fix(deps): update dependency dotenv to v17

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
dotenv	^5.0.0 -> ^17.0.0

---

Release Notes

motdotla/dotenv (dotenv)

v17.2.3

Compare Source

Changed

• Fixed typescript error definition (#​912)

v17.2.2

Compare Source

Added

• 🙏 A big thank you to new sponsor Tuple.app - the premier screen sharing app for developers on macOS and Windows. Go check them out. It's wonderful and generous of them to give back to open source by sponsoring dotenv. Give them some love back.

v17.2.1

Compare Source

Changed

• Fix clickable tip links by removing parentheses (#​897)

v17.2.0

Compare Source

Added

• Optionally specify DOTENV_CONFIG_QUIET=true in your environment or .env file to quiet the runtime log (#​889)
• Just like dotenv any DOTENV_CONFIG_ environment variables take precedence over any code set options like ({quiet: false})

v17.1.0

Compare Source

Added

• Add additional security and configuration tips to the runtime log (#​884)
• Dim the tips text from the main injection information text

const TIPS = [
  '🔐 encrypt with dotenvx: https://dotenvx.com',
  '🔐 prevent committing .env to code: https://dotenvx.com/precommit',
  '🔐 prevent building .env in docker: https://dotenvx.com/prebuild',
  '🛠️  run anywhere with `dotenvx run -- yourcommand`',
  '⚙️  specify custom .env file path with { path: \'/custom/path/.env\' }',
  '⚙️  enable debug logging with { debug: true }',
  '⚙️  override existing env vars with { override: true }',
  '⚙️  suppress all logs with { quiet: true }',
  '⚙️  write to custom object with { processEnv: myObject }',
  '⚙️  load multiple .env files with { path: [\'.env.local\', \'.env\'] }'
]

v17.0.1

Compare Source

Changed

• Patched injected log to count only populated/set keys to process.env (#​879)

v17.0.0

Compare Source

Changed

• Default quiet to false - informational (file and keys count) runtime log message shows by default (#​875)

v16.6.1

Compare Source

Changed

• Default quiet to true – hiding the runtime log message (#​874)
• NOTICE: 17.0.0 will be released with quiet defaulting to false. Use config({ quiet: true }) to suppress.
• And check out the new dotenvx. As coding workflows evolve and agents increasingly handle secrets, encrypted .env files offer a much safer way to deploy both agents and code together with secure secrets. Simply switch require('dotenv').config() for require('@​dotenvx/dotenvx').config().

v16.6.0

Compare Source

Added

• Default log helpful message [[email protected]] injecting env (1) from .env (#​870)
• Use { quiet: true } to suppress
• Aligns dotenv more closely with dotenvx.

v16.5.0

Compare Source

Added

• 🎉 Added new sponsor Graphite - the AI developer productivity platform helping teams on GitHub ship higher quality software, faster.

[!TIP]
Become a sponsor

The dotenvx README is viewed thousands of times DAILY on GitHub and NPM.
Sponsoring dotenv is a great way to get in front of developers and give back to the developer community at the same time.

Changed

• Remove _log method. Use _debug #​862

v16.4.7

Compare Source

Changed

• Ignore .tap folder when publishing. (oops, sorry about that everyone. - @​motdotla) #​848

v16.4.6

Compare Source

Changed

• Clean up stale dev dependencies #​847
• Various README updates clarifying usage and alternative solutions using dotenvx

v16.4.5

Compare Source

Changed

• 🐞 Fix recent regression when using path option. return to historical behavior: do not attempt to auto find .env if path set. (regression was introduced in 16.4.3) #​814

v16.4.4

Compare Source

Changed

• 🐞 Replaced chaining operator ?. with old school && (fixing node 12 failures) #​812

v16.4.3

Compare Source

Changed

• 🐞 Fix recent regression when using path option. return to historical behavior: do not attempt to auto find .env if path set. (regression was introduced in 16.4.3) #​814

v16.4.2

Compare Source

Changed

• Changed funding link in package.json to dotenvx.com

v16.4.1

Compare Source

• Patch support for array as path option #​797

v16.4.0

Compare Source

• Add error.code to error messages around .env.vault decryption handling #​795
• Add ability to find .env.vault file when filename(s) passed as an array #​784

v16.3.2

Compare Source

Added

• Add debug message when no encoding set #​735

Changed

• Fix output typing for populate #​792
• Use subarray instead of slice #​793

v16.3.1

Compare Source

Added

• Add missing type definitions for processEnv and DOTENV_KEY options. #​756

v16.3.0

Compare Source

Added

• Optionally pass DOTENV_KEY to options rather than relying on process.env.DOTENV_KEY. Defaults to process.env.DOTENV_KEY #​754

v16.2.0

Compare Source

Added

• Optionally write to your own target object rather than process.env. Defaults to process.env. #​753
• Add import type URL to types file #​751

v16.1.4

Compare Source

Added

• Added .github/ to .npmignore #​747

v16.1.3

Compare Source

Removed

• Removed browser keys for path, os, and crypto in package.json. These were set to false incorrectly as of 16.1. Instead, if using dotenv on the front-end make sure to include polyfills for path, os, and crypto. node-polyfill-webpack-plugin provides these.

v16.1.2

Compare Source

Changed

• Exposed private function _configDotenv as configDotenv. #​744

v16.1.1

Compare Source

Added

• Added type definition for decrypt function

Changed

• Fixed {crypto: false} in packageJson.browser

v16.1.0

Compare Source

Added

• Add populate convenience method #​733
• Accept URL as path option #​720
• Add dotenv to npm fund command
• Spanish language README #​698
• Add .env.vault support. 🎉 (#​730)

ℹ️ .env.vault extends the .env file format standard with a localized encrypted vault file. Package it securely with your production code deploys. It's cloud agnostic so that you can deploy your secrets anywhere – without risky third-party integrations. read more

Changed

• Fixed "cannot resolve 'fs'" error on tools like Replit #​693

v16.0.3

Compare Source

Changed

• Added library version to debug logs (#​682)

v16.0.2

Compare Source

Added

• Export env-options.js and cli-options.js in package.json for use with downstream dotenv-expand module

v16.0.1

Compare Source

Changed

• Minor README clarifications
• Development ONLY: updated devDependencies as recommended for development only security risks (#​658)

v16.0.0

Compare Source

Added

• Breaking: Backtick support 🎉 (#​615)

If you had values containing the backtick character, please quote those values with either single or double quotes.

v15.0.1

Compare Source

Changed

• Properly parse empty single or double quoted values 🐞 (#​614)

v15.0.0

Compare Source

v15.0.0 is a major new release with some important breaking changes.

Added

• Breaking: Multiline parsing support (just works. no need for the flag.)

Changed

• Breaking: # marks the beginning of a comment (UNLESS the value is wrapped in quotes. Please update your .env files to wrap in quotes any values containing #. For example: SECRET_HASH="something-with-a-#-hash").

..Understandably, (as some teams have noted) this is tedious to do across the entire team. To make it less tedious, we recommend using dotenv cli going forward. It's an optional plugin that will keep your .env files in sync between machines, environments, or team members.

Removed

• Breaking: Remove multiline option (just works out of the box now. no need for the flag.)

v14.3.2

Compare Source

Changed

• Preserve backwards compatibility on values containing # 🐞 (#​603)

v14.3.1

Compare Source

Changed

• Preserve backwards compatibility on exports by re-introducing the prior in-place exports 🐞 (#​606)

v14.3.0

Compare Source

Added

• Add multiline option 🎉 (#​486)

v14.2.0

Compare Source

Added

• Add dotenv_config_override cli option
• Add DOTENV_CONFIG_OVERRIDE command line env option

v14.1.1

Compare Source

Added

• Add React gotcha to FAQ on README

v14.1.0

Compare Source

Added

• Add override option 🎉 (#​595)

v14.0.1

Compare Source

Added

• Log error on failure to load .env file (#​594)

v14.0.0

Compare Source

Added

• Breaking: Support inline comments for the parser 🎉 (#​568)

v13.0.1

Compare Source

Changed

• Hide comments and newlines from debug output (#​404)

v13.0.0

Compare Source

Added

• Breaking: Add type file for config.js (#​539)

v12.0.4

Compare Source

Changed

• README updates
• Minor order adjustment to package json format

v12.0.3

Compare Source

Changed

• Simplified jsdoc for consistency across editors

v12.0.2

Compare Source

Changed

• Improve embedded jsdoc type documentation

v12.0.1

Compare Source

Changed

• README updates and clarifications

v12.0.0

Compare Source

Removed

• Breaking: drop support for Flow static type checker (#​584)

Changed

• Move types/index.d.ts to lib/main.d.ts (#​585)
• Typescript cleanup (#​587)
• Explicit typescript inclusion in package.json (#​566)

v11.0.0

Compare Source

Changed

• Breaking: drop support for Node v10 (#​558)
• Patch debug option (#​550)

v10.0.0

Compare Source

Added

• Add generic support to parse function
• Allow for import "dotenv/config.js"
• Add support to resolve home directory in path via ~

v9.0.2

Compare Source

Changed

• Support windows newlines with debug mode

v9.0.1

Compare Source

Changed

• Updates to README

v9.0.0

Compare Source

Changed

• Breaking: drop support for Node v8

v8.6.0

Compare Source

Added

• define package.json in exports

v8.5.1

Compare Source

Changed

• updated dev dependencies via npm audit

v8.5.0

Compare Source

Added

• allow for import "dotenv/config"

v8.4.0

Compare Source

Changed

• point to exact types file to work with VS Code

v8.3.0

Compare Source

Changed

• Breaking: drop support for Node v8 (mistake to be released as minor bump. later bumped to 9.0.0. see above.)

v8.2.0

Compare Source

Added

• TypeScript types

v8.1.0

Compare Source

Changed

• Breaking: drop support for Node v6 (#​392)

v8.0.0

Compare Source

Changed

• Breaking: drop support for Node v6 (#​302)

7.0.0 - 2019-03-12

Fixed

• Fix removing unbalanced quotes (#​376)

Removed

• Removed load alias for config for consistency throughout code and documentation.

6.2.0 - 2018-12-03

Added

• Support preload configuration via environment variables (#​351)

6.1.0 - 2018-10-08

Added

• debug option for config and parse methods will turn on logging

6.0.0 - 2018-06-02

Changed

• Breaking: drop support for Node v4 (#​304)

5.0.0 - 2018-01-29

Added

• Testing against Node v8 and v9
• Documentation on trim behavior of values
• Documentation on how to use with import

Changed

• Breaking: default path is now path.resolve(process.cwd(), '.env')
• Breaking: does not write over keys already in process.env if the key has a falsy value
• using const and let instead of var

Removed

• Testing against Node v7

4.0.0 - 2016-12-23

Changed

• Return Object with parsed content or error instead of false (#​165).

Removed

• verbose option removed in favor of returning result.

3.0.0 - 2016-12-20

Added

• verbose option will log any error messages. Off by default.
• parses email addresses correctly
• allow importing config method directly in ES6

Changed

• Suppress error messages by default (#​154)
• Ignoring more files for NPM to make package download smaller

Fixed

• False positive test due to case-sensitive variable (#​124)

Removed

• silent option removed in favor of verbose

2.0.0 - 2016-01-20

Added

• CHANGELOG to "make it easier for users and contributors to see precisely what notable changes have been made between each release". Linked to from README
• LICENSE to be more explicit about what was defined in package.json. Linked to from README
• Testing nodejs v4 on travis-ci
• added examples of how to use dotenv in different ways
• return parsed object on success rather than boolean true

Changed

• README has shorter description not referencing ruby gem since we don't have or want feature parity

Removed

• Variable expansion and escaping so environment variables are encouraged to be fully orthogonal

1.2.0 - 2015-06-20

Added

• Preload hook to require dotenv without including it in your code

Changed

• clarified license to be "BSD-2-Clause" in package.json

Fixed

• retain spaces in string vars

1.1.0 - 2015-03-31

Added

• Silent option to silence console.log when .env missing

1.0.0 - 2015-03-13

Removed

• support for multiple .env files. should always use one .env file for the current environment

v7.0.0

Compare Source

Changed

• Breaking: drop support for Node v6 (#​302)

7.0.0 - 2019-03-12

Fixed

• Fix removing unbalanced quotes (#​376)

Removed

• Removed load alias for config for consistency throughout code and documentation.

6.2.0 - 2018-12-03

Added

• Support preload configuration via environment variables (#​351)

6.1.0 - 2018-10-08

Added

• debug option for config and parse methods will turn on logging

6.0.0 - 2018-06-02

Changed

• Breaking: drop support for Node v4 (#​304)

5.0.0 - 2018-01-29

Added

• Testing against Node v8 and v9
• Documentation on trim behavior of values
• Documentation on how to use with import

Changed

• Breaking: default path is now path.resolve(process.cwd(), '.env')
• Breaking: does not write over keys already in process.env if the key has a falsy value
• using const and let instead of var

Removed

• Testing against Node v7

4.0.0 - 2016-12-23

Changed

• Return Object with parsed content or error instead of false (#​165).

Removed

• verbose option removed in favor of returning result.

3.0.0 - 2016-12-20

Added

• verbose option will log any error messages. Off by default.
• parses email addresses correctly
• allow importing config method directly in ES6

Changed

• Suppress error messages by default (#​154)
• Ignoring more files for NPM to make package download smaller

Fixed

• False positive test due to case-sensitive variable (#​124)

Removed

• silent option removed in favor of verbose

2.0.0 - 2016-01-20

Added

• CHANGELOG to "make it easier for users and contributors to see precisely what notable changes have been made between each release". Linked to from README
• LICENSE to be more explicit about what was defined in package.json. Linked to from README
• Testing nodejs v4 on travis-ci
• added examples of how to use dotenv in different ways
• return parsed object on success rather than boolean true

Changed

• README has shorter description not referencing ruby gem since we don't have or want feature parity

Removed

• Variable expansion and escaping so environment variables are encouraged to be fully orthogonal

1.2.0 - 2015-06-20

Added

• Preload hook to require dotenv without including it in your code

Changed

• clarified license to be "BSD-2-Clause" in package.json

Fixed

• retain spaces in string vars

1.1.0 - 2015-03-31

Added

• Silent option to silence console.log when .env missing

1.0.0 - 2015-03-13

Removed

• support for multiple .env files. should always use one .env file for the current environment

v6.2.0

Compare Source

Changed

• Breaking: drop support for Node v6 (#​302)

7.0.0 - 2019-03-12

Fixed

• Fix removing unbalanced quotes (#​376)

Removed

• Removed load alias for config for consistency throughout code and documentation.

6.2.0 - 2018-12-03

Added

• Support preload configuration via environment variables (#​351)

6.1.0 - 2018-10-08

Added

• debug option for config and parse methods will turn on logging

6.0.0 - 2018-06-02

Changed

• Breaking: drop support for Node v4 (#​304)

5.0.0 - 2018-01-29

Added

• Testing against Node v8 and v9
• Documentation on trim behavior of values
• Documentation on how to use with import

Changed

• Breaking: default path is now path.resolve(process.cwd(), '.env')
• Breaking: does not write over keys already in process.env if the key has a falsy value
• using const and let instead of var

Removed

• Testing against Node v7

4.0.0 - 2016-12-23

Changed

• Return Object with parsed content or error instead of false (#​165).

Removed

• verbose option removed in favor of returning result.

3.0.0 - 2016-12-20

Added

• verbose option will log any error messages. Off by default.
• parses email addresses correctly
• allow importing config method directly in ES6

Changed

• Suppress error messages by default (#​154)
• Ignoring more files for NPM to make package download smaller

Fixed

• False positive test due to case-sensitive variable (#​124)

Removed

• silent option removed in favor of verbose

2.0.0 - 2016-01-20

Added

• CHANGELOG to "make it easier for users and contributors to see precisely what notable changes have been made between each release". Linked to from README
• LICENSE to be more explicit about what was defined in package.json. Linked to from README
• Testing nodejs v4 on travis-ci
• added examples of how to use dotenv in different ways
• return parsed object on success rather than boolean true

Changed

• README has shorter description not referencing ruby gem since we don't have or want feature parity

Removed

• Variable expansion and escaping so environment variables are encouraged to be fully orthogonal

1.2.0 - 2015-06-20

Added

• Preload hook to require dotenv without including it in your code

Changed

• clarified license to be "BSD-2-Clause" in package.json

Fixed

• retain spaces in string vars

1.1.0 - 2015-03-31

Added

• Silent option to silence console.log when .env missing

1.0.0 - 2015-03-13

Removed

• support for multiple .env files. should always use one .env file for the current environment

v6.1.0

Compare Source

Changed

• Breaking: drop support for Node v6 (#​302)

7.0.0 - 2019-03-12

Fixed

• Fix removing unbalanced quotes (#​376)

Removed

• Removed load alias for config for consistency throughout code and documentation.

6.2.0 - 2018-12-03

Added

• Support preload configuration via environment variables (#​351)

6.1.0 - 2018-10-08

Added

• debug option for config and parse methods will turn on logging

6.0.0 - 2018-06-02

Changed

• Breaking: drop support for Node v4 (#​304)

5.0.0 - 2018-01-29

Added

• Testing against Node v8 and v9
• Documentation on trim behavior of values
• Documentation on how to use with import

Changed

• Breaking: default path is now path.resolve(process.cwd(), '.env')
• Breaking: does not write over keys already in process.env if the key has a falsy value
• using const and let instead of var

Removed

• Testing against Node v7

4.0.0 - 2016-12-23

Changed

• Return Object with parsed content or error instead of false (#​165).

Removed

• verbose option removed in favor of returning result.

3.0.0 - 2016-12-20

Added

• verbose option will log any error messages. Off by default.
• parses email addresses correctly
• allow importing config method directly in ES6

Changed

• Suppress error messages by default (#​154)
• Ignoring more files for NPM to make package download smaller

Fixed

• False positive test due to case-sensitive variable (#​124)

Removed

• silent option removed in favor of verbose

2.0.0 - 2016-01-20

Added

• CHANGELOG to "make it easier for users and contributors to see precisely what notable changes have been made between each release". Linked to from README
• LICENSE to be more explicit about what was defined in package.json. Linked to from README
• Testing nodejs v4 on travis-ci
• added examples of how to use dotenv in different ways
• return parsed object on success rather than boolean true

Changed

• README has shorter description not referencing ruby gem since we don't have or want feature parity

Removed

• Variable expansion and escaping so environment variables are encouraged to be fully orthogonal

1.2.0 - 2015-06-20

Added

• Preload hook to require dotenv without including it in your code

Changed

• clarified license to be "BSD-2-Clause" in package.json

Fixed

• retain spaces in string vars

1.1.0 - 2015-03-31

Added

• Silent option to silence console.log when .env missing

1.0.0 - 2015-03-13

Removed

• support for multiple .env files. should always use one .env file for the current environment

v6.0.0

Compare Source

Changed

• Breaking: drop support for Node v6 (#​302)

7.0.0 - 2019-03-12

Fixed

• Fix removing unbalanced quotes (#​376)

Removed

• Removed load alias for config for consistency throughout code and documentation.

6.2.0 - 2018-12-03

Added

• Support preload configuration via environment variables (#​351)

6.1.0 - 2018-10-08

Added

• debug option for config and parse methods will turn on logging

6.0.0 - 2018-06-02

Changed

• Breaking: drop support for Node v4 (#​304)

5.0.0 - 2018-01-29

Added

• Testing against Node v8 and v9
• Documentation on trim behavior of values
• Documentation on how to use with import

Changed

• Breaking: default path is now path.resolve(process.cwd(), '.env')
• Breaking: does not write over keys already in process.env if the key has a falsy value
• using const and let instead of var

Removed

• Testing against Node v7

4.0.0 - 2016-12-23

Changed

• Return Object with parsed content or error instead of false (#​165).

Removed

• verbose option removed in favor of returning result.

3.0.0 - 2016-12-20

Added

• verbose option will log any error messages. Off by default.
• parses email addresses correctly
• allow importing config method directly in ES6

Changed

• Suppress error messages by default (#​154)
• Ignoring more files for NPM to make package download smaller

Fixed

• False positive test due to case-sensitive variable (#​124)

Removed

• silent option removed in favor of verbose

2.0.0 - 2016-01-20

Added

• CHANGELOG to "make it easier for users and contributors to see precisely what notable changes have been made between each release". Linked to from README
• LICENSE to be more explicit about what was defined in package.json. Linked to from README
• Testing nodejs v4 on travis-ci
• added examples of how to use dotenv in different ways
• return parsed object on success rather than boolean true

Changed

• README has shorter description not referencing ruby gem since we don't have or want feature parity

Removed

• Variable expansion and escaping so environment variables are encouraged to be fully orthogonal

1.2.0 - 2015-06-20

Added

• Preload hook to require dotenv without including it in your code

Changed

• clarified license to be "BSD-2-Clause" in package.json

Fixed

• retain spaces in string vars

1.1.0 - 2015-03-31

Added

• Silent option to silence console.log when .env missing

1.0.0 - 2015-03-13

Removed

• support for multiple .env files. should always use one .env file for the current environment

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.