@dotenvx/dotenvx

Changed

• Improve bundle size (#1000)

Changed

• Simplify custody picker to 3 initial options (#998)

? Choose private key custody …
❯ ⛉ Local
  ⛨ Dotenvx Armor
  ⛊ Password Managers

Changed

• BREAKING: Envfile renamed to Envspec file (#996)
• BREAKING: dotenvx init removed. renamed to dotenvx spec. (#996)

Added

• Envspec rules now guide check, run, encrypt, and protect. (#996)

Changed

• armor up should read for os secret store, 1password, and bitwarden (#992)

Added

• Add dotenvx feedback command so you (and your coding agent) can give feedback on the cli (#987)
• Add dotenvx init for generating your Envfile (#990)

Changed

• Restore ESM named imports such as import { config } from '@dotenvx/dotenvx', broken in 2.30.0 by the withEvents export (#989).
• BREAKING: dotenvx validate renamed to dotenvx check and works off Envfile only going forward. Support for .env.example dropped. Switch to using an Envfile.

Removed

• BREAKING: dotenvx define removed. Use dotenvx init.

Added

• Add support for secrets references as safe from dotenvx protect (#985)
• Add cli audit logging for Armor customers (#983)

Added

• Add dotenvx protect to prevent plaintext .env files from being committed to code on a machine (#980)

Changed

• Deprecate dotenvx gitignore. Use dotenvx protect.
• Deprecate dotenvx precommit. Use dotenvx protect.
• Deprecate dotenvx prebuild. Use dotenvx protect --docker.

Changed

• Only owner can write to and read from .env.keys file (#979)

Changed

• Send pk via stdin to keychain. was argv. thank you @kta1kri for the security report. (#978)
• Move some commands under a hidden menu (#973)

Added

• Choose where you custody your keys (#972)

Your private key
├── ⛉ Local Custody
│   ├── OS (macOS Keychain / Windows Credential Manager / Linux Secret Service)
│   ├── 1Password
│   ├── Bitwarden
│   └── File (.env.keys)
└── ⛊ Managed Custody
    └── ⛨ Armor

Removed

• BREAKING: Removed run --validate flag and validate command against .env.example file. To be replaced soon with a modern validation scheme.

Changed

• Add dotenvx 1password up|down|push|pull and dotenvx bitwarden up|down|push|pull (#969)

Added

• Add support for storing private key to bitwarden or 1password (#968)

Changed

• Store private key to os secret store rather than .env.keys by default (#967)

Changed

• Upgraded to latest @dotenvx/primitives

Changed

• Do not expand nested commands (#965)

Removed

• BREAKING: Remove the -p shorthand for --plain; use --plain instead

Added

• Support comma-separated env file paths with -f and the config({ path }) option. Example: dotenvx run -f .env.local,.env -- node index.js
• Add DOTENV_PATH (or DOTENV_F) to support the same. Example: DOTENV_PATH=.env.local,.env

Changed

• Rename DOTENV_CONFIG_* variables to DOTENV_CONVENTION, DOTENV_IGNORE, and DOTENV_QUIET, while retaining their existing DOTENV_CONFIG_* names as fallbacks

Added

• Install verified binaries directly from GitHub Releases (#956)

Changed

• Fall back to ~/.local/bin when /usr/local/bin is not writable (#955)

Added

• Add dotenvx enc and dotenvx dec shorthands for encrypt and decrypt (#943)
• Add convenient dx alias for shorter dx run --, dx enc, etc (#944)

Changed

• Patch typescript types for path (#942)

Changed

• Handle accent marks for ext precommit (#936)

Added

• Add dotenvx del command for deleting a key from a .env file (#939)

Changed

• Exempt .env.vault from precommit/prebuild sealed checks (vault-format ciphertext is already safe to commit)

Changed

• User can click enter to open up approval url for convenience (#934)

Added

• Add dotenvx armor open to open armored key details in browser (#930)

• Patch injected message when preset encrypted: value (#927)

Added

• Make authenticated API calls to the Dotenvx Armor API with dotenvx curl. Allows you to control your Dotenvx Armor account directly from your agent inside Codex, Claude, etc. (#923)

Changed

• Send device identifier along with curl requests (#922)

Changed

• Exempt .env.example in subdirectories from precommit (#920)

Added

• Add support for DOTENV_CONFIG_IGNORE global convenience (#919)

Changed

• Handle ctrl + c better (#916)

Added

• Add support for Bitwarden bw:// secrets in your .env files. (#915)

Changed

• Fix: Do not report child error - let child do so. (#914)

Added

• Add support for -ek and -ik to dotenvx get (#913)

Changed

• Better communicate time waiting on 1password with elapsed time (#909)

Added

• Add support for 1Password op:// secrets in your .env files. (#908)

Added

• Add dotenvx run --validate for simple env validation against your .env.example (#906)
• Add dotenvx validate for a pre-check of validation against your .env.example file (#906)

Added

• Add get --eval-export flag (#904)

Changed

• Make get --eval posix safe (#904)

Changed

• Small Breaking: Single quoted 'Let\'s go' now correctly escapes to Let's go (#903)

Changed

• Improve command substitution for nested commands (#902)

Changed

• Bump @dotenvx/primtivies to support nested node invocations for pkg-ed binary (#901)

Changed

• Redact all keys by default - except those ending in _PLAIN (460862)
• Support dotenvx run -- claude and dotenvx run -- codex (#900)
• Simplify default encrypted .env file to just HELLO="World" (#899)

Added

• Add convenience method dotenvx update (#897)

Changed

• BREAKING: Send informational messages like injected env to stderr instead of stdout. This makes it more reliable to do things like piping output to a file without needing --quiet. (#898)

Added

• Add run --redact to keep secrets out of command output. (#894)

Changed

• BREAKING: ls from @dotenvx/dotenvx is now async/await. (#893)

Added

• Add FILE_NOT_WRITABLE error for user convenience (#891)
• Support Enclaved Armored Keys (#892)

Changed

• Fix: --quiet should not display the spinner and its stderr messages (#889)

Added

• Include dotenvx armor status command.

Changed

• Security Improvement: dotenvx armor login attempts to set the DOTENVX_ARMOR_TOKEN in your native OS secret store going forward. For current Armor users run dotenvx armor logout and then dotenvx armor login to make use of this immediately. (#886)

Added

• Added support for --mask on get, run, decrypt (#885)

Added

• Support native up|down|pull|push for windows (#884)

Added

• Support native up|down|pull|push for windows (#883)

Added

• Support config(path:) as a directory like app/web. Useful for monorepos (#882)

Added

• Support multiple -fk flags for select commands (#880)
• Support -f ../.. directories (#881)

Removed

• Replace various deps with @dotenvx/tooling (#879)

Removed

• Remove dotenv and commander for @dotenvx/tooling (#878)

Changed

• Permit empty value for set (#877)

Changed

• Fix correct default valuation interpolation for empty strings by upgrading primitives package

Added

• Add lock up and lock down commands for password protecting private keys (#875)

Changed

• BREAKING: Rename keychain commands to native to make way for windows and linux. (#875)

Removed

• BREAKING: Remove --no-ops. Use --no-armor. (#875)