🐸 Versioned release

[bumpy-bot]

This PR was created and will be kept in sync by bumpy based on your bump files (in .bumpy/). Merge it when you are ready to release the packages listed below:

Minor releases

@varlock/native-helper-darwin 1.17.1 → 1.18.0 _CHANGELOG.md

@varlock/native-helper-linux-arm64 1.17.1 → 1.18.0 _CHANGELOG.md

@varlock/native-helper-linux-x64 1.17.1 → 1.18.0 _CHANGELOG.md

@varlock/native-helper-win32-x64 1.17.1 → 1.18.0 _CHANGELOG.md

env-spec-language 0.3.3 → 0.4.0 _CHANGELOG.md

• Add completions and diagnostics for the new domain data type (bump file)
• Added allowed protocol validation for URL values. (bump file)

varlock 1.17.1 → 1.18.0 _CHANGELOG.md

• Fix leak detection missing sensitive values split across response chunks (bump file)
• Fix encrypt --file crashing when confirming values to encrypt (bump file)
• auto-load and framework integrations no longer pass NODE_OPTIONS to the varlock CLI subprocess, so preloaded modules (e.g. NODE_OPTIONS="-r next-logger") can no longer corrupt its output and crash env loading (bump file)
• Behavior change: schema items that resolve to undefined are no longer injected into process.env as empty strings by auto-load, matching varlock run and the documented VAR= semantics (so process.env.MY_VAR ?? 'fallback' works). varlock load --format shell now also skips them. If your code relies on unset vars being "", add # @injectUndefinedAsEmpty to your .env.schema header to restore the old behavior; when set, generated types mark process.env keys as always-present strings (optional enums become "a" | "b" | ""). (bump file)
• New domain data type for validating bare domain names (hostnames), with options for wildcards, single-label hostnames, IPv4 values (for HOST-style vars), lowercasing, and regex matching (bump file)
• Added allowed protocol validation for URL values. (bump file)
• Proxy: a placeholder appearing in a request surface its rule doesn't substitute in (e.g. the body under the default header-only targets) is now skipped (forwarded unsubstituted) and logged as a skipped-placeholder audit event, instead of blocking the request. Blocking still applies to occurrences off the named path/param within a body: or query: target. (bump file)
  The maxOccurrences option has been removed. Each substituteIn target is now worth one substitution per request, so listing a target is what grants it an occurrence: an API that carries the secret in two places just names both (substituteIn=["header:authorization", "body:signature"]) instead of raising a count. A repeat at the same target still blocks. Setting maxOccurrences is now a schema error that points at the replacement.
• Fix @currentEnv from an import losing to the --env fallback when loading a directory's own .env.[env] files (bump file)

[pullfrog]

This run croaked 😵

The workflow encountered an error before any progress could be reported. Please check the link below for details.

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ 𝕏}

[github-actions]

📦 Bundle size vs last published release

⚠️ grows the bundle by 78.3 KB (+1.9%)

Metric	v1.17.1 (published)	This release	Δ
Total dist	4049.8 KB	4128.2 KB	+78.3 KB (+1.9%)
JS	1566.7 KB	1596.7 KB	+30.0 KB (+1.9%)
Sourcemaps	2398.6 KB	2446.2 KB	+47.6 KB (+2.0%)
Type defs	84.6 KB	85.2 KB	+0.7 KB (+0.8%)
Other	0.0 KB	0.0 KB	—

dist/ only; native binaries are versioned separately and not counted here.