🐸 Versioned release

[bumpy-bot]

This PR was created and will be kept in sync by bumpy based on your bump files (in .bumpy/). Merge it when you are ready to release the packages listed below:

Minor releases

@varlock/ci-env-info 0.0.2 → 0.1.0 _CHANGELOG.md

• Add detection for Railway, AWS Amplify, Google Cloud Run, Deno Deploy, Zeabur, and Firebase App Hosting; detect dev sandboxes (CodeSandbox, StackBlitz, GitHub Codespaces, Gitpod, Replit) with isCI: false; add detectRuntime/detectOs and expose them as VARLOCK_RUNTIME/VARLOCK_OS builtin variables. (bump file)
  Also fixes several incorrect env var names found during a std-env doc audit: GitHub Actions PR number (was reading a non-existent variable), GitLab MR number (was using the instance-wide ID instead of the IID), Netlify build URL (double https://), Semaphore PR number (Classic-only variable), Azure Pipelines PR number (prefers the GitHub-facing number), and Bitbucket repo owner (deprecated variable). Adds repo extraction for Bitrise.
  A second pass against std-env's actual detection logic found three more real gaps: Vercel and Netlify now report isCI: false when running their local dev servers (vercel dev, netlify dev) instead of always reporting CI; StackBlitz detection now also requires the WebContainer runtime marker (matching std-env) instead of a weak SHELL-only heuristic that could misfire; and detectRuntime's isNode flag now matches std-env's semantics (stays true under Bun/Deno's Node-compat mode).

@varlock/infisical-plugin 2.0.1 → 2.1.0 _CHANGELOG.md

• Add allowMissing flag to infisical() and @initInfisical() for optional secrets (bump file)

varlock 1.10.0 → 1.11.0 _CHANGELOG.md

• Fix: varlock load --format json-full no longer includes @internal items by default (pass --include-internal to opt in for local debugging). Framework integrations shell out to this exact command to get their injected config, so this closes a leak where an @internal secret-zero credential could reach client/SSR runtime code. (bump file)
• Docs: clarify that _VARLOCK_ENV_KEY encrypts the injected env blob (not an encrypted() resolver), and drop the stale plugin count from the package README (bump file)
• Add --filter flag to load/run for selecting env vars by key/glob, @sensitive/@required, or tags (new @tag() item decorator). Also add a matching filter= arg to @generate* code-generation decorators, so a single schema can emit multiple generated files scoped to different subsets. (bump file)
• Add detection for Railway, AWS Amplify, Google Cloud Run, Deno Deploy, Zeabur, and Firebase App Hosting; detect dev sandboxes (CodeSandbox, StackBlitz, GitHub Codespaces, Gitpod, Replit) with isCI: false; add detectRuntime/detectOs and expose them as VARLOCK_RUNTIME/VARLOCK_OS builtin variables. (bump file)
  Also fixes several incorrect env var names found during a std-env doc audit: GitHub Actions PR number (was reading a non-existent variable), GitLab MR number (was using the instance-wide ID instead of the IID), Netlify build URL (double https://), Semaphore PR number (Classic-only variable), Azure Pipelines PR number (prefers the GitHub-facing number), and Bitbucket repo owner (deprecated variable). Adds repo extraction for Bitrise.
  A second pass against std-env's actual detection logic found three more real gaps: Vercel and Netlify now report isCI: false when running their local dev servers (vercel dev, netlify dev) instead of always reporting CI; StackBlitz detection now also requires the WebContainer runtime marker (matching std-env) instead of a weak SHELL-only heuristic that could misfire; and detectRuntime's isNode flag now matches std-env's semantics (stays true under Bun/Deno's Node-compat mode).

Patch releases

env-spec-language 0.2.5 → 0.2.6 _CHANGELOG.md

• Add editor autocomplete and hover docs for the new @tag() decorator, the filter= arg on @generate* decorators, and @internal (bump file)