Pull request #1779 · stacks/bun-plugin-dotenvx

This PR contains the following updates:

Package	Change	Type	Update
@dotenvx/dotenvx	`^1.51.0` → `^1.75.1`	dependencies	minor
actions/checkout	`v6.0.1` → `v6.1.0`	action	minor
better-dx	`^0.2.15` → `^0.2.38`	devDependencies	patch
stacksjs/action-releaser	`v1.2.9` → `v1.2.11`	action	patch
vite-plugin-vue-devtools (source)	`^8.0.3` → `^8.2.1`	devDependencies	minor

Release Notes

dotenvx/dotenvx (@dotenvx/dotenvx)

`v1.75.1`

Compare Source

Changed

Publish as named binaries (#851)

Removed

Remove references to dotenvx-vlt (now dotenvx-armor) (#849)

`v1.75.0`

Compare Source

Changed

Swap in @dotenvx/primitives (#848)
ext commands become first-class(#847)

`v1.74.3`

Compare Source

Changed

Bundle dotenvx with @dotenvx/next-env for user convenience (#845)

`v1.74.2`

Compare Source

Changed

Fix provenance for @dotenvx/next-env (#844)

`v1.74.1`

Compare Source

Added

Add README for @dotenvx/next-env (#843)

`v1.73.1`

Compare Source

Changed

Give update available notification only for armor commands (#840)

`v1.73.0`

Compare Source

Added

Add dotenvx armor commands directly inside dotenvx (#839)

dotenvx remains local-first: armor commands are optional under professional security section

`v1.72.0`

Compare Source

Added

Move armor login command to first class dotenvx login command. (#836)
dotenvx remains local-first: login is optional and only needed when you want Armor features like moving keys off-device, team sharing, and audit access.
Patch 2 high severity dependencies (#837)

`v1.71.3`

Compare Source

Changed

Forward command to Dotenvx Armor Key Guard approvals (#835)

`v1.71.2`

Compare Source

Changed

touch up get, set, and decrypt when armor installed (#834)

`v1.71.1`

Compare Source

Changed

stderr changed to inherit for dotenvx-armor integration (#833)

`v1.71.0`

Compare Source

Added

Add optional automation --token support for Armor ⛨ users (#831)

`v1.70.0`

Compare Source

Changed

Dotenvx Ops/Vlt is now Dotenvx Armor ⛨ (#830)

`v1.69.2`

Compare Source

Changed

Minor messaging improvements, especially if using armored keys (#825)

`v1.69.1`

Compare Source

Changed

Internally rename ops to vlt (#823)

`v1.69.0`

Compare Source

Changed

Remove fully-deprecated opsOff option in favor of noOps (#822)

`v1.68.1`

Compare Source

Changed

Pass -f to ops (#821)

`v1.68.0`

Compare Source

Changed

Support ignore option on parse (#820)

`v1.67.0`

Compare Source

Added

Add prompt for local storage vs armored storage (#819)

`v1.66.0`

Compare Source

Added

Add dotenvx doctor (#815)

`v1.65.3`

Compare Source

Changed

Improve spinner message blinking with simpler --no-spinner flag passed to ops (#814)

`v1.65.2`

Compare Source

Changed

Improve spinner message coordination between dotenvx and dotenvx-ops (#813)

`v1.65.1`

Compare Source

Changed

Prompts from ops should bubble up (#812)

`v1.65.0`

Compare Source

Added

Add support for replaceing duplicate keys with different values (#806)

`v1.64.0`

Compare Source

Added

Add optional dotenvx armor command.
- armor up armor private key
- armor down dearmor private key
- armor push push armored key (from .env.keys)
- armor pull pull armored key (into .env.keys)

Move private keys off device and under access control with Dotenvx Ops ⛨. Learn more

`v1.63.0`

Compare Source

Added

Add support for encrypted values passed to --env flag (#804)
Add support for --format=colon in order to support cloudflare's wrangler --var flag format (#804)

`v1.62.0`

Compare Source

Added

Add support for config({ envs }). unlocks simpler cloudflare worker integration (#803)

$ dotenvx encrypt -f .env.txt

// src/index.js
import envSrc from '../.env.txt'
import dotenvx from '@dotenvx/dotenvx'

const config = dotenvx.config({ envs: [{ type: 'env', value: envSrc, privateKeyName: 'DOTENV_PRIVATE_KEY' }] })
const envx = config.parsed

export default {
  async fetch(request, env, ctx) {
    return new Response(`Hello ${envx.HELLO}`)
  }
}

"scripts": {
  "deploy": "wrangler deploy",
  "dev": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
  "start": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
  "test": "vitest"
},

`v1.61.6`

Compare Source

Changed

Guard against command substitution following encrypted: (#802)

`v1.61.5`

Compare Source

Changed

Support --hostname flag to dotenvx-ops.login (#801)

`v1.61.4`

Compare Source

Changed

Respect SIGINT handler completion (#798)

`v1.61.3`

Compare Source

Changed

Tighten up ext precommit --install message (#797)

`v1.61.2`

Compare Source

Changed

For Ops ⛨ users surface stderr (#796)

`v1.61.1`

Compare Source

Changed

Faster coldstarts! (#781)
Patch dotenvx precommit|prebuild shorthand (#793)

`v1.61.0`

Compare Source

Added

Add login and logout method that proxy to dotenvx-ops login/logout (#780)
Note: dotenvx continues to make zero outgoing HTTP requests and includes no telemetry. Outgoing requests occur only if you explicitly install the dotenvx-ops SDK or CLI.

`v1.60.2`

Compare Source

Changed

Communicate local key and armored key (for Ops stored keys) (#778)

`v1.60.1`

Compare Source

Added

Added missing + key ⛨ for Ops stored keys (#777)

`v1.60.0`

Compare Source

Added

Add spinner with loading messages
- injecting (run)
- encrypting (encrypt, set)
- decrypting (decrypt, get)
- rotating (rotate)
- retrieving (keypair)

`v1.59.1`

Compare Source

Added

add HELLO key to the kit sample to match most of our examples in the README

`v1.59.0`

Compare Source

Changed

encrypt and set now create a .env file if one does not exist (#771)
pass --no-create to prevent file creation

`v1.58.0`

Compare Source

Changed

Changed runtime injection message to format ⟐ injecting env (N) from FILE · dotenvx@VERSION (#770)

`v1.57.5`

Compare Source

Changes

Improve already installed message (#768)

`v1.57.4`

Compare Source

Changes

Use curl example for install dotenvx.com/ops (#767)

`v1.57.3`

Compare Source

Changes

Simplify installed success message (#766)

`v1.57.2`

Compare Source

Changes

Ran npm audit to update package-lock.json (#763)

`v1.57.1`

Compare Source

Changes

improved error logs and compacted most to a single line (#755)
introduced leading log glyphs as a visual status language:
- ⟐ success action (injected)
- ◈ success action (encrypted)
- ◇ success action (set plain value, decrypted)
- ⟳ success action (rotated)
- ○ informational no-op (no changes)
- ▣ success action for generated/updated support files
- ⚠ warning
- ☠ error

`v1.57.0`

Compare Source

Changed

color and formatting changes to outputs (#754)

`v1.56.0`

Compare Source

Changed

ops off flag — now respected by get, keypair, rotate, and encrypt (#750)
--pp alias — added as shorthand for --pretty-print; toward sunsetting -pp (#750)

Removed

Remove support for .env.vault files (#750)

`v1.55.1`

Compare Source

Added

Respect dotenvx-ops status (on|off) (#749)

`v1.55.0`

Compare Source

Added

Add '⛨ ARMORED KEYS: Harden your private keys.' security feature when dotenvx-ops installed (#746)

Removed

Remove ProKeypair logic

`v1.54.1`

Compare Source

Changed

Fix npm publish

`v1.53.0`

Compare Source

Removed

Remove radar. It has been a year since replaced by ops. (#743)

`v1.52.0`

Compare Source

Added

Pass log level options to main.set (#731)

`v1.51.4`

Compare Source

Changed

Change description of dotenvx-ops to better reflect its tooling as operational primitives on top of dotenvx for production use cases. (#721)

`v1.51.3`

Compare Source

Added

Add hint on .env.keys for dotenvx armor up. Dotenvx Armor lets you armor your private keys securely with just a single command. It's a convenient alternative to manually copy/pasting them in and out of 1Password. (#718)

`v1.51.2`

Compare Source

Changed

Switch npm publish to use Dotenvx Ops' new Rotation Tokens (ROTs) (#715)

This will allow us to start dogfooding our own solution for third-party API key rotation. Third-party API key rotation would drastically improve security industry wide. Please get in touch if this is interesting to you.

`v1.51.1`

Compare Source

Added

Add opsOff type information

actions/checkout

`v6.1.0`

Compare Source

What's Changed

[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in #2500
backport fixes to releases-v6 by @aiqiaoy in #2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v6.1.0

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v6.0.2`

Compare Source

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

stacksjs/better-dx (better-dx)

stacksjs/action-releaser

`v1.2.11`

Compare Source

Compare changes

🐛 Bug Fixes

release: publish GitHub action directly (0cf36bd) (by Chris <chrisbreuer93@>gmail.com>)

🧹 Chores

release v1.2.11 (fe1e8d5) (by Chris <chrisbreuer93@>gmail.com>)

Contributors

Chris <chrisbreuer93@>gmail.com>

`v1.2.10`

Compare Source

vuejs/devtools (vite-plugin-vue-devtools)

`v8.2.1`

Compare Source

🐞 Bug Fixes

core: Avoid bundling Vite and Vue Router types in declarations - by @webfansplz <samp>(8f51a)</samp>

View changes on GitHub

`v8.2.0`

Compare Source

🚀 Features

devtools-api: Add no-op stub under node export condition - by @danielroe in #1114 <samp>(435e6)</samp>

🐞 Bug Fixes

client: Disable pin reorder buttons at list bounds - by @SaKaNa-Y in #1105 <samp>(87d38)</samp>

View changes on GitHub

`v8.1.5`

Compare Source

No significant changes

View changes on GitHub

`v8.1.4`

Compare Source

🐞 Bug Fixes

kit,shared: Mark packages side-effect-free for treeshaking - by @danielroe in #1108 <samp>(2b9ce)</samp>

View changes on GitHub

`v8.1.3`

Compare Source

🐞 Bug Fixes

vite: Align module field with emitted ESM output - by @itosa-kazu in #1106 <samp>(4720c)</samp>

View changes on GitHub

`v8.1.2`

Compare Source

🚀 Features

Bump vite-plugin-vue-inspector to support vapor app - by @webfansplz in #1096 <samp>(784c3)</samp>

🐞 Bug Fixes

devtools-kit: Remove special handling for Router object - by @skirtles-code in #1092 <samp>(c2dde)</samp>
extension: Load devtools-background.js as type="module" - by @skirtles-code in #1072 <samp>(eed09)</samp>
vite: Use TrustedScriptURL for overlay injection under Trusted Types CSP - by @ashishkr96 in #1094 <samp>(ef08f)</samp>

View changes on GitHub

`v8.1.1`

Compare Source

🚀 Features

overlay: Enhance style inspector button ux when enabled - by @skirtles-code in #1069 <samp>(0e32d)</samp>

🐞 Bug Fixes

applet: Preserve active component when filtering - by @skirtles-code in #1065 <samp>(ec4a2)</samp>
overlay: Use toggleEnabled to allow exiting in spector mode - by @SaKaNa-Y in #1067 <samp>(ace74)</samp>

View changes on GitHub

`v8.1.0`

Compare Source

No significant changes

View changes on GitHub

`v8.0.7`

Compare Source

🚀 Features

Show VNode lifecycle events as built-in - by @skirtles-code in #1036 <samp>(35de5)</samp>
Tooltips for field values - by @skirtles-code in #1037 <samp>(27555)</samp>

🐞 Bug Fixes

Use displayName for functional components - by @skirtles-code in #1046 <samp>(20efd)</samp>
Match camelCase event declarations - by @skirtles-code in #1048 <samp>(0f7e1)</samp>
computed and inject leak via mixins - by @skirtles-code in #1050 <samp>(ecca7)</samp>

View changes on GitHub

`v8.0.6`

Compare Source

🚀 Features

Add IIFE and ESM browser builds - by @skirtles-code in #1024 <samp>(62fe5)</samp>

View changes on GitHub

`v8.0.5`

Compare Source

🐞 Bug Fixes

Dts exports, close #1007 - by @webfansplz in #1007 <samp>(aa1f5)</samp>

View changes on GitHub

`v8.0.4`

Compare Source

🚀 Features

Enhance node import edge recognizability - by @LittleSound in #993 <samp>(94974)</samp>

🐞 Bug Fixes

Compatible with node v25.2 - by @webfansplz in #1006 <samp>(ba7a0)</samp>
client: Dead recursion in graph filtering - by @LittleSound in #992 <samp>(eff70)</samp>

View changes on GitHub

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.