chore(deps): bump varlock from 0.7.4 to 1.9.0

[dependabot]

Bumps varlock from 0.7.4 to 1.9.0.

Release notes

Sourced from varlock's releases.

varlock v1.9.0

• #835 (minor) - Add varlock keychain commands to manage macOS Keychain-backed secrets.

• #830 (patch) Improved audit and init env var scanning in monorepos:

  • Scanning no longer descends into child packages — any subdirectory with its own package.json or .env.schema is treated as a separate package and skipped. This fixes spurious results and makes scanning much faster.
  • Pure execution-environment plumbing (PATH, HOME, SHELL, NODE_OPTIONS, npm_*, etc.) is no longer reported as "missing in schema" by audit, nor added to inferred schemas by init. App-meaningful vars like NODE_ENV and CI variables are still reported.

Published to

• ✅ npm

varlock v1.8.0

• #817 (minor) - Add @​internal decorator to mark items used only by varlock (e.g. a secret-zero token) so they are resolved but not injected into your app
• #818 (minor) - Enrich CLI telemetry with plugin, integration, and schema feature context.
• #811 (patch) - Stop UPX on Windows native encrypt binary, sign via Azure Artifact Signing, and publish SHA256SUMS for native helpers
• #812 (patch) - varlock run now forwards termination signals (SIGTERM/SIGINT/SIGHUP/SIGQUIT) to the child process and propagates its exit status faithfully (128+N on signal death), making it safe to use as a container ENTRYPOINT / PID 1
• #799 (patch) - Update gunshi to 0.35. varlock cache status/clear are now proper subcommands with scoped help and completion, and printenv/explain/reveal/scan/audit now declare their positional arguments so they appear in --help and shell completion.

Published to

• ✅ npm

varlock v1.7.2

• #808 (patch) - Bundle the varlock agent skill in the npm package so agents can discover version-pinned guidance from node_modules
• #809 (patch) - Detect circular @​import() between schemas and fail with a clear error instead of crashing

... (truncated)

Changelog

Sourced from varlock's changelog.

1.9.0

2026-06-25

• #835 (minor) - Add varlock keychain commands to manage macOS Keychain-backed secrets.

• #830 (patch) Improved audit and init env var scanning in monorepos:

  • Scanning no longer descends into child packages — any subdirectory with its own package.json or .env.schema is treated as a separate package and skipped. This fixes spurious results and makes scanning much faster.
  • Pure execution-environment plumbing (PATH, HOME, SHELL, NODE_OPTIONS, npm_*, etc.) is no longer reported as "missing in schema" by audit, nor added to inferred schemas by init. App-meaningful vars like NODE_ENV and CI variables are still reported.

1.8.0

2026-06-23

• #817 (minor) - Add @​internal decorator to mark items used only by varlock (e.g. a secret-zero token) so they are resolved but not injected into your app
• #818 (minor) - Enrich CLI telemetry with plugin, integration, and schema feature context.
• #811 (patch) - Stop UPX on Windows native encrypt binary, sign via Azure Artifact Signing, and publish SHA256SUMS for native helpers
• #812 (patch) - varlock run now forwards termination signals (SIGTERM/SIGINT/SIGHUP/SIGQUIT) to the child process and propagates its exit status faithfully (128+N on signal death), making it safe to use as a container ENTRYPOINT / PID 1
• #799 (patch) - Update gunshi to 0.35. varlock cache status/clear are now proper subcommands with scoped help and completion, and printenv/explain/reveal/scan/audit now declare their positional arguments so they appear in --help and shell completion.

1.7.2

2026-06-19

• #806 (patch) - Fix typegen leaking keys that exist only in a plain .env (not declared in .env.schema) into generated types. varlock typegen now also reports any such ignored keys.
• #809 (patch) - Detect circular @​import() between schemas and fail with a clear error instead of crashing
• #808 (patch) - Bundle the varlock agent skill in the npm package so agents can discover version-pinned guidance from node_modules

1.7.1

2026-06-17

• #790 (patch) - Fix typed builtin vars (e.g. boolean VARLOCK_IS_CI) being stringified when referenced from root decorators like @import/@​initOp, which broke not()/if() logic
• #794 (patch) - Object and array literals can now span multiple lines. Inside decorators each continuation line is prefixed with # (like multi-line function calls), e.g. a long @import(./.env.shared, pick=[ ... ]) key list; literals nested in item-value function calls use plain newlines. Single-line literals are unchanged. Multi-line literals and function calls also support # comments — full-line entries can be commented out (# # OLD_KEY,) and individual entries annotated with trailing comments (# KEY, # note). The VSCode extension's syntax highlighting now understands object/array literals (single- and multi-line) and these inline comments.

1.7.0

2026-06-16

• #783 (minor) - Add per-item leak-detection opt-out via @sensitive={preventLeaks=false}. Secrets that legitimately leave the system (e.g. an API endpoint that returns a secret to another service) can be excluded from runtime leak detection while still being redacted in logs. The options form also accepts enabled to toggle sensitivity (including dynamically, e.g. @sensitive={enabled=forEnv(production)}). Adds standalone object ({key=value}) and array ([a, b, c]) literals to the env-spec grammar, usable as decorator values and function-call arguments (including nested). () remains reserved for function calls.
• #786 (minor) - @setValuesBulk and @import support pick/omit key filters. Filter which keys are brought in with pick (allowlist) or omit (denylist) array args — e.g. @setValuesBulk(opLoadEnvironment(env-id), pick=[API_KEY, DB_*]) or @import(./.env.shared, omit=[LEGACY_TOKEN]). By default every key is included; pick and omit can't be combined, and both accept simple globs (*, ?). For @import, listing keys as positional args (@import(./.env.shared, KEY1, KEY2)) is now deprecated in favor of pick=[...] — it still works but warns.

1.6.1

2026-06-11

• #770 (patch) - Fix: varlock run no longer breaks interactive TTY tools (psql, claude, etc.). Previously redaction always piped stdout/stderr, which broke raw-TTY behavior unless you passed --no-redact-stdout. Redaction is now auto-detected per stream: output attached to an interactive terminal passes through directly (preserving raw TTY behavior), while piped or redirected output (CI logs, files, pipes) is still redacted — that's where leaked secrets actually persist. Detection is per stream, so varlock run -- app | tee log.txt redacts stdout while stderr (still on the terminal) passes through.
  • Add --redact-stdout / _VARLOCK_REDACT_STDOUT to override the auto-detection: force redaction of piped output (e.g. to override @redactLogs=false). Forcing redaction while attached to an interactive terminal errors, since it isn't possible without breaking TTY behavior. The flag takes precedence over the env var.
  • Fix a leak where a secret split across stream chunk boundaries escaped redaction.

... (truncated)

Commits

• 01a7abb Version packages (#836)
• 5637ef1 fix(varlock): scope audit/init env scanning in monorepos (#830)
• 431902e feat: add keychain CLI commands (#835)
• 2bf2443 fix(ci): gitignore generated SHA256SUMS.txt so release publish isn't blocked ...
• 289dc74 Version packages (#815)
• 023fda1 collect anonymous plugin, integration, and package manager data (#818)
• f2d9861 astro7 + cloudflare adapter compat (#823)
• e352fed Update gunshi to 0.35; nested cache subcommands, positional & hidden args (#799)
• 87722a7 Add @​internal decorator to exclude items from app injection (#817)
• b4a6c9b fix(run): forward signals to child and propagate exit status (#812)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	varlock@​0.7.4 ⏵ 1.9.0	+1		+1	+1

View full report

[dependabot]

Superseded by #134.