chore(deps): bump varlock from 1.16.1 to 1.17.0

[dependabot]

Bumps varlock from 1.16.1 to 1.17.0.

Release notes

Sourced from varlock's releases.

varlock v1.17.0

• #1006 (minor) Native local-encryption helper binaries now ship as per-platform optional dependencies (@​varlock/native-helper-*), so npm installs only download the binaries for your own platform (on Linux this includes the Windows helper, which WSL needs)
• #1013 (minor) printenv: new --template flag renders a string template with resolved values (with optional --escape json), e.g. auth headers JSON for an MCP headersHelper
• #1000 (patch) Exit cleanly instead of crashing when CLI output is piped into a consumer that closes early (e.g. varlock flatten | head -3)
• #993 (patch) - true
• #1007 (patch) varlock flatten no longer needs to detect a workspace root - any @​import path that resolves on disk is flattened, including in non-JS monorepos
• #1004 (patch) Ship the Linux local-encryption helper binaries uncompressed. UPX packing caused antivirus false positives (Defender Wacatac.C!ml) during install.
• #1016 (patch) Redact sensitive values from Error objects passed to console methods, and fix console redaction of plain objects that could not survive a JSON round-trip (nested errors, circular references, bigints, dates)
• #1015 (patch) - Replace the semver dependency with verkit, a smaller tree-shakeable alternative
• #1007 (patch) Clearer errors for Windows-style @import/@​plugin paths, which are not supported (use forward slashes, or a relative/~ path instead of a drive letter)

Published to

• ✅ npm

Changelog

Sourced from varlock's changelog.

1.17.0

2026-08-18

• #1013 (minor) printenv: new --template flag renders a string template with resolved values (with optional --escape json), e.g. auth headers JSON for an MCP headersHelper
• #1006 (minor) Native local-encryption helper binaries now ship as per-platform optional dependencies (@​varlock/native-helper-*), so npm installs only download the binaries for your own platform (on Linux this includes the Windows helper, which WSL needs)
• #1000 (patch) Exit cleanly instead of crashing when CLI output is piped into a consumer that closes early (e.g. varlock flatten | head -3)
• #1004 (patch) Ship the Linux local-encryption helper binaries uncompressed. UPX packing caused antivirus false positives (Defender Wacatac.C!ml) during install.
• #1007 (patch) varlock flatten no longer needs to detect a workspace root - any @​import path that resolves on disk is flattened, including in non-JS monorepos
• #1007 (patch) Clearer errors for Windows-style @import/@​plugin paths, which are not supported (use forward slashes, or a relative/~ path instead of a drive letter)
• #1015 (patch) - Replace the semver dependency with verkit, a smaller tree-shakeable alternative
• #1016 (patch) Redact sensitive values from Error objects passed to console methods, and fix console redaction of plain objects that could not survive a JSON round-trip (nested errors, circular references, bigints, dates)

Commits

• 4830a78 Version packages (#1005)
• ce567c8 fix(redaction): redact secrets from Error objects passed to console (#1016)
• 73c1e92 Ship native helper binaries as per-platform optional dependencies (#1006)
• ff9b07a chore: replace semver dependency with verkit (#1015)
• 2ea84ed feat(printenv): add --template flag for rendering string templates (#1013)
• 3b403e8 fix(flatten): drop the workspace-root concept (#1007)
• 777de2e Exit cleanly on broken pipe instead of crashing (#1000)
• dfcfccf Fix flaky randomString bias test (#993)
• See full diff in compare view