You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Default quiet to true – hiding the runtime log message (#874)
NOTICE: 17.0.0 will be released with quiet defaulting to false. Use config({ quiet: true }) to suppress.
And check out the new dotenvx. As coding workflows evolve and agents increasingly handle secrets, encrypted .env files offer a much safer way to deploy both agents and code together with secure secrets. Simply switch require('dotenv').config() for require('@​dotenvx/dotenvx').config().
The dotenvx README is viewed thousands of times DAILY on GitHub and NPM.
Sponsoring dotenv is a great way to get in front of developers and give back to the developer community at the same time.
🐞 Fix recent regression when using path option. return to historical behavior: do not attempt to auto find .env if path set. (regression was introduced in 16.4.3) #814
🐞 Fix recent regression when using path option. return to historical behavior: do not attempt to auto find .env if path set. (regression was introduced in 16.4.3) #814
Removed browser keys for path, os, and crypto in package.json. These were set to false incorrectly as of 16.1. Instead, if using dotenv on the front-end make sure to include polyfills for path, os, and crypto. node-polyfill-webpack-plugin provides these.
ℹ️ .env.vault extends the .env file format standard with a localized encrypted vault file. Package it securely with your production code deploys. It's cloud agnostic so that you can deploy your secrets anywhere – without risky third-party integrations. read more
Changed
Fixed "cannot resolve 'fs'" error on tools like Replit #693
renovatebot
changed the title
fix(deps): update dependency dotenv to v16.6.1
chore(deps): update dependency dotenv to v16.6.1
Sep 25, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
16.0.2→16.6.1Release Notes
motdotla/dotenv (dotenv)
v16.6.1Compare Source
Changed
quietto true – hiding the runtime log message (#874)config({ quiet: true })to suppress.require('dotenv').config()forrequire('@​dotenvx/dotenvx').config().v16.6.0Compare Source
Added
[dotenv@16.6.0] injecting env (1) from .env(#870){ quiet: true }to suppressv16.5.0Compare Source
Added
Changed
_logmethod. Use_debug#862v16.4.7Compare Source
Changed
.tapfolder when publishing. (oops, sorry about that everyone. - @motdotla) #848v16.4.6Compare Source
Changed
v16.4.5Compare Source
Changed
pathoption. return to historical behavior: do not attempt to auto find.envifpathset. (regression was introduced in16.4.3) #814v16.4.4Compare Source
Changed
?.with old school&&(fixing node 12 failures) #812v16.4.3Compare Source
Changed
pathoption. return to historical behavior: do not attempt to auto find.envifpathset. (regression was introduced in16.4.3) #814v16.4.2Compare Source
Changed
dotenvx.comv16.4.1Compare Source
pathoption #797v16.4.0Compare Source
error.codeto error messages around.env.vaultdecryption handling #795.env.vaultfile when filename(s) passed as an array #784v16.3.2Compare Source
Added
Changed
populate#792v16.3.1Compare Source
Added
processEnvandDOTENV_KEYoptions. #756v16.3.0Compare Source
Added
DOTENV_KEYto options rather than relying onprocess.env.DOTENV_KEY. Defaults toprocess.env.DOTENV_KEY#754v16.2.0Compare Source
Added
process.env. Defaults toprocess.env. #753v16.1.4Compare Source
Added
.github/to.npmignore#747v16.1.3Compare Source
Removed
browserkeys forpath,os, andcryptoin package.json. These were set to false incorrectly as of 16.1. Instead, if using dotenv on the front-end make sure to include polyfills forpath,os, andcrypto. node-polyfill-webpack-plugin provides these.v16.1.2Compare Source
Changed
_configDotenvasconfigDotenv. #744v16.1.1Compare Source
Added
decryptfunctionChanged
{crypto: false}inpackageJson.browserv16.1.0Compare Source
Added
populateconvenience method #733npm fundcommand.env.vaultsupport. 🎉 (#730)ℹ️
.env.vaultextends the.envfile format standard with a localized encrypted vault file. Package it securely with your production code deploys. It's cloud agnostic so that you can deploy your secrets anywhere – without risky third-party integrations. read moreChanged
v16.0.3Compare Source
Changed
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.