chore(deps): update dependency @dotenvx/dotenvx to v1.54.1#4966
chore(deps): update dependency @dotenvx/dotenvx to v1.54.1#4966renovate[bot] wants to merge 1 commit intomainfrom
Conversation
1b84670 to
65b8871
Compare
65b8871 to
b36748a
Compare
b36748a to
327e5c1
Compare
327e5c1 to
7961c7d
Compare
7961c7d to
4f5d484
Compare
4f5d484 to
e85b5a6
Compare
d9056dc to
710bd50
Compare
710bd50 to
a4cb9aa
Compare
3d7e3da to
7ce273b
Compare
7ce273b to
c5d6741
Compare
d41d9a4 to
0a36bda
Compare
0a36bda to
2413c50
Compare
2413c50 to
c707ffb
Compare
c6d2cbf to
9677b34
Compare
pnpm-lock.yaml
Outdated
| @@ -21,7 +21,7 @@ importers: | |||
| version: 2.29.6(@types/node@24.2.1) | |||
| '@dotenvx/dotenvx': | |||
| specifier: ^1.34.0 | |||
| version: 1.44.2 | |||
| version: 1.51.0 | |||
There was a problem hiding this comment.
[P3] Transitive upgrades: this bump to @dotenvx/dotenvx also updates dotenv to 17.2.3 and fdir/picomatch. Node engine constraints remain compatible (>=12). Given dotenv minor version jump, consider a quick smoke run of any scripts using dotenvx run to confirm no edge-case parsing differences (e.g., single-quoted expansion) affect our usage. No blocking issues from my side.
pnpm-lock.yaml
Outdated
| @@ -1624,15 +1624,15 @@ packages: | |||
| resolution: {integrity: sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==} | |||
| engines: {node: '>=18'} | |||
|
|
|||
| '@dotenvx/dotenvx@1.44.2': | |||
| resolution: {integrity: sha512-2C44+G2dch4cB6zw7+oGQ9VcFQuuVhc5xOzfVvY7iUEj2PRhiVMIB6SpNMK1V5TvpdqrAqCYFjclK18Mh9vwNQ==} | |||
| '@dotenvx/dotenvx@1.51.0': | |||
There was a problem hiding this comment.
[P2] Transitive behavior change: @dotenvx/dotenvx includes a fix for variable expansion of single‑quoted values (v1.49.1) and now pulls dotenv 17.2.3. If any .env entries rely on single‑quoted interpolation semantics, values may change. Recommend a quick smoke test of .env parsing in CI/dev (especially single‑quoted variables with ${...}).
| @@ -8084,6 +8085,10 @@ packages: | |||
| resolution: {integrity: sha512-M7BAV6Rlcy5u+m6oPhAPFgJTzAioX/6B0DxyvDlo9l8+T3nLKbrczg2WLUyzd45L8RqfUMyGPzekbMvX2Ldkwg==} | |||
There was a problem hiding this comment.
[P3] Duplicate versions: both picomatch 4.0.2 and 4.0.3 are present after this bump (introduced via fdir@6.5.0). If feasible, consider running pnpm dedupe --lockfile-only in a follow-up to reduce duplication. Not blocking.
| @@ -11136,21 +11141,21 @@ snapshots: | |||
|
|
|||
There was a problem hiding this comment.
[P3] Optional Ops features: dotenvx 1.50+ adds Ops and a new opsOff flag. To avoid any network calls/telemetry during CI or local scripts, consider disabling Ops explicitly (e.g., DOTENVX_OPS_OFF=1 or pass --ops-off when invoking dotenvx). Non-blocking.
| @@ -5970,6 +5970,15 @@ packages: | |||
| picomatch: | |||
| optional: true | |||
|
|
|||
| fdir@6.5.0: | |||
| resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==} | |||
There was a problem hiding this comment.
[P3] Multiple fdir versions: lockfile now contains fdir 6.5.0 alongside 6.4.x (e.g., under tinyglobby). Consider a follow-up pnpm dedupe --lockfile-only to converge on a single fdir where possible; smaller tree and fewer transitive mismatches. Not blocking.
pnpm-lock.yaml
Outdated
| @@ -5419,8 +5419,8 @@ packages: | |||
| resolution: {integrity: sha512-7GO6HghkA5fYG9TYnNxi14/7K9f5occMlp3zXAuSxn7CKCxt9xbNWG7yF8hTCSUchlfWSe3uLmlPfigevRItzQ==} | |||
| engines: {node: '>=12'} | |||
|
|
|||
| dotenv@16.5.0: | |||
| resolution: {integrity: sha512-m/C+AwOAr9/W1UOIZUo232ejMNnJAJtYQjUbHoNTBNTJSvqzzDh7vnrei3o3r3m9blf6ZoDkvcw0VmozNRFJxg==} | |||
| dotenv@17.2.3: | |||
There was a problem hiding this comment.
[P3] Duplicate dotenv versions: lockfile contains both dotenv 16.0.3 and 17.2.3. If feasible, try converging dependents to a single version via a follow-up pnpm dedupe --lockfile-only or targeted bumps to avoid inconsistent parsing behavior across tools. Non-blocking.
pnpm-lock.yaml
Outdated
| picomatch: 4.0.2 | ||
|
|
||
| tinyglobby@0.2.14: | ||
| dependencies: | ||
| fdir: 6.4.6(picomatch@4.0.2) | ||
| fdir: 6.5.0(picomatch@4.0.2) |
There was a problem hiding this comment.
[P3] Two tinyglobby versions (0.2.13 and 0.2.14) are present after this bump. If feasible, align dependents to a single minor to minimize duplicates (e.g., run pnpm dedupe --lockfile-only in a follow-up or adjust constraints) to keep the tree smaller. Non-blocking.
| engines: {node: '>=10'} | ||
| hasBin: true | ||
|
|
||
| semver@7.7.3: |
There was a problem hiding this comment.
[P3] Duplicate semver versions: both semver 7.7.2 and 7.7.3 appear in the lockfile after this bump. Consider a follow-up pnpm dedupe --lockfile-only (or align dependents) to converge on a single semver version and reduce duplication. Non-blocking.
|
|
||
| '@noble/curves@1.9.2': | ||
| resolution: {integrity: sha512-HxngEd2XUcg9xi20JkwlLCtYwfoFw4JGkuZpT+WlsPD4gB/cxkvTD8fSsoAnphGZhFdZYKeQIPCuFlWPm1uE0g==} | ||
| '@noble/curves@1.9.7': |
There was a problem hiding this comment.
[P3] Transitive crypto update: '@noble/curves' bumped to 1.9.7 via eciesjs/dotenvx. While low-risk, crypto stacks can have subtle compat differences. If any env-vault/ECIES flows are exercised (even indirectly), consider a quick encrypt/decrypt smoke test. Non-blocking.
pnpm-lock.yaml
Outdated
|
|
||
| '@ecies/ciphers@0.2.3': | ||
| resolution: {integrity: sha512-tapn6XhOueMwht3E2UzY0ZZjYokdaw9XtL9kEyjhQ/Fb9vL9xTFbOaI+fV0AWvTpYu4BNloC6getKW6NtSg4mA==} | ||
| '@ecies/ciphers@0.2.4': |
There was a problem hiding this comment.
[P3] '@ecies/ciphers' moved to 0.2.4. Recent releases also removed an eval usage in related helpers (hardening). No action required—just flagging the stack change alongside noble/curves. Non-blocking.
Review SummaryThis dependency update has been reviewed. All previously identified issues remain valid. No new issues were found in the latest commit. Issues Identified
RecommendationAll flagged issues are informational (P3) or low-priority (P2). The P2 item suggests smoke testing single-quoted env variable expansion. The P3 items are optimization suggestions for follow-up work (deduplication, telemetry configuration). This is a standard lockfile-only dependency update with no blocking issues. Mention @roomote in a comment to request specific changes to this pull request or fix all unresolved issues. |
This PR contains the following updates:
1.44.2→1.54.1Release Notes
dotenvx/dotenvx (@dotenvx/dotenvx)
v1.54.1Compare Source
Changed
v1.53.0Compare Source
Removed
radar. It has been a year since replaced byops. (#743)v1.52.0Compare Source
Added
main.set(#731)v1.51.4Compare Source
Changed
dotenvx-opsto better reflect its tooling as operational primitives on top of dotenvx for production use cases. (#721)v1.51.3Compare Source
Added
.env.keysfordotenvx ops backup. Dotenvx Ops Backup lets you back up your private keys securely with just a single command. It's a convenient alterantive to manually copy/pasting them in and out of 1Password. (#718)v1.51.2Compare Source
Changed
npm publishto use Dotenvx Ops' new Rotation Tokens (ROTs) (#715)v1.51.1Compare Source
Added
opsOfftype informationv1.51.0Compare Source
Added
config({opsOff: true})options and--ops-offflag for turning off Dotenvx Ops features. (#680)v1.50.1Compare Source
Removed
radar(nowops) (#678)v1.50.0Compare Source
Added
dotenvx opscommand (#677)dotenvx opsuse dotenvx across your team, infrastructure, agents, and more.v1.49.1Compare Source
Changed
v1.49.0Compare Source
Added
.env.xfile like we do with.env.vaultfile. (#666)v1.48.4Compare Source
Removed
evalin proKeypair helper (#654)v1.48.3Compare Source
Changed
privateKeyNameandprivateKeyon internalprocessedEnvobject (#649)v1.48.2Compare Source
Changed
v1.48.1Compare Source
Changed
beforEnvandafterEnvto Radar if user has installed (#645)v1.48.0Compare Source
Added
beforeEnvandafterEnvfor user debugging (#644)v1.47.7Compare Source
Changed
srcshould be in internalprocessEnvobject (#643)v1.47.6Compare Source
Changed
v1.47.5Compare Source
Changed
v1.47.4Compare Source
Changed
dotenvx-radar(#638)v1.47.3Compare Source
Added
radar#observeif Radar installed by user (#631)Removed
cliin package.json (#632)v1.47.2Compare Source
Added
cliin package.json (#629)v1.47.1Compare Source
Added
radar active 📡when dotenvx-radar is installed (#625)v1.47.0Compare Source
Added
dotenvx radarcommand (#624)v1.46.0Compare Source
Added
Removed
git-dotenvxandgit dotenvxshorthand (#621)v1.45.2Compare Source
Changed
v1.45.1Compare Source
Changed
setLogNameandsetLogVersioninconfig(#613)v1.45.0Compare Source
Added
logger.setNameandlogger.setVersionfor customization of logger (#612)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.