dmno-dev/varlock varlock@0.9.0

on GitHub

Minor Changes

• #615 9c38e3a - Add --no-inject-graph CLI flag to varlock run to opt out of injecting the __VARLOCK_ENV serialized config graph into the child process environment. This prevents sensitive values from being exposed via environment inspection (e.g., env, printenv) in interactive shells, long-lived processes, or LLM-driven agents.

Patch Changes

• #627 f93c23f - Fix: escape */ sequences in item descriptions to prevent premature JSDoc comment closure in generated TypeScript types

• #622 6f90d87 - Fix leak detection for Uint8Array/ArrayBuffer response bodies

  scanForLeaks now detects secrets in Uint8Array, ArrayBufferView, and ArrayBuffer values. Previously these fell through unscanned, so secrets returned as binary-encoded response bodies (common in Cloudflare Workers) were not caught.