chore(deps): update dependency @dotenvx/dotenvx to v2

v2.38.2

Compare Source

Changed

• Fix SEA crash (#​1031)

v2.38.1

Compare Source

Changed

• Surface Armor approval prompts to stderr (#​1030)

v2.38.0

Compare Source

Added

• Add getSync convenience (#​1029)

Changed

• Default to file key storage in non-interactive mode (#​1028)

v2.37.0

Compare Source

Added

• New: Dotenvx Armor Enclaved Keys - software enclaved on the remote provider like Vercel, GitHub Actions, and more. (#​1026)

⛨ Choose key type …
  ⛨ Armored
❯ ◊ Enclaved

v2.36.0

Compare Source

Added

• Add dotenvx armor invite command (#​1025)

v2.35.0

Compare Source

Added

• Add encrypt --with to bring public key. Useful for Dotenvx Armor's new remote enclaved private keys. Encrypt locally but decrypt only on the remote software enclave. Private keys never leave. (#​1022)

Changed

• Use atomic file writes in protect (#​1019)

v2.34.2

Compare Source

Changed

• Patch: fix atomic edge case of writing .env and .env.keys file (#​1014)

v2.34.1

Compare Source

Changed

• Patch: don't write public key on ctrl+c or prompt failure (#​1009)

v2.34.0

Compare Source

Changed

• Swap internal provider logic for @​dotenvx/providers (#​1008)
• BREAKING: Remove lock commands and support for unlocking. Passwords are too difficult to manage securely. Convenience not worth it for the agentic future we are entering. (#​1008)
• Return provider information with dotenvx keypair command (#​1008)
• Swap armor provider logic to @​dotenvx/providers#armor (#​1009)

v2.33.0

Compare Source

Added

• Add Envfile profiles for selecting .env file combinations with --profile or DOTENV_ENV.
• Automatically redact stdout/stderr from config() when an Envfile is present.

Changed

• Move Envfile processing into @dotenvx/primitives.
• First file wins when combining Envfile rules. run and check validate final values; encryption rules apply to encrypt, set, and protect.

v2.32.4

Compare Source

Changed

• Make Envfile the filename. Final decision. (#​1003)

v2.32.3

Compare Source

Changed

• Make Dotenvspec the filename (#​1002)
• Improve startup time for cli (#​1001)

v2.32.2

Compare Source

Changed

• Improve bundle size (#​1000)

v2.32.1

Compare Source

Changed

• Simplify custody picker to 3 initial options (#​998)

? Choose private key custody …
❯ ⛉ Local
  ⛨ Dotenvx Armor
  ⛊ Password Managers

v2.32.0

Compare Source

Changed

• BREAKING: Envfile renamed to Envspec file (#​996)
• BREAKING: dotenvx init removed. renamed to dotenvx spec. (#​996)

Added

• Envspec rules now guide check, run, encrypt, and protect. (#​996)

v2.31.1

Compare Source

Changed

• armor up should read for os secret store, 1password, and bitwarden (#​992)

v2.31.0

Compare Source

Added

• Add dotenvx feedback command so you (and your coding agent) can give feedback on the cli (#​987)
• Add dotenvx init for generating your Envfile (#​990)

Changed

• Restore ESM named imports such as import { config } from '@dotenvx/dotenvx', broken in 2.30.0 by the withEvents export (#​989).
• BREAKING: dotenvx validate renamed to dotenvx check and works off Envfile only going forward. Support for .env.example dropped. Switch to using an Envfile.

Removed

• BREAKING: dotenvx define removed. Use dotenvx init.

v2.30.0

Compare Source

Added

• Add dotenvx feedback command so you (and your coding agent) can give feedback on the cli (#​987)
• Add dotenvx init for generating your Envfile (#​990)

Changed

• Restore ESM named imports such as import { config } from '@dotenvx/dotenvx', broken in 2.30.0 by the withEvents export (#​989).
• BREAKING: dotenvx validate renamed to dotenvx check and works off Envfile only going forward. Support for .env.example dropped. Switch to using an Envfile.

Removed

• BREAKING: dotenvx define removed. Use dotenvx init.

v2.29.0

Compare Source

Added

• Add dotenvx protect to prevent plaintext .env files from being committed to code on a machine (#​980)

Changed

• Deprecate dotenvx gitignore. Use dotenvx protect.
• Deprecate dotenvx precommit. Use dotenvx protect.
• Deprecate dotenvx prebuild. Use dotenvx protect --docker.

v2.28.2

Compare Source

Changed

• Only owner can write to and read from .env.keys file (#​979)

v2.28.1

Compare Source

Changed

• Send pk via stdin to keychain. was argv. thank you @​kta1kri for the security report. (#​978)
• Move some commands under a hidden menu (#​973)

v2.28.0

Compare Source

Added

• Choose where you custody your keys (#​972)

Your private key
├── ⛉ Local Custody
│   ├── OS (macOS Keychain / Windows Credential Manager / Linux Secret Service)
│   ├── 1Password
│   ├── Bitwarden
│   └── File (.env.keys)
└── ⛊ Managed Custody
    └── ⛨ Armor

v2.27.0

Compare Source

Removed

• BREAKING: Removed run --validate flag and validate command against .env.example file. To be replaced soon with a modern validation scheme.

v2.26.1

Compare Source

Changed

• Add dotenvx 1password up|down|push|pull and dotenvx bitwarden up|down|push|pull (#​969)

v2.26.0

Compare Source

Added

• Add support for storing private key to bitwarden or 1password (#​968)

v2.25.0

Compare Source

Changed

• Store private key to os secret store rather than .env.keys by default (#​967)

v2.24.1

Compare Source

Changed

• Upgraded to latest @​dotenvx/primitives

v2.24.0

Compare Source

Changed

• Do not expand nested commands (#​965)

Removed

• BREAKING: Remove the -p shorthand for --plain; use --plain instead

v2.23.0

Compare Source

Added

• Support comma-separated env file paths with -f and the config({ path }) option. Example: dotenvx run -f .env.local,.env -- node index.js
• Add DOTENV_PATH (or DOTENV_F) to support the same. Example: DOTENV_PATH=.env.local,.env

Changed

• Rename DOTENV_CONFIG_* variables to DOTENV_CONVENTION, DOTENV_IGNORE, and DOTENV_QUIET, while retaining their existing DOTENV_CONFIG_* names as fallbacks

v2.22.0

Compare Source

Added

• Install verified binaries directly from GitHub Releases (#​956)

Changed

• Fall back to ~/.local/bin when /usr/local/bin is not writable (#​955)

v2.21.0

Compare Source

Added

• Add dotenvx enc and dotenvx dec shorthands for encrypt and decrypt (#​943)
• Add convenient dx alias for shorter dx run --, dx enc, etc (#​944)

Changed

• Patch typescript types for path (#​942)

v2.20.1

Compare Source

Changed

• Handle accent marks for ext precommit (#​936)

v2.20.0

Compare Source

Added

• Add dotenvx del command for deleting a key from a .env file (#​939)

Changed

• Exempt .env.vault from precommit/prebuild sealed checks (vault-format ciphertext is already safe to commit)

v2.19.2

Compare Source

see CHANGELOG

v2.19.1

Compare Source

Changed

• User can click enter to open up approval url for convenience (#​934)

v2.19.0

Compare Source

Added

• Add dotenvx armor open to open armored key details in browser (#​930)

v2.18.1

Compare Source

• Patch injected message when preset encrypted: value (#​927)

v2.18.0

Compare Source

Added

• Make authenticated API calls to the Dotenvx Armor API with dotenvx curl. Allows you to control your Dotenvx Armor account directly from your agent inside Codex, Claude, etc. (#​923)

v2.17.4

Compare Source

Changed

• Send device identifier along with curl requests (#​922)

v2.17.3

Compare Source

Changed

• Exempt .env.example in subdirectories from precommit (#​920)

v2.17.2

Compare Source

Added

• Add support for DOTENV_CONFIG_IGNORE global convenience (#​919)

v2.17.1

Compare Source

Changed

• Handle ctrl + c better (#​916)

v2.17.0

Compare Source

Added

• Add support for Bitwarden bw:// secrets in your .env files. (#​915)

v2.16.1

Compare Source

Changed

• Fix: Do not report child error - let child do so. (#​914)

v2.16.0

Compare Source

Added

• Add support for -ek and -ik to dotenvx get (#​913)

v2.15.1

Compare Source

Changed

• Better communicate time waiting on 1password with elapsed time (#​909)

v2.15.0

Compare Source

Added

• Add support for 1Password op:// secrets in your .env files. (#​908)

v2.14.0

Compare Source

Added

• Add dotenvx run --validate for simple env validation against your .env.example (#​906)
• Add dotenvx validate for a pre-check of validation against your .env.example file (#​906)

v2.13.0

Compare Source

Added

• Add get --eval-export flag (#​904)

Changed

• Make get --eval posix safe (#​904)

v2.12.0

Compare Source

Changed

• Small Breaking: Single quoted 'Let\'s go' now correctly escapes to Let's go (#​903)

v2.11.3

Compare Source

Changed

• Improve command substitution for nested commands (#​902)

v2.11.2

Compare Source

Changed

• Bump @​dotenvx/primtivies to support nested node invocations for pkg-ed binary (#​901)

v2.11.1

Compare Source

Changed

• Redact all keys by default - except those ending in _PLAIN (460862)
• Support dotenvx run -- claude and dotenvx run -- codex (#​900)
• Simplify default encrypted .env file to just HELLO="World" (#​899)

v2.11.0

Compare Source

Added

• Add convenience method dotenvx update (#​897)

Changed

• BREAKING: Send informational messages like injected env to stderr instead of stdout. This makes it more reliable to do things like piping output to a file without needing --quiet. (#​898)

v2.10.0

Compare Source

Added

• Add run --redact to keep secrets out of command output. (#​894)

v2.9.0

Compare Source

Changed

• BREAKING: ls from @dotenvx/dotenvx is now async/await. (#​893)

v2.8.0

Compare Source

Added

• Add FILE_NOT_WRITABLE error for user convenience (#​891)
• Support Enclaved Armored Keys (#​892)

v2.7.3

Compare Source

Changed

• Fix: --quiet should not display the spinner and its stderr messages (#​889)

v2.7.2

Compare Source

Added

• Include dotenvx armor status command.

v2.7.1

Compare Source

Changed

• Security Improvement: dotenvx armor login attempts to set the DOTENVX_ARMOR_TOKEN in your native OS secret store going forward. For current Armor users run dotenvx armor logout and then dotenvx armor login to make use of this immediately. (#​886)

v2.7.0

Compare Source

Added

• Added support for --mask on get, run, decrypt (#​885)

v2.6.0

Compare Source

Added

• Support native up|down|pull|push for windows (#​884)

v2.5.0

Compare Source

Added

• Support native up|down|pull|push for windows (#​883)

v2.4.1

Compare Source

Added

• Support config(path:) as a directory like app/web. Useful for monorepos (#​882)

v2.4.0

Compare Source

Added

• Support multiple -fk flags for select commands (#​880)
• Support -f ../.. directories (#​881)

v2.3.4

Compare Source

Removed

• Replace various deps with @dotenvx/tooling (#​879)

v2.3.3

Compare Source

Removed

• Remove dotenv and commander for @dotenvx/tooling (#​878)

v2.3.2

Compare Source

Changed

• Permit empty value for set (#​877)

v2.3.1

Compare Source

Changed

• Fix correct default valuation interpolation for empty strings by upgrading primitives package

v2.3.0

Compare Source

Added

• Add lock up and lock down commands for password protecting private keys (#​875)

Changed

• BREAKING: Rename keychain commands to native to make way for windows and linux. (#​875)

Removed

• BREAKING: Remove --no-ops. Use --no-armor. (#​875)

v2.2.2

Compare Source

Changed

• Move login and logout under armor (#​874)

v2.2.1

Compare Source

Changed

• Move genexample to top level commands (#​873)

v2.2.0

Compare Source

Added

• Use dotenvx keychain up|down to move your private keys to your macOS Keychain (#​872)

v2.1.5

Compare Source

Changed

• precommit and prebuild respect _PLAIN (#​871)

v2.1.4

Compare Source

Added

• Add support for DOTENV_CONFIG_CONVENTION=nextjs (#​869)

v2.1.3

Compare Source

Changed

• Patch edge case when custom unspecified -f and --env flag (#​868)

v2.1.2

Compare Source

Changed

• Support restricted read permissions to .env.keys (#​676, #​867)

v2.1.1

Compare Source

Changed

• Support DOTENV_CONFIG_QUIET=true as synonym for --quiet flag (#​866)

v2.1.0

Compare Source

Added

• Add interactive input mode for set (#​862)
• Support leaving _PLAIN suffixed keys unencrypted during set and encrypt (#​862)

Changed

• Return exit code 1 from get when decryption errors are reported (#​862)

Fixed

• Add Windows PowerShell coverage for npm shim encryption of .env.local files

v2.0.0

Compare Source

Changed

• BREAKING: lib/main#set async only (#​855)
• BREAKING: lib/main#get async only (#​855)
• New keyring support - for local and armor providers and to unlock future providers (#​855)
• Route run, config, and get through shared env and keypair resolvers backed by @dotenvx/primitives (#​855)
• Route set, encrypt, and decrypt through shared transforms that operate on primitive scan, parse, encrypt, and upsert results (#​855)
• Update library parse to use primitive parsing while preserving dotenvx-style encrypted value errors (#​855)

Removed

• BREAKING: Remove the rotate command (it will return in 2.1 or 2.2 soon with a more complete implementation for local and armored keys) (#​855)
• BREAKING: Remove the library doctor, keypair, and genexample exports from lib/main (#​855)

v1.75.1

Compare Source

Changed

• Publish as named binaries (#​851)

Removed

• Remove references to dotenvx-vlt (now dotenvx-armor) (#​849)

v1.75.0

Compare Source

Changed

• Swap in @dotenvx/primitives (#​848)
• ext commands become first-class(#​847)

v1.74.3

Compare Source

Changed

• Bundle dotenvx with @dotenvx/next-env for user convenience (#​845)

v1.74.2

Compare Source

Changed

• Fix provenance for @dotenvx/next-env (#​844)

v1.74.1

Compare Source

Added

• Add README for @dotenvx/next-env (#​843)

v1.73.1

Compare Source

Changed

• Give update available notification only for armor commands (#​840)

v1.73.0

Compare Source

Added

• Add dotenvx armor commands directly inside dotenvx (#​839)

dotenvx remains local-first: armor commands are optional under professional security section

v1.72.0

Compare Source

Added

• Move armor login command to first class dotenvx login command. (#​836)
• dotenvx remains local-first: login is optional and only needed when you want Armor features like moving keys off-device, team sharing, and audit access.
• Patch 2 high severity dependencies (#​837)

v1.71.3

Compare Source

Changed

• Forward command to Dotenvx Armor Key Guard approvals (#​835)

v1.71.2

Compare Source

Changed

• touch up get, set, and decrypt when armor installed (#​834)

v1.71.1

Compare Source

Changed

• stderr changed to inherit for dotenvx-armor integration (#​833)

v1.71.0

Compare Source

Added

• Add optional automation --token support for Armor ⛨ users (#​831)

v1.70.0

Compare Source

Changed

• Dotenvx Ops/Vlt is now Dotenvx Armor ⛨ (#​830)

v1.69.2

Compare Source

Changed

• Minor messaging improvements, especially if using armored keys (#​825)

v1.69.1

Compare Source

Changed

• Internally rename ops to vlt (#​823)

v1.69.0

Compare Source

Changed

• Remove fully-deprecated opsOff option in favor of noOps (#​822)

v1.68.1

Compare Source

Changed

• Pass -f to ops (#​821)

v1.68.0

Compare Source

Changed

• Support ignore option on parse (#​820)

v1.67.0

Compare Source

Added

• Add prompt for local storage vs armored storage (#​819)

v1.66.0

Compare Source

Added

• Add dotenvx doctor (#​815)

v1.65.3

Compare Source

Changed

• Improve spinner message blinking with simpler --no-spinner flag passed to ops (#​814)

v1.65.2

Compare Source

Changed

• Improve spinner message coordination between dotenvx and dotenvx-ops (#​813)

v1.65.1

Compare Source

Changed

• Prompts from ops should bubble up (#​812)

v1.65.0

Compare Source

Added

• Add support for replaceing duplicate keys with different values (#​806)

v1.64.0

Compare Source

Added

• Add optional dotenvx armor command.
  • armor up armor private key
  • armor down dearmor private key
  • armor push push armored key (from .env.keys)
  • armor pull pull armored key (into .env.keys)

Move private keys off device and under access control with Dotenvx Ops ⛨. Learn more

v1.63.0

Compare Source

Added

• Add support for encrypted values passed to --env flag (#​804)
• Add support for --format=colon in order to support cloudflare's wrangler --var flag format (#​804)

v1.62.0

Compare Source

Added

• Add support for config({ envs }). unlocks simpler cloudflare worker integration (#​803)

$ dotenvx encrypt -f .env.txt

// src/index.js
import envSrc from '../.env.txt'
import dotenvx from '@dotenvx/dotenvx'

const config = dotenvx.config({ envs: [{ type: 'env', value: envSrc, privateKeyName: 'DOTENV_PRIVATE_KEY' }] })
const envx = config.parsed

export default {
  async fetch(request, env, ctx) {
    return new Response(`Hello ${envx.HELLO}`)
  }
}

"scripts": {
  "deploy": "wrangler deploy",
  "dev": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
  "start": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
  "test": "vitest"
},

v1.61.6

Compare Source

Changed

• Guard against command substitution following encrypted: (#​802)

v1.61.5

Compare Source

Changed

• Support --hostname flag to dotenvx-ops.login (#​801)

v1.61.4

Compare Source

Changed

• Respect SIGINT handler completion (#​798)

v1.61.3

Compare Source

Changed

• Tighten up ext precommit --install message (#​797)

v1.61.2

Compare Source

Changed

• For Ops ⛨ users surface stderr (#​796)

v1.61.1

Compare Source

Changed

• Faster coldstarts! (#​781)
• Patch dotenvx precommit|prebuild shorthand (#​793)

v1.61.0

Compare Source

Added

• Add login and logout method that proxy to dotenvx-ops login/logout (#​780)
• Note: dotenvx continues to make zero outgoing HTTP requests and includes no telemetry. Outgoing requests occur only if you explicitly install the dotenvx-ops SDK or CLI.

v1.60.2

Compare Source

Changed

• Communicate local key and armored key (for Ops stored keys) (#​778)

v1.60.1

Compare Source

Added

• Added missing + key ⛨ for Ops stored keys (#​777)

v1.60.0

Compare Source

Added

• Add spinner with loading messages
  • injecting (run)
  • encrypting (encrypt, set)
  • decrypting (decrypt, get)
  • rotating (rotate)
  • retrieving (keypair)

v1.59.1

Compare Source

Added

• add HELLO key to the kit sample to match most of our examples in the README

v1.59.0

Compare Source

Changed

• encrypt and set now create a .env file if one does not exist (#​771)
• pass --no-create to prevent file creation

v1.58.0

Compare Source

Changed

• Changed runtime injection message to format ⟐ injecting env (N) from FILE · dotenvx@VERSION (#​770)

v1.57.5

Compare Source

Changes

• Improve already installed message (#​768)

v1.57.4

Compare Source

Changes

• Use curl example for install dotenvx.com/ops (#​767)

v1.57.3

Compare Source

Changes

• Simplify installed success message (#​766)

v1.57.2

Compare Source

Changes

• Ran npm audit to update package-lock.json (#​763)

v1.57.1

Compare Source

Changes

• improved error logs and compacted most to a single line (#​755)

• introduced leading log glyphs as a visual status language:

  • ⟐ success action (injected)
  • ◈ success action (encrypted)
  • ◇ success action (set plain value, decrypted)
  • ⟳ success action (rotated)
  • ○ informational no-op (no changes)
  • ▣ success action for generated/updated support files
  • ⚠ warning
  • ☠ error

v1.57.0

Compare Source

Changed

• color and formatting changes to outputs (#​754)

v1.56.0

Compare Source

Changed

• ops off flag — now respected by get, keypair, rotate, and encrypt (#​750)
• --pp alias — added as shorthand for --pretty-print; toward sunsetting -pp (#​750)

Removed

• Remove support for .env.vault files (#​750)

v1.55.1

Compare Source

Added

• Respect dotenvx-ops status (on|off) (#​749)

v1.55.0

Compare Source

Added

• Add '⛨ ARMORED KEYS: Harden your private keys.' security feature when dotenvx-ops installed (#​746)

Removed

• Remove ProKeypair logic

v1.54.1

Compare Source

Changed

• Fix npm publish

v1.53.0

Compare Source

Removed

• Remove radar. It has been a year since replaced by ops. (#​743)

v1.52.0

Compare Source

Added

• Pass log level options to main.set (#​731)

v1.51.4

Compare Source

Changed

• Change description of dotenvx-ops to better reflect its tooling as operational primitives on top of dotenvx for production use cases. (#​721)

v1.51.3

Compare Source

Added

• Add hint on .env.keys for dotenvx armor up. Dotenvx Armor lets you armor your private keys securely with just a single command. It's a convenient alternative to manually copy/pasting them in and out of 1Password. (#​718)

v1.51.2

Compare Source

Changed

• Switch npm publish to use Dotenvx Ops' new Rotation Tokens (ROTs) (#​715)

This will allow us to start dogfooding our own solution for third-party API key rotation. Third-party API key rotation would drastically improve security industry wide. Please get in touch if this is interesting to you.

v1.51.1

Compare Source

Added

• Add opsOff type information