Blog
Thank you to each and every one of you who has given varlock a try, starred us on GitHub, contributed code, opened discussions, or shared feedback on Discord. This has been an incredible year, and we couldn’t have done it without our amazing community.
By the Numbers
- 🎉 First Release: June 18, 2025
- ⭐ Stars: 872
- 📦 Releases: 20
- 🔀 PRs Merged: 157
- 🐛 Issues Closed: 19
- 💬 Active Discussions: 11
Major Milestones & Features
2025 was a year of rapid growth and development for Varlock. We started with a vision to make .env files built for sharing, powered by @env-spec decorator comments, and quickly grew into a trusted tool for managing environment variables across the JavaScript ecosystem and beyond.
Core Features
@env-specStandard - The standard for.envfiles that varlock implements- Security Guardrails - Leak detection, leak prevention, and log redaction
- Type Safety - Full TypeScript support with schema validation
@importDecorator - Import schemas and values from other.envfiles, perfect for monorepos and sharing common variables- Plugin System - Extensible architecture for third-party integrations, introduced in
varlock@0.1.0which unified resolvers with decorators
Major Releases
varlock@0.1.0- Major release that unified resolvers with decorators and introduced our new plugin system- 1Password Integration - Native integration for 1Password, supporting both desktop app and service accounts
Framework Integrations
We shipped lots of integrations this year, including: JavaScript / Node.js, Next.js, Vite, Cloudflare Workers, and Astro.
Developer Tools & Infrastructure
We also shipped tools to help you use varlock in your projects including a Docker Image, GitHub Action, and a Docs MCP.
Community Highlights
Active Discussions
Our community has been incredibly engaged with 11 active discussions, including:
- @env-spec RFC: Initial specification for the env-spec standard
- Schema Store RFC: Community proposal for a schema store
- Native Encryption RFC: Discussion on built-in encryption support
- Baked-in Functions RFC: Proposal for utility functions and operators
Events & Talks
- Live Stream with Nick Taylor - Theo and Phil live streamed adding varlock to Nick’s Astro project.
- GitHub Open Source Friday - Theo and Phil live streamed on GitHub Open Source Friday with Kadesha
- TorontoJS - Phil gave a talk on securing secrets in Next.js
- DevtoolsTO - Phil gave a presentation on varlock at DevtoolsTO
- Modern Web Podcast - Theo and Phil joined Rob on the Modern Web Podcast
- Claude Code Vancouver - Theo closed out the year with a talk at the first ever Claude Code Vancouver event.
Mentions
- Next.js Weekly
- Hacker News
- Daniel Miessler’s Newsletter
- ES Next News
- Astro Weekly
- 1Password Developer Newsletter
- 1Password Marketplace
Looking Forward
As we look ahead to 2026, we’re excited about:
- Credential Rotation: Automatic credential rotation for 1Password and other plugins
- GitHub App: PR schema validation and reporting
- More Plugins: Expanding our plugin ecosystem with additional integrations
- More Integrations: Continuing to support new frameworks and tools
- Remote
@import: Support for importing from remote sources
Thank You
This year has been incredible, and it’s all thanks to our amazing community. Whether you’ve starred us on GitHub, opened an issue or discussion, submitted a pull request, shared varlock with others, provided feedback and suggestions, or used varlock in your projects - thank you!
We’re excited to continue building with you in 2026!