dmno-dev/varlock varlock@1.19.0

varlock v1.19.0

on GitHub

• #1075 (minor) Thanks @DavideCarvalho!
  varlock audit can now be taught project-specific env access patterns with @auditExtraPatterns(), for code that reads env vars through a wrapper like configService.get('KEY'). Add fileTypes=[tf, yaml] to a call to limit its patterns to those file types, which is also how the scan reaches file types it skips by default, such as Terraform or Helm values. @auditIgnorePaths() and varlock audit --ignore can now exclude one specific directory, written as a path (./apps/docs, ../, ~/, or absolute) instead of only a bare directory name that matches everywhere it appears. A path written without one of those prefixes, or resolving outside the scanned directory, used to silently exclude nothing and is now an error that names the fix. Also fixes the scanner reporting commented-out code inside template literal interpolations (${/* ... */ ...}) as live env references.
• #1082 (minor) - New domainFromUrl() function to extract the host from a URL, and a new allowIpV6 option on the domain type
• #1068 (minor)
  Plugin cache: getOrSet now accepts a TTL callback, so a plugin can set the cache lifetime from the value it just fetched (an STS session, an OAuth token, a lease). Also fixes plugin caching to respect the cache mode set via the @cache root decorator.
• #1008 (minor)
  Credential proxy: added request transforms, which let the proxy compute a request's credential itself rather than substituting a placeholder. HMAC signing and Basic auth are built in, and plugins can contribute new transformations.
• #1054 (minor)
  Check that a value marked sensitive can actually be protected by redaction, which replaces it wherever it appears. Values under 12 characters warn. Values under 3 characters, booleans, numbers, composites with non-string elements, and the @currentEnv item are an error when you wrote @sensitive on the item, and a warning when @defaultSensitive swept it in, so nothing inherited from the default can fail a load. For a number, make it a string to keep leading zeros and precision. Composite values are checked per element, since redaction registers each element on its own. A non-sensitive value that contains a sensitive one now warns. Acknowledge a legitimately short secret with @sensitive={allowShortValue=true}; it does not apply under 3 characters. Also fixes sensitive values that are not strings, and the pre-coercion form of a coerced value, being shown unredacted in CLI output.
• #1060 (patch) - Find the Varlock CLI next to Bun-compiled workspace executables.
• #1064 (patch)
  Data type fixes. @type=enum now matches numeric and boolean members against string values from process.env and overrideValues, so LEVEL=2 or FLAG=true from CI satisfies enum(1, 2, 3) / enum(true, false). @type=url matches allowedDomains in full against the URL host instead of as a substring, which previously let example.com pass an allowlist of myexample.com; write two or more hosts as an array (allowedDomains=[a.com, b.com]), since a comma inside a single string now errors and names the array to use. An allowedDomains entry without a port now allows any port, so allowedDomains=[localhost] accepts http://localhost:3000; add a port to pin it. Each entry must be a hostname with an optional port; an empty list, or a scheme, path, or credentials in an entry, now errors instead of silently matching the wrong host or nothing at all. VS Code diagnostics for allowedDomains, allowedProtocols and noTrailingSlash were reporting different results than an actual load, and now match. @env-spec/parser exports autoCoerce so tooling can classify unquoted values exactly as the parser does. @type=url(noTrailingSlash=true) now also catches a trailing slash that is followed by a query string or hash, such as https://example.com/path/?q=1. @type=ip(version=6) accepts IPv4-mapped addresses like ::ffff:192.168.1.1. @type=md5 accepts uppercase hex and normalizes it to lowercase. @type=port rejects non-integers such as 80.5.
• #1072 (patch) - Report loading/parse errors before resolving values, instead of crashing with expected dataType to be set
• #1066 (patch)
  @currentEnv=$FLAG can now reference a key brought in by @import, including a partial import that lists the flag in pick=[...]. Previously the flag had to be defined in the same file, which broke monorepo schemas that import a shared DEPLOY_ENV. A missing flag still errors, now naming the import as a way to provide it. An auto-loaded .env value on its own does not satisfy the flag or trigger .env.<env> loading. A @currentEnv declared in an imported file now also carries through a partial import when the flag is included in the filter. Directory imports declared before the import that provides the flag are rejected with an error asking you to reorder.
• #1079 (patch)
  varlock load/run no longer spawns the native encryption helper unless encrypted values or the disk cache are actually used. Fixes multi-second startup on WSL 2 for projects with no encrypted values.
• #1065 (patch)
  A leak detected in ServerResponse.end no longer leaves the HTTP client hanging. The response is finished before the leak error is rethrown (a plaintext 500 if the headers have not gone out yet, otherwise the connection is closed), so a Next.js Pages Router res.json() that would have leaked a sensitive value fails the request instead of stalling the client on a body that never arrives.

Published to

• ✅ npm