Update dotenv 16.6.1 → 17.2.1 (major)

[depfu]

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ dotenv (16.6.1 → 17.2.1) · Repo · Changelog

Release Notes

17.2.1 (from changelog)

Changed

• Fix clickable tip links by removing parentheses (#897)

17.2.0 (from changelog)

Added

• Optionally specify DOTENV_CONFIG_QUIET=true in your environment or .env file to quiet the runtime log (#889)
• Just like dotenv any DOTENV_CONFIG_ environment variables take precedence over any code set options like ({quiet: false})

# .env
DOTENV_CONFIG_QUIET=true
HELLO="World"

// index.js
require('dotenv').config()
console.log(`Hello ${process.env.HELLO}`)

17.1.0 (from changelog)

Added

• Add additional security and configuration tips to the runtime log (#884)
• Dim the tips text from the main injection information text

const TIPS = [
  '🔐 encrypt with dotenvx: https://dotenvx.com',
  '🔐 prevent committing .env to code: https://dotenvx.com/precommit',
  '🔐 prevent building .env in docker: https://dotenvx.com/prebuild',
  '🛠️  run anywhere with `dotenvx run -- yourcommand`',
  '⚙️  specify custom .env file path with { path: \'/custom/path/.env\' }',
  '⚙️  enable debug logging with { debug: true }',
  '⚙️  override existing env vars with { override: true }',
  '⚙️  suppress all logs with { quiet: true }',
  '⚙️  write to custom object with { processEnv: myObject }',
  '⚙️  load multiple .env files with { path: [\'.env.local\', \'.env\'] }'
]

17.0.1 (from changelog)

Changed

• Patched injected log to count only populated/set keys to process.env (#879)

17.0.0 (from changelog)

Changed

• Default quiet to false - informational (file and keys count) runtime log message shows by default (#875)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 41 commits:

• 17.2.1
• changelog 🪵
• Merge pull request #897 from motdotla/adjust-tip-for-click
• add to tests
• adjust clickable tip
• Merge pull request #894 from mjomble/patch-1
• Merge pull request #895 from andersr/add-es6-config-info-to-readme
• Add info about ES6 import with config options
• Fixed link in changelog
• 17.2.0
• Merge pull request #889 from motdotla/env-quiet
• clean up
• changelog 🪵
• smarter DOTENV_CONFIG_QUIET option that can read from source .env file
• support passing DOTENV_CONFIG_QUIET=true (and other DOTENV_CONFIG options - see env-options.js) to modify config options, rather than via code
• 17.1.0
• add to test coverage
• changelog 🪵
• adjust test
• standard formatting 🧼
• adjust tips
• add tips around prebuild and precommit
• dim tips
• Merge pull request #884 from motdotla/copilot/fix-883
• Remove _getRandomTip from public exports
• Implement random tips functionality with array of 7 tips
• readme updates
• Initial plan
• Update preload instructions
• 17.0.1
• changelog 🪵
• Merge pull request #879 from motdotla/smarter-keys-logged
• correctly track which keys were written to process.env
• remove sponsors
• 17.0.0
• changelog 🪵
• Merge pull request #875 from motdotla/quiet-true
• mention dotenvx in runtime message to point people to safer .env files
• update README with `quiet` option
• `quiet` defaults to false - use `quiet: true` to suppress info log
• changelog 🪵

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[canova]

Oof, this is interesting. With this major update, it looks like the dotenv package is now printing an ad at the startup of the app:

[dotenv@17.2.1] injecting env (3) from .env -- tip: 📡 observe env with Radar: https://dotenvx.com/radar

It looks unprofessional, but besides that, it uses console.log to print the message. I'm assuming that this will break our mozlog parser if we deploy it.

At least it looks like there is a way to disable it by passing .config({quiet: true}). So I will do this in this PR to prevent the ads. But I think it would be good to remove this package later.

I see that node has util.parseEnv now, but it's still in active development. It would be good to switch to it once it's stable. I'll file an issue for it.

[canova]

r+ with the newly added { quiet: true } config param.