2026-08-31
- #1051 (patch)
Fix "exports is not defined in ES module scope" when using varlockNextConfigPlugin in a next.config.ts file. varlock now ships CJS builds of its runtime entry points (varlock/env, varlock/patch-console, varlock/patch-server-response, varlock/encrypt-env, varlock/exec-sync-varlock) via the
requirecondition, so requiring them from CommonJS works through Next's TypeScript config loader and on Node versions without require(esm) support (below 22.12).
2026-08-25
- #987 (patch) Fix package.json entry points - remove references to files that were never built and declare import/require conditions explicitly
- #1030 (patch) The env reload log now reports "no changes found" correctly. It previously always said "changes found", because the comparison also picked up formatting and internal bookkeeping that shift on every reload
- #1021 (patch) - Build with tsdown instead of tsup; published files now use explicit .mjs/.cjs extensions.
2026-07-28
- #750 (minor) - Add static/dynamic config controls and dynamic+public framework/runtime support
2026-07-16
- #886 (patch) Thanks @mhornbacher! Preserve all "use ..." directives (e.g. "use cache", "use cache: remote", "use workflow", "use memo") including stacked ones, instead of only a fixed set
2026-07-15
- #884 (patch) Detect FIFO/non-regular env sources (e.g. 1Password Environments) and disable watching and reload checks for them, fixing dev-server hangs and repeated reload logs
- #881 (patch) - Warn when deploying to Vercel without encryption enabled for the injected env blob
2026-07-06
- #857 (patch)
Fix dev-server env file reloading on turbopack and Next 16. Two issues: (1) on Next 16 only the render worker calls
loadEnvConfig, so the extra env-file watchers were never installed — watcher ownership is now claimed by whichever process loads env first; (2) on turbopack, non-sensitiveENV.xvalues were statically inlined into server files at compile time, so reloaded values were never served — in dev, server-side (node runtime) files now read env through the runtime proxy, which stays fresh across reloads. Client components and edge files still inline values (required), so those keep needing a page refresh after a full recompile. - #860 (patch) fix turbopack static ENV replacement corrupting ENV.x references inside string literals and comments — replacement is now AST-based, matching the vite integration
- #861 (patch) Fix pages router and middleware support: webpack builds no longer fail on pages-router files, pages-router SSR picks up reloaded env values in turbopack dev, middleware no longer crashes the dev server or gets rejected by Vercel's edge bundle analyzer, works with turbopack dev on Next 15.5+, and encrypted deployments now work in middleware and edge routes
2026-06-03
- #656 (patch) - add @encryptInjectedEnv and @disableProcessEnvInjection root decorators for encrypted deployments
2026-05-29
- #723 (patch) - Improve env reload feedback in Cloudflare and Next.js integrations, including explicit logs when watched source changes produce no effective env changes.
2026-05-24
- #708 - next-env-compat improvements
- #713 - fix: preserve initial env vars in nextjs dev error path to prevent v15 turbopack from exiting
2026-05-02
- #681 - Add --summary-stderr/--summary-file flags to varlock load and fullResult option to execSyncVarlock
2026-04-29
- Bump to avoid conflict with accidental 1.0.0 publish (long time ago)
2026-04-29
- Updated dependency
varlockv1.0.0
2026-04-23
- #651 - bundle varlock into next-env-compat and skip CLI exec at runtime on serverless platforms
2026-04-23
- #649 - bundle varlock into next-env-compat and skip CLI exec at runtime on serverless platforms
2026-04-23
- #647 - bundle varlock into next-env-compat to fix Vercel module resolution
-
#553
6ab2d31- Fix diamond dependency handling when the same schema is imported via multiple paths. Previously, duplicate imports caused plugin init decorators to run twice ("Instance already initialized" error). Now, duplicate imports create lightweightImportAliasSourcenodes that appear at the correct precedence position without re-initializing the source. This correctly handles different importKeys subsets across import sites and preserves override semantics matching non-deduplicated behavior. Also addstypefield to serialized source entries for easier filtering. -
Updated dependencies [
2022ef7,74752a3,0ea6641,6ab2d31,01c9a6a,1a4b0cf,02e82d0,0c27ed1]:- varlock@0.7.2
-
#508
04b81a3Thanks @melkir! - - fix: publicENV.*replacement now works in'use client'components under Turbopack — the loader previously bailed out early for client modules, skipping the static replacement pass entirely -
Updated dependencies [
ba61adb,6fe325d,76c17f8,7f32751]:- varlock@0.7.0
-
#443
a271d6a- Improved loader caching: only disable cache for files that referenceENV.(turbopack only), allowing most files to benefit from build caching. Updated docs and README to reflect full Next.js 15/16 and Turbopack support. -
Updated dependencies [
57f0e04]:- varlock@0.6.1
- Updated dependencies [
e30ec1f]:- varlock@0.4.0
- Updated dependencies [
1a42d3f,6b64a4f,98fccd6,9d8302f,2af0b2f,2d15354,ccff56b,2af0b2f]:- varlock@0.3.0
- Updated dependencies [
c872e71,fe893e2,15b9c81,e5c7d24,bcba478,558360a,50c4ad4,c0d9942]:- varlock@0.2.0
-
#163
8d31513- fix issue with executable path when running directly instead of via package manager -
Updated dependencies [
b6fc6dd,8d31513]:- varlock@0.0.15
- Updated dependencies [
9d9c8de]:- varlock@0.0.13
- Updated dependencies [
330bd92]:- varlock@0.0.11
- Updated dependencies [
17206e8]:- varlock@0.0.10
- Updated dependencies [
186d6ed]:- varlock@0.0.6
-
#63
bde6758- detect turbopack and throw an error if using plugin -
Updated dependencies [
eb27ce8,6c1065f]:- varlock@0.0.4
- Updated dependencies [
9e7b898]:- varlock@0.0.3