chore(deps): bump varlock from 0.7.4 to 1.7.2

[dependabot]

Bumps varlock from 0.7.4 to 1.7.2.

Release notes

Sourced from varlock's releases.

varlock v1.7.2

• #808 (patch) - Bundle the varlock agent skill in the npm package so agents can discover version-pinned guidance from node_modules
• #809 (patch) - Detect circular @​import() between schemas and fail with a clear error instead of crashing
• #806 (patch) - Fix typegen leaking keys that exist only in a plain .env (not declared in .env.schema) into generated types. varlock typegen now also reports any such ignored keys.

Published to

• ✅ npm

varlock v1.7.1

• #790 (patch) - Fix typed builtin vars (e.g. boolean VARLOCK_IS_CI) being stringified when referenced from root decorators like @import/@​initOp, which broke not()/if() logic
• #794 (patch) - Object and array literals can now span multiple lines. Inside decorators each continuation line is prefixed with # (like multi-line function calls), e.g. a long @import(./.env.shared, pick=[ ... ]) key list; literals nested in item-value function calls use plain newlines. Single-line literals are unchanged. Multi-line literals and function calls also support # comments — full-line entries can be commented out (# # OLD_KEY,) and individual entries annotated with trailing comments (# KEY, # note). The VSCode extension's syntax highlighting now understands object/array literals (single- and multi-line) and these inline comments.

Published to

• ✅ npm

varlock v1.7.0

• #783 (minor) - Add per-item leak-detection opt-out via @sensitive={preventLeaks=false}. Secrets that legitimately leave the system (e.g. an API endpoint that returns a secret to another service) can be excluded from runtime leak detection while still being redacted in logs. The options form also accepts enabled to toggle sensitivity (including dynamically, e.g. @sensitive={enabled=forEnv(production)}). Adds standalone object ({key=value}) and array ([a, b, c]) literals to the env-spec grammar, usable as decorator values and function-call arguments (including nested). () remains reserved for function calls.
• #786 (minor) - @setValuesBulk and @import support pick/omit key filters. Filter which keys are brought in with pick (allowlist) or omit (denylist) array args — e.g. @setValuesBulk(opLoadEnvironment(env-id), pick=[API_KEY, DB_*]) or @import(./.env.shared, omit=[LEGACY_TOKEN]). By default every key is included; pick and omit can't be combined, and both accept simple globs (*, ?). For @import, listing keys as positional args (@import(./.env.shared, KEY1, KEY2)) is now deprecated in favor of pick=[...] — it still works but warns.

... (truncated)

Changelog

Sourced from varlock's changelog.

1.7.2

2026-06-19

• #806 (patch) - Fix typegen leaking keys that exist only in a plain .env (not declared in .env.schema) into generated types. varlock typegen now also reports any such ignored keys.
• #809 (patch) - Detect circular @​import() between schemas and fail with a clear error instead of crashing
• #808 (patch) - Bundle the varlock agent skill in the npm package so agents can discover version-pinned guidance from node_modules

1.7.1

2026-06-17

• #790 (patch) - Fix typed builtin vars (e.g. boolean VARLOCK_IS_CI) being stringified when referenced from root decorators like @import/@​initOp, which broke not()/if() logic
• #794 (patch) - Object and array literals can now span multiple lines. Inside decorators each continuation line is prefixed with # (like multi-line function calls), e.g. a long @import(./.env.shared, pick=[ ... ]) key list; literals nested in item-value function calls use plain newlines. Single-line literals are unchanged. Multi-line literals and function calls also support # comments — full-line entries can be commented out (# # OLD_KEY,) and individual entries annotated with trailing comments (# KEY, # note). The VSCode extension's syntax highlighting now understands object/array literals (single- and multi-line) and these inline comments.

1.7.0

2026-06-16

• #783 (minor) - Add per-item leak-detection opt-out via @sensitive={preventLeaks=false}. Secrets that legitimately leave the system (e.g. an API endpoint that returns a secret to another service) can be excluded from runtime leak detection while still being redacted in logs. The options form also accepts enabled to toggle sensitivity (including dynamically, e.g. @sensitive={enabled=forEnv(production)}). Adds standalone object ({key=value}) and array ([a, b, c]) literals to the env-spec grammar, usable as decorator values and function-call arguments (including nested). () remains reserved for function calls.
• #786 (minor) - @setValuesBulk and @import support pick/omit key filters. Filter which keys are brought in with pick (allowlist) or omit (denylist) array args — e.g. @setValuesBulk(opLoadEnvironment(env-id), pick=[API_KEY, DB_*]) or @import(./.env.shared, omit=[LEGACY_TOKEN]). By default every key is included; pick and omit can't be combined, and both accept simple globs (*, ?). For @import, listing keys as positional args (@import(./.env.shared, KEY1, KEY2)) is now deprecated in favor of pick=[...] — it still works but warns.

1.6.1

2026-06-11

• #770 (patch) - Fix: varlock run no longer breaks interactive TTY tools (psql, claude, etc.). Previously redaction always piped stdout/stderr, which broke raw-TTY behavior unless you passed --no-redact-stdout. Redaction is now auto-detected per stream: output attached to an interactive terminal passes through directly (preserving raw TTY behavior), while piped or redirected output (CI logs, files, pipes) is still redacted — that's where leaked secrets actually persist. Detection is per stream, so varlock run -- app | tee log.txt redacts stdout while stderr (still on the terminal) passes through.
  • Add --redact-stdout / _VARLOCK_REDACT_STDOUT to override the auto-detection: force redaction of piped output (e.g. to override @redactLogs=false). Forcing redaction while attached to an interactive terminal errors, since it isn't possible without breaking TTY behavior. The flag takes precedence over the env var.
  • Fix a leak where a secret split across stream chunk boundaries escaped redaction.
  • Exclude all reserved _VARLOCK_* keys from the injected env blob, generated types, and override provenance (previously only _VARLOCK_ENV_KEY / _VARLOCK_CACHE_KEY were excluded), and scope override provenance to actual schema config keys instead of mirroring every process.env key. Warn when a user defines a config item using the reserved _VARLOCK_ prefix.

1.6.0

2026-06-10

• #577 (minor) - - Add caching system: cache() resolver, plugin cache API, encrypted JSON store (file mode 0600), varlock cache CLI with TTY-aware browser and --yes confirm for clear.
  • Cache TTLs use the shared duration format; "forever" caches until manually cleared (the default for cache()), setting a plugin's cacheTtl to false (or an empty string) disables caching, and a TTL of 0 is rejected as ambiguous.
  • Cached values are individually encrypted and bound to their cache key, so entries cannot be swapped or replayed within the cache file.
  • --clear-cache always clears the persistent disk cache, including when combined with --skip-cache; @cache=disk warns when used in CI or with the file-based encryption fallback.
  • Add random value generators backed by node:crypto: randomNum() (integer by default, float when precision is set), randomUuid(), randomHex() (string-length by default, bytes=true for byte-length), randomString() (uses rejection sampling for unbiased output across any charset).
  • Add duration data type: accepts flexible string/number input ("1h", "30m", "500ms", 2000, "2days") and coerces to a number in a configurable output unit (ms default; seconds, minutes, hours, days, weeks). Only plain decimal number formats are accepted, and sub-millisecond durations are rejected. Same parser is used by cache(..., ttl=...) and the plugin cacheTtl option.
  • When _VARLOCK_CACHE_KEY is set (e.g. as a CI secret; same format as _VARLOCK_ENV_KEY, but a separate var since that one can be ephemeral), auto cache mode uses a disk cache encrypted with that key instead of falling back to memory — enabling shared caching across CI processes without the key ever touching disk. Each key gets its own cache file, named by key fingerprint.
  • @cache can be set dynamically with functions (e.g. @cache=forEnv(dev, "disk")); invalid resolved values surface as schema errors.
  • Plaintext is passed to the native encryption binary via stdin instead of argv so it never appears in process listings (the macOS enclave binary gained --data-stdin support); debug logging no longer includes encrypt/decrypt payloads.
  • Plugin opt-in caching via cacheTtl is documented per plugin — see the plugin packages' own changelogs.
• #757 (patch) Thanks @​yinjs! - fix: treat whitespace-only lines as blank lines instead of throwing a parse error
• #756 (patch) - Preserve process.env override provenance across nested invocations so varlock run-injected resolved values are no longer treated as true overrides by inner varlock loads. Only real upstream overrides now propagate through nesting, while inner command-local overrides still win as expected. Also fixes smoke-test CLI resolution to use the workspace-local varlock CLI instead of any globally installed binary.

... (truncated)

Commits

• 3a54b51 Version packages (#804)
• e53d050 Bundle agent skill in npm package + generate .well-known discovery (#808)
• 843631d fix(env-graph): detect circular @​import() and fail cleanly (#809)
• 2f265c0 fix(typegen): don't leak undeclared .env keys into generated types (#806)
• 89e8de7 Friendlier init message when EXAMPLE_ITEM is left in schema (#802)
• a4ba859 Version packages (#791)
• eb288c5 feat(parser): multi-line object/array literals with comments (#794)
• e2381b7 fix(varlock): preserve typed builtin vars referenced from root decorators (#790)
• 1eae294 Version packages (#785)
• 8d2424f feat(varlock): pick/omit key filters for @​setValuesBulk and @​import (#786)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	varlock@​0.7.4 ⏵ 1.7.2			+1	+1

View full report

[dependabot]

Superseded by #130.