Skip to content

Update dependency @dotenvx/dotenvx to v2#21

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/dotenvx-dotenvx-2.x
Open

Update dependency @dotenvx/dotenvx to v2#21
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/dotenvx-dotenvx-2.x

Conversation

@renovate

@renovate renovate Bot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@dotenvx/dotenvx ^0.35.0^2.0.0 age confidence

Release Notes

dotenvx/dotenvx (@​dotenvx/dotenvx)

v2.7.3

Compare Source

Changed
  • Fix: --quiet should not display the spinner and its stderr messages (#​889)

v2.7.2

Compare Source

Added
  • Include dotenvx armor status command.

v2.7.1

Compare Source

Changed
  • Security Improvement: dotenvx armor login attempts to set the DOTENVX_ARMOR_TOKEN in your native OS secret store going forward. For current Armor users run dotenvx armor logout and then dotenvx armor login to make use of this immediately. (#​886)

v2.7.0

Compare Source

Added
  • Added support for --mask on get, run, decrypt (#​885)

v2.6.0

Compare Source

Added
  • Support native up|down|pull|push for windows (#​884)

v2.5.0

Compare Source

Added
  • Support native up|down|pull|push for windows (#​883)

v2.4.1

Compare Source

Added
  • Support config(path:) as a directory like app/web. Useful for monorepos (#​882)

v2.4.0

Compare Source

Added
  • Support multiple -fk flags for select commands (#​880)
  • Support -f ../.. directories (#​881)

v2.3.4

Compare Source

Removed
  • Replace various deps with @dotenvx/tooling (#​879)

v2.3.3

Compare Source

Removed
  • Remove dotenv and commander for @dotenvx/tooling (#​878)

v2.3.2

Compare Source

Changed
  • Permit empty value for set (#​877)

v2.3.1

Compare Source

Changed
  • Fix correct default valuation interpolation for empty strings by upgrading primitives package

v2.3.0

Compare Source

Added
  • Add lock up and lock down commands for password protecting private keys (#​875)
Changed
  • BREAKING: Rename keychain commands to native to make way for windows and linux. (#​875)
Removed
  • BREAKING: Remove --no-ops. Use --no-armor. (#​875)

v2.2.2

Compare Source

Changed
  • Move login and logout under armor (#​874)

v2.2.1

Compare Source

Changed
  • Move genexample to top level commands (#​873)

v2.2.0

Compare Source

Added
  • Use dotenvx keychain up|down to move your private keys to your macOS Keychain (#​872)

v2.1.5

Compare Source

Changed
  • precommit and prebuild respect _PLAIN (#​871)

v2.1.4

Compare Source

Added
  • Add support for DOTENV_CONFIG_CONVENTION=nextjs (#​869)

v2.1.3

Compare Source

Changed
  • Patch edge case when custom unspecified -f and --env flag (#​868)

v2.1.2

Compare Source

Changed

v2.1.1

Compare Source

Changed
  • Support DOTENV_CONFIG_QUIET=true as synonym for --quiet flag (#​866)

v2.1.0

Compare Source

Added
  • Add interactive input mode for set (#​862)
  • Support leaving _PLAIN suffixed keys unencrypted during set and encrypt (#​862)
Changed
  • Return exit code 1 from get when decryption errors are reported (#​862)
Fixed
  • Add Windows PowerShell coverage for npm shim encryption of .env.local files

v2.0.0

Compare Source

Changed
  • BREAKING: lib/main#set async only (#​855)
  • BREAKING: lib/main#get async only (#​855)
  • New keyring support - for local and armor providers and to unlock future providers (#​855)
  • Route run, config, and get through shared env and keypair resolvers backed by @dotenvx/primitives (#​855)
  • Route set, encrypt, and decrypt through shared transforms that operate on primitive scan, parse, encrypt, and upsert results (#​855)
  • Update library parse to use primitive parsing while preserving dotenvx-style encrypted value errors (#​855)
Removed
  • BREAKING: Remove the rotate command (it will return in 2.1 or 2.2 soon with a more complete implementation for local and armored keys) (#​855)
  • BREAKING: Remove the library doctor, keypair, and genexample exports from lib/main (#​855)

v1.75.1

Compare Source

Changed
  • Publish as named binaries (#​851)
Removed
  • Remove references to dotenvx-vlt (now dotenvx-armor) (#​849)

v1.75.0

Compare Source

Changed
  • Swap in @dotenvx/primitives (#​848)
  • ext commands become first-class(#​847)

v1.74.3

Compare Source

Changed
  • Bundle dotenvx with @dotenvx/next-env for user convenience (#​845)

v1.74.2

Compare Source

Changed
  • Fix provenance for @dotenvx/next-env (#​844)

v1.74.1

Compare Source

Added
  • Add README for @dotenvx/next-env (#​843)

v1.73.1

Compare Source

Changed
  • Give update available notification only for armor commands (#​840)

v1.73.0

Compare Source

Added
  • Add dotenvx armor commands directly inside dotenvx (#​839)

dotenvx remains local-first: armor commands are optional under professional security section

v1.72.0

Compare Source

Added
  • Move armor login command to first class dotenvx login command. (#​836)
  • dotenvx remains local-first: login is optional and only needed when you want Armor features like moving keys off-device, team sharing, and audit access.
  • Patch 2 high severity dependencies (#​837)

v1.71.3

Compare Source

Changed
  • Forward command to Dotenvx Armor Key Guard approvals (#​835)

v1.71.2

Compare Source

Changed
  • touch up get, set, and decrypt when armor installed (#​834)

v1.71.1

Compare Source

Changed
  • stderr changed to inherit for dotenvx-armor integration (#​833)

v1.71.0

Compare Source

Added
  • Add optional automation --token support for Armor ⛨ users (#​831)

v1.70.0

Compare Source

Changed
  • Dotenvx Ops/Vlt is now Dotenvx Armor ⛨ (#​830)

v1.69.2

Compare Source

Changed
  • Minor messaging improvements, especially if using armored keys (#​825)

v1.69.1

Compare Source

Changed
  • Internally rename ops to vlt (#​823)

v1.69.0

Compare Source

Changed
  • Remove fully-deprecated opsOff option in favor of noOps (#​822)

v1.68.1

Compare Source

Changed

v1.68.0

Compare Source

Changed
  • Support ignore option on parse (#​820)

v1.67.0

Compare Source

Added
  • Add prompt for local storage vs armored storage (#​819)

v1.66.0

Compare Source

Added

v1.65.3

Compare Source

Changed
  • Improve spinner message blinking with simpler --no-spinner flag passed to ops (#​814)

v1.65.2

Compare Source

Changed
  • Improve spinner message coordination between dotenvx and dotenvx-ops (#​813)

v1.65.1

Compare Source

Changed
  • Prompts from ops should bubble up (#​812)

v1.65.0

Compare Source

Added
  • Add support for replaceing duplicate keys with different values (#​806)

v1.64.0

Compare Source

Added
  • Add optional dotenvx armor command.
    • armor up armor private key
    • armor down dearmor private key
    • armor push push armored key (from .env.keys)
    • armor pull pull armored key (into .env.keys)

Move private keys off device and under access control with Dotenvx Ops ⛨. Learn more

v1.63.0

Compare Source

Added
  • Add support for encrypted values passed to --env flag (#​804)
  • Add support for --format=colon in order to support cloudflare's wrangler --var flag format (#​804)

v1.62.0

Compare Source

Added
  • Add support for config({ envs }). unlocks simpler cloudflare worker integration (#​803)
$ dotenvx encrypt -f .env.txt
// src/index.js
import envSrc from '../.env.txt'
import dotenvx from '@​dotenvx/dotenvx'

const config = dotenvx.config({ envs: [{ type: 'env', value: envSrc, privateKeyName: 'DOTENV_PRIVATE_KEY' }] })
const envx = config.parsed

export default {
  async fetch(request, env, ctx) {
    return new Response(`Hello ${envx.HELLO}`)
  }
}
"scripts": {
  "deploy": "wrangler deploy",
  "dev": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
  "start": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
  "test": "vitest"
},

v1.61.6

Compare Source

Changed
  • Guard against command substitution following encrypted: (#​802)

v1.61.5

Compare Source

Changed
  • Support --hostname flag to dotenvx-ops.login (#​801)

v1.61.4

Compare Source

Changed
  • Respect SIGINT handler completion (#​798)

v1.61.3

Compare Source

Changed
  • Tighten up ext precommit --install message (#​797)

v1.61.2

Compare Source

Changed
  • For Ops ⛨ users surface stderr (#​796)

v1.61.1

Compare Source

Changed
  • Faster coldstarts! (#​781)
  • Patch dotenvx precommit|prebuild shorthand (#​793)

v1.61.0

Compare Source

Added
  • Add login and logout method that proxy to dotenvx-ops login/logout (#​780)
  • Note: dotenvx continues to make zero outgoing HTTP requests and includes no telemetry. Outgoing requests occur only if you explicitly install the dotenvx-ops SDK or CLI.

v1.60.2

Compare Source

Changed
  • Communicate local key and armored key (for Ops stored keys) (#​778)

v1.60.1

Compare Source

Added
  • Added missing + key ⛨ for Ops stored keys (#​777)

v1.60.0

Compare Source

Added
  • Add spinner with loading messages
    • injecting (run)
    • encrypting (encrypt, set)
    • decrypting (decrypt, get)
    • rotating (rotate)
    • retrieving (keypair)

v1.59.1

Compare Source

Added
  • add HELLO key to the kit sample to match most of our examples in the README

v1.59.0

Compare Source

Changed
  • encrypt and set now create a .env file if one does not exist (#​771)
  • pass --no-create to prevent file creation

v1.58.0

Compare Source

Changed
  • Changed runtime injection message to format ⟐ injecting env (N) from FILE · dotenvx@VERSION (#​770)

v1.57.5

Compare Source

Changes
  • Improve already installed message (#​768)

v1.57.4

Compare Source

Changes

v1.57.3

Compare Source

Changes
  • Simplify installed success message (#​766)

v1.57.2

Compare Source

Changes
  • Ran npm audit to update package-lock.json (#​763)

v1.57.1

Compare Source

Changes
  • improved error logs and compacted most to a single line (#​755)

  • introduced leading log glyphs as a visual status language:

    • success action (injected)
    • success action (encrypted)
    • success action (set plain value, decrypted)
    • success action (rotated)
    • informational no-op (no changes)
    • success action for generated/updated support files
    • warning
    • error

v1.57.0

Compare Source

Changed
  • color and formatting changes to outputs (#​754)

v1.56.0

Compare Source

Changed
  • ops off flag — now respected by get, keypair, rotate, and encrypt (#​750)
  • --pp alias — added as shorthand for --pretty-print; toward sunsetting -pp (#​750)
Removed
  • Remove support for .env.vault files (#​750)

v1.55.1

Compare Source

Added
  • Respect dotenvx-ops status (on|off) (#​749)

v1.55.0

Compare Source

Added
  • Add '⛨ ARMORED KEYS: Harden your private keys.' security feature when dotenvx-ops installed (#​746)
Removed
  • Remove ProKeypair logic

v1.54.1

Compare Source

Changed
  • Fix npm publish

v1.53.0

Compare Source

Removed
  • Remove radar. It has been a year since replaced by ops. (#​743)

v1.52.0

Compare Source

Added
  • Pass log level options to main.set (#​731)

v1.51.4

Compare Source

Changed
  • Change description of dotenvx-ops to better reflect its tooling as operational primitives on top of dotenvx for production use cases. (#​721)

v1.51.3

Compare Source

Added
  • Add hint on .env.keys for dotenvx armor up. Dotenvx Armor lets you armor your private keys securely with just a single command. It's a convenient alternative to manually copy/pasting them in and out of 1Password. (#​718)

v1.51.2

Compare Source

Changed

This will allow us to start dogfooding our own solution for third-party API key rotation. Third-party API key rotation would drastically improve security industry wide. Please get in touch if this is interesting to you.

v1.51.1

Compare Source

Added
  • Add opsOff type information

v1.51.0

Compare Source

Added
  • Add config({opsOff: true}) options and --ops-off flag for turning off Dotenvx Ops features. (#​680)

v1.50.1

Compare Source

Removed
  • Remove listed command to radar (now ops) (#​678)

v1.50.0

Compare Source

Added
  • Add optional dotenvx ops command (#​677)
  • Ops is a coming rename of Radar. Radar will become a feature inside ops.
  • With dotenvx ops use dotenvx across your team, infrastructure, agents, and more.
 _______________________________________________________________________
|                                                                       |
|  dotenvx-ops: production grade dotenvx–with operational primitives    |
|                                                                       |
|  ░▒▓██████▓▒░░▒▓███████▓▒░ ░▒▓███████▓▒░                              |
| ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░                                     |
| ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░                                     |
| ░▒▓█▓▒░░▒▓█▓▒░▒▓███████▓▒░ ░▒▓██████▓▒░                               |
| ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░             ░▒▓█▓▒░                              |
| ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░             ░▒▓█▓▒░                              |
|  ░▒▓██████▓▒░░▒▓█▓▒░      ░▒▓███████▓▒░                               |
|                                                                       |
|  Learn more at https://dotenvx.com/ops                                |
|_______________________________________________________________________|

v1.49.1

Compare Source

Changed
  • 🐞 patch bug with variable expansion of single quoted values (#​675)

v1.49.0

Compare Source

Added
  • For precommit and prebuild, ignore .env.x file like we do with .env.vault file. (#​666)

v1.48.4

Compare Source

Removed
  • Remove unnecessary use of eval in proKeypair helper (#​654)

v1.48.3

Compare Source

Changed
  • Include privateKeyName and privateKey on internal processedEnv object (#​649)

v1.48.2

Compare Source

Changed
  • Check radar status before sending (#​646)

v1.48.1

Compare Source

Changed
  • Send beforEnv and afterEnv to Radar if user has installed (#​645)

v1.48.0

Compare Source

Added
  • Include beforeEnv and afterEnv for user debugging (#​644)

v1.47.7

Compare Source

Changed
  • src should be in internal processEnv object (#​643)

v1.47.6

Compare Source

Changed
  • Make Radar call non-blocking (#​642)

v1.47.5

Compare Source

Changed
  • Add resilient handling of any Radar failures (#​639)

v1.47.4

Compare Source

Changed

v1.47.3

Compare Source

Added
  • Send to radar#observe if Radar installed by user (#​631)
Removed
  • Remove cli in package.json (#​632)

v1.47.2

Compare Source

Added
  • Export cli in package.json (#​629)

v1.47.1

Compare Source

Added
  • Add convenience log that radar active 📡 when dotenvx-radar is installed (#​625)

v1.47.0

Compare Source

Added
  • Add optional dotenvx radar command (#​624)
  • Radar is an early access commercial extension for dotenvx that will auto backup your .env files.
 _______________________________________________________________________
|                                                                       |
|  Dotenvx Radar: Env Observability                                     |
|                                                                       |
|  ░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓███████▓▒░    |
|  ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░   |
|  ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░   |
|  ░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓████████▓▒░▒▓███████▓▒░    |
|  ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░   |
|  ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░   |
|  ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░   |
|                                                                       |
|  Observe, version, and back up your environment variables at runtime. |
|                                                                       |
|  Purchase lifetime access at https://dotenvx.com/radar                |
|                                                                       |
| --------------------------------------------------------------------- |
| - thank you for using dotenvx! - @​motdotla                            |
|_______________________________________________________________________|

v1.46.0

Compare Source

Added
  • Add error when hoisting issue experienced around commander.js (#​623)
Removed
  • Remove git-dotenvx and git dotenvx shorthand (#​621)

v1.45.2

Compare Source

Changed
  • Minor README updates

v1.45.1

Compare Source

Changed
  • Include setLogName and setLogVersion in config (#​613)

v1.45.0

Compare Source

Added
  • Add logger.setName and logger.setVersion for customization of logger (#​612)

v1.44.2

Compare Source

Changed
  • Clarify license is BSD-3.

v1.44.1

Compare Source

Changed

v1.44.0

Compare Source

Added

v1.43.0

Compare Source

Removed
  • Remove errorv, errornocolor, blank from logger options (#​584)
Changed
  • Replace instances of console.error with logger.error (#​584)

v1.42.2

Compare Source

Changed
  • Fix --force flag work with ?force=true (2776715)

v1.42.1

Compare Source

Added
  • Add --force flag to install.sh (0b8d21c)

v1.42.0

Compare Source

Added
  • Add ability to override the os and arch via install.sh and dotenvx.sh (3ded752)

v1.41.0

Compare Source

Added
  • Add [directory] argument to precommit and prebuild (#​572)

v1.40.1

Compare Source

Changed

v1.40.0

Compare Source

Added
  • Smarter ext precommit and ext prebuild – catch duplicate KEYs in the same .env file where one is mistakenly left unencrypted (#​567)

v1.39.1

Compare Source

Added
  • Add version to homebrew formula (#​564)

v1.39.0

Compare Source

Added
  • Add --convention flow option to dotenvx run (#​551)
Changed

v1.38.5

Compare Source

Added
  • 🐞 Add config.d.ts file to fix type error when loading dotenvx/dotenvx/config with dynamic import (#​547)

v1.38.4

Compare Source

Changed
  • 🐞 Fix blank line disappearing after encrypting empty value (#​542)

v1.38.3

Compare Source

Changed
  • 🐞 Fix self-referencing expansion when key exists already in process.env (#​536)

v1.38.2

Compare Source

Added
  • Add typescript types for main.get.

v1.38.1

Compare Source

Changed
  • Support encrypt when mutliline contains windows CRLF (\r\n) (#​534)

Note: dotenvx will convert these \r\n newlines to \n. Our recommendation is to stop using CRLF - its origin is from typewriter days. Instead, set your editor or gitattributes to use LF.

v1.38.0

Compare Source

Changed
  • Command substitution failures no longer halt further processing of keys in a .env file (#​533)
  • A more helpful error is raised if a command substitution failure occurs (#​533)

v1.37.0

Compare Source

Added
  • add dotenvx rotate command 🎉 (#​530)

also: our whitepaper is released as a draft.

v1.36.0

Compare Source

Changed
  • --strict flag respects (doesn't throw) anything in --ignore flag (#​527)

v1.35.0

Compare Source

Added
  • npx dotenvx precommit support as a convenience (#​523)
  • main.get method (#​524)

The addition of main.get facilitates what we term Decryption at Access, a concept explored in greater detail in our whitepaper.

v1.34.0

Compare Source

Added
  • main.set method now writes to files (#​517)

v1.33.0

Compare Source

Added
  • support ESM import convenience import '@​dotenvx/dotenvx/config' (#​508)

v1.32.1

Compare Source

Changed
  • remove duplicated help messages (#​504)

v1.32.0

Compare Source

Added
  • add encrypted check support for ext prebuild (#​501)
Changed
  • modify ext precommit to check git modified state as well as git staged state - useful for using dotenvx ext precommit without the --install flag in automated scripts and ci. (#​499)
Removed
  • remove internal logger methods errorvp, errorvpb, warnv, warnvp, warnvpb, successvp, successvpb, help2 (#​501)

v1.31.3

Compare Source

Changed
  • adjust wingetcreate to use powershell when parsing version

v1.31.2

Compare Source

Changed
  • use wingetcreate for releasing to WinGet (#​498)

v1.31.1

Compare Source

Changed
  • 🐞 fix encryption of values containing explicit \n newlines (#​495)

v1.31.0

Compare Source

Added
  • expose main.set function (#​492)
  • add missing types for main.config (#​491)

v1.30.1

Compare Source

Added
  • support complex command substitution combining variable expansion (#​490)

v1.30.0

Compare Source

Added
  • add -fk (--env-keys-file) flag to customize the path to your .env.keys file with run, get, set, encrypt, decrypt, and keypair 🎉 (#​486)

This is great for monorepos. Maintain one .env.keys file across all your apps.

$ dotenvx encrypt -fk .env.keys -f apps/backend/.env
$ dotenvx encrypt -fk .env.keys -f apps/frontend/.env

$ tree -a .
├── .env.keys
└── apps
    ├── backend
    │   └── .env
    └── frontend
        └── .env

$ dotenvx get -fk .env.keys -f apps/backend/.env

v1.29.0

Compare Source

Added
  • add --ignore flag to suppress specified errors. example: dotenvx run --ignore=MISSING_ENV_FILE (#​485)

v1.28.0

Compare Source

Changed
  • .env.keys file is generated WITHOUT quotes going forward. This is to minimize friction around Docker gotchas to developers - old versions of Docker do not support --env-file containing quoted keys/values. (#​480) (additional note)

v1.27.0

Compare Source

Added
  • add support for \t expansion when double quoted. (e.g. TAB="hi\tfriend" becomes hi friend) (#​479)

v1.26.2

Compare Source

Changed
  • build binaries with bytecode option (#​477)

v1.26.1

Compare Source

Added
  • add typescript type definitions for main.parse method (#​475)

v1.26.0

Compare Source

Added
  • add privateKey option to main.parse method (#​474)

v1.25.2

Compare Source

Added
  • for binaries add pre-build step using esbuild (#​471)
Removed
  • remove types for functions that were removed a while back (2aa660)

v1.25.1

[Compare Source](https://redirect.github.com/dotenv

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot force-pushed the renovate/dotenvx-dotenvx-2.x branch 8 times, most recently from df40398 to 05f5d1e Compare July 9, 2026 17:29
@renovate renovate Bot force-pushed the renovate/dotenvx-dotenvx-2.x branch 4 times, most recently from a158110 to 5ba761a Compare July 13, 2026 19:39
@renovate renovate Bot force-pushed the renovate/dotenvx-dotenvx-2.x branch from 5ba761a to 42af36f Compare July 14, 2026 03:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants