[bumpy-bot]

This PR was created and will be kept in sync by bumpy based on your bump files (in .bumpy/). Merge it when you are ready to release the packages listed below:

Minor releases

@varlock/aws-secrets-plugin 1.2.5 → 1.3.0 _CHANGELOG.md

• awsSecret() and awsParam() can read nested JSON values with a dot-separated key, such as awsSecret("db-config#db.host"). An exact top-level key with the same name still takes precedence. (bump file)

varlock 1.24.0 → 1.25.0 _CHANGELOG.md

• Proxy: response scrubbing and body substitution no longer corrupt non-UTF-8 bodies (e.g. Go checksum database tiles served as text/plain), HEAD responses keep their content-length, and 206 partial responses are no longer rewritten (bump file)
• varlock audit now detects ENV.KEY (from @generatePythonEnv) and os.environ.get() reads in Python files (bump file)
• Fix CLI calls occasionally losing stdout/stderr when the command exits quickly under load, which could surface as a vague "unknown" error instead of the real one (bump file)
• Reusing an injected env blob (auto-load under varlock run) now also re-resolves when an env file it would load, like .env.local, was created after the blob was made (bump file)
• Accept VARLOCK_ENV_KEY (and the other _VARLOCK_* config vars without the leading underscore) for platforms like AWS Lambda that reject env var names starting with _ (bump file)
• Native helper packages (@varlock/native-helper-*) are now versioned independently and only re-released when their binaries change. varlock still pins exact helper versions. (bump file)
• Fix varlock run and varlock proxy run dropping piped output: output still unread when the command exits, output from background processes it started, and output that a slow reader had not consumed within 1 second (bump file)
• Fix varlock run corrupting multi-byte UTF-8 characters split across chunks of piped output (bump file)
• A dependency cycle is now reported even when another item has a schema error, instead of the load stopping with "varlock stopped before the command finished" (bump file)
• Resolving a large schema no longer slows down quadratically with the number of items (3,000 items: about 245 ms to 50 ms) (bump file)
• Key globs with many * (in pick/omit, --filter and @auditIgnoreKeys) no longer take seconds or minutes to match (bump file)
• An error from a decorator's value (for example @required=forEnv(prod) when the current environment is not set) is reported once instead of twice (bump file)
• An item reached by several resolvers at the same time is resolved and validated once instead of once per caller (bump file)
• Add built-in timeZone data type that validates IANA time zone names. Rename the simple-object data type to simpleObject so all built-in type names are camelCase (simple-object still works but logs a deprecation warning). (bump file)
• Generated C# modules now decrypt @encryptInjectedEnv blobs using _VARLOCK_ENV_KEY, instead of rejecting them. (bump file)

Patch releases

@env-spec/parser 0.6.2 → 0.6.3 _CHANGELOG.md

• Fix item and syntax error offsets being wrong for files that use Windows (CRLF) line endings (bump file)

@varlock/1password-plugin 2.0.6 → 2.0.7 _CHANGELOG.md

• Fix CLI calls occasionally losing stdout/stderr when the command exits quickly under load, which could surface as a vague "unknown" error instead of the real one (bump file)

@varlock/astro-integration 1.4.5 → 1.4.6 (cascade) _CHANGELOG.md

• Version bump via cascade rule

@varlock/azure-key-vault-plugin 1.3.1 → 1.3.2 _CHANGELOG.md

• Fetch the Azure access token once per service when resolving many secrets at once, run az account get-access-token without blocking other requests, and read the Azure CLI token cache from AZURE_CONFIG_DIR when set (bump file)

@varlock/bitwarden-plugin 2.0.2 → 2.0.3 _CHANGELOG.md

• Fix CLI calls occasionally losing stdout/stderr when the command exits quickly under load, which could surface as a vague "unknown" error instead of the real one (bump file)

@varlock/cloudflare-integration 1.6.3 → 1.6.4 _CHANGELOG.md

• The deprecated varlockSvelteKitCloudflarePlugin now uses the same adapter detection as varlockVitePlugin() (fixing vite dev on adapter-cloudflare 8) and logs a deprecation warning (bump file)

@varlock/keepass-plugin 2.0.4 → 2.0.5 _CHANGELOG.md

• Fix CLI calls occasionally losing stdout/stderr when the command exits quickly under load, which could surface as a vague "unknown" error instead of the real one (bump file)

@varlock/nextjs-integration 2.0.0 → 2.0.1 _CHANGELOG.md

• Accept VARLOCK_ENV_KEY (and the other _VARLOCK_* config vars without the leading underscore) for platforms like AWS Lambda that reject env var names starting with _ (bump file)
• Fix frozen builds exiting at boot on Vercel, where Next.js leaves the config env out of the build output. Rewritten Turbopack runtime files now also get matching content hashes in the build's file traces. (bump file)

@varlock/nuxt-integration 0.1.5 → 0.1.6 _CHANGELOG.md

• Stop re-resolving env (and re-triggering auth prompts like 1Password) when the Nuxt dev server shuts down or reloads without an env file change (bump file)

@varlock/pass-plugin 1.0.3 → 1.0.4 _CHANGELOG.md

• Fix CLI calls occasionally losing stdout/stderr when the command exits quickly under load, which could surface as a vague "unknown" error instead of the real one (bump file)

@varlock/proton-pass-plugin 2.0.2 → 2.0.3 _CHANGELOG.md

• Fix CLI calls occasionally losing stdout/stderr when the command exits quickly under load, which could surface as a vague "unknown" error instead of the real one (bump file)

@varlock/vite-integration 1.5.5 → 1.5.6 _CHANGELOG.md

• Reload env values on the first dev server restart when Vite's root is not the working directory (bump file)
• Fix vite dev 500s on SvelteKit with adapter-cloudflare 8 ("no __VARLOCK_ENV binding found"): the Workers env loader is now only injected into builds (bump file)
• Dev server restarts only re-resolve env when an env file changed or was created, or the last load failed, and startup reuses env already resolved by varlock/auto-load, so plugin resolvers run once instead of several times (bump file)

env-spec-language 0.5.0 → 0.5.1 _CHANGELOG.md

• Add built-in timeZone data type that validates IANA time zone names. Rename the simple-object data type to simpleObject so all built-in type names are camelCase (simple-object still works but logs a deprecation warning). (bump file)

[github-actions]

📦 Bundle size vs last published release

⚠️ grows the bundle by 66.5 KB (+1.3%)

Metric	v1.24.0 (published)	This release	Δ
Total dist	5173.1 KB	5239.6 KB	+66.5 KB (+1.3%)
JS	1975.4 KB	1998.6 KB	+23.1 KB (+1.2%)
Sourcemaps	3060.5 KB	3097.1 KB	+36.5 KB (+1.2%)
Type defs	137.1 KB	143.9 KB	+6.8 KB (+5.0%)
Other	0.0 KB	0.0 KB	—

dist/ only; native binaries are versioned separately and not counted here.