unstale

npm / @dotenvx/dotenvx

@dotenvx/dotenvx

What changed in @dotenvx/dotenvx 1 to 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

43 breaking12 security3 deprecations43 new APIs and options3 performance29 behavior and defaults38 tooling30 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

@dotenvx/dotenvx 2139 changes

Breaking changes 33

  • File key storage is now the default in non-interactive mode.

    2.38.0release notes

  • Lock commands and support for unlocking were removed because passwords are too difficult to manage securely.

    2.34.0release notes

  • Automatically redacts stdout and stderr from config() when an Envfile is present.

    2.33.0release notes

  • Applies Envfile encryption rules to set.

    2.33.0release notes

  • The first file wins when combining Envfile rules.

    2.33.0release notes

  • Dotenvspec is now the filename.

    2.32.3release notes

  • The picker now presents three initial custody options: Local, Dotenvx Armor, and Password Managers.

    2.32.1release notes

  • Replaces the removed dotenvx init command.

    2.32.0release notes

  • The Envfile file was renamed to Envspec.

    2.32.0release notes

  • Replaces dotenvx validate and now works from Envfile only; support for .env.example is dropped.

    2.31.0release notes

  • Removes the command; use dotenvx init instead.

    2.31.0release notes

  • The command is renamed to dotenvx check; switch to using an Envfile.

    2.31.0release notes

  • Only the owner can read from or write to the .env.keys file.

    2.28.2release notes

  • The run --validate flag was removed; it is to be replaced with a modern validation scheme.

    2.27.0release notes

  • The validate command against .env.example was removed; it is to be replaced with a modern validation scheme.

    2.27.0release notes

  • Private keys are stored in the OS secret store by default rather than in .env.keys.

    2.25.0release notes

  • Nested commands are no longer expanded.

    2.24.0release notes

  • The -p shorthand for --plain was removed; use --plain instead.

    2.24.0release notes

  • Keys are redacted by default, except keys ending in _PLAIN.

    2.11.1release notes

  • Informational messages such as injected env are sent to stderr instead of stdout, making it more reliable to pipe output to a file without --quiet.

    2.11.0release notes

  • ls from @dotenvx/dotenvx is now async/await, so callers must handle it asynchronously.

    2.9.0release notes

  • Renames the keychain commands to native to make way for Windows and Linux.

    2.3.0release notes

  • Removes --no-ops; use --no-armor instead.

    2.3.0release notes

  • The login command is now under armor.

    2.2.2release notes

  • The logout command is now under armor.

    2.2.2release notes

  • genexample is now a top-level command.

    2.2.1release notes

  • get returns exit code 1 when decryption errors are reported.

    2.1.0release notes

  • The library doctor export is removed from lib/main.

    2.0.0release notes

  • The library genexample export is removed from lib/main.

    2.0.0release notes

  • The library get operation is async only, so callers must use it asynchronously.

    2.0.0release notes

  • The library keypair export is removed from lib/main.

    2.0.0release notes

  • The rotate command is removed; the notes say it will return in a future release with a more complete implementation for local and armored keys.

    2.0.0release notes

  • The library set operation is async only, so callers must use it asynchronously.

    2.0.0release notes

Security 8

  • Secrets references are supported as safe from dotenvx protect.

    2.30.0release notes

  • Adds a command to prevent plaintext .env files from being committed to code on a machine.

    2.29.0release notes

  • The private key is sent to keychain via stdin instead of argv, addressing a security report.

    2.28.1release notes

  • Install verified binaries directly from GitHub Releases.

    2.22.0release notes

  • Adds --redact to keep secrets out of command output.

    2.10.0release notes

  • Adds a command for password protecting private keys.

    2.3.0release notes

  • Adds a command for password protecting private keys.

    2.3.0release notes

  • Supports restricted read permissions for .env.keys.

    2.1.2release notes

Deprecations 3

  • The command is deprecated; use dotenvx protect instead.

    2.29.0release notes

  • The command is deprecated; use dotenvx protect --docker instead.

    2.29.0release notes

  • The command is deprecated; use dotenvx protect instead.

    2.29.0release notes

New APIs and options 29

  • Adds getSync as a convenience.

    2.38.0release notes

  • Adds Enclaved as an Armor key type, for software enclaved on remote providers such as Vercel and GitHub Actions.

    2.37.0release notes

  • Adds encrypt --with to bring a public key and encrypt locally for decryption only on remote software enclaves.

    2.35.0release notes

  • Selects combinations of .env files through Envfile profiles.

    2.33.0release notes

  • Selects combinations of .env files through Envfile profiles.

    2.33.0release notes

  • Envfile is now the filename developers should use.

    2.32.4release notes

  • You can choose where to custody keys: locally in the OS, 1Password, Bitwarden, or .env.keys, or with managed custody through Armor.

    2.28.0release notes

  • Private keys can now be stored in Bitwarden or 1Password.

    2.26.0release notes

  • The DOTENV_CONFIG_* variable is renamed to this variable; its existing name remains supported as a fallback.

    2.23.0release notes

  • This environment variable accepts comma-separated env file paths.

    2.23.0release notes

  • The DOTENV_CONFIG_* variable is renamed to this variable; its existing name remains supported as a fallback.

    2.23.0release notes

  • This environment variable accepts comma-separated env file paths.

    2.23.0release notes

  • The -f option accepts comma-separated env file paths.

    2.23.0release notes

  • Adds support for the DOTENV_CONFIG_IGNORE global convenience.

    2.17.2release notes

  • Supports Bitwarden secrets in .env files using the bw:// scheme.

    2.17.0release notes

  • Adds support for -ek to dotenvx get.

    2.16.0release notes

  • Adds support for -ik to dotenvx get.

    2.16.0release notes

  • You can use 1Password op:// secrets in .env files.

    2.15.0release notes

  • Adds --validate to check environment variables against .env.example.

    2.14.0release notes

  • Adds the --eval-export flag to get.

    2.13.0release notes

  • The --mask option is supported with get, run, and decrypt.

    2.7.0release notes

  • The native up, down, pull, and push commands are supported on Windows.

    2.5.0release notesrelease notes

  • config(path:) supports a directory such as app/web, which is useful for monorepos.

    2.4.1release notes

  • Select commands now support multiple -fk flags.

    2.4.0release notes

  • Use these commands to move your private keys to your macOS Keychain.

    2.2.0release notes

  • Adds support for the nextjs convention through DOTENV_CONFIG_CONVENTION.

    2.1.4release notes

  • Supports DOTENV_CONFIG_QUIET=true as a synonym for the --quiet flag.

    2.1.1release notes

  • The set command gains an interactive input mode.

    2.1.0release notes

  • Adds keyring support for local and armor providers, with the aim of enabling future providers.

    2.0.0release notes

Performance 2

Behavior and default changes 21

  • Uses atomic file writes in protect.

    2.35.0release notes

  • Applies Envfile encryption rules to encrypt.

    2.33.0release notes

  • Applies Envfile encryption rules to protect.

    2.33.0release notes

  • Validates final values when Envfile rules are combined.

    2.33.0release notes

  • Envspec rules now guide check, run, encrypt, and protect.

    2.32.0release notes

  • armor up should read from the OS secret store, 1Password, and Bitwarden.

    2.31.1release notes

  • Some commands are moved under a hidden menu.

    2.28.1release notes

  • The path option accepts comma-separated env file paths.

    2.23.0release notes

  • The DOTENV_CONFIG_* variable is renamed to this variable; its existing name remains supported as a fallback.

    2.23.0release notes

  • Installation falls back to ~/.local/bin when /usr/local/bin is not writable.

    2.22.0release notes

  • Exempts .env.vault from precommit and prebuild sealed checks because vault-format ciphertext is already safe to commit.

    2.20.0release notes

  • Pressing Enter opens the approval URL for convenience.

    2.19.1release notes

  • Curl requests now include a device identifier.

    2.17.4release notes

  • Pkg-ed binaries support nested node invocations.

    2.11.2release notes

  • The default encrypted .env file is simplified to contain just HELLO="World".

    2.11.1release notes

  • The -f flag now supports directories.

    2.4.0release notes

  • The set command now permits an empty value.

    2.3.2release notes

  • prebuild now respects _PLAIN.

    2.1.5release notes

  • precommit now respects _PLAIN.

    2.1.5release notes

  • Keys with the _PLAIN suffix can be left unencrypted when using set or encrypt.

    2.1.0release notes

  • Library parse now uses primitive parsing while preserving dotenvx-style errors for encrypted values.

    2.0.0release notes

Tooling 27

  • Adds the dotenvx armor invite command.

    2.36.0release notes

  • The command now returns provider information.

    2.34.0release notes

  • Validates final values when Envfile rules are combined.

    2.33.0release notes

  • Adds a command for giving feedback on the CLI.

    2.31.0release notes

  • Adds a command for generating your Envfile.

    2.31.0release notes

  • CLI audit logging is added for Armor customers.

    2.30.0release notes

  • Adds the down command for 1Password integration.

    2.26.1release notes

  • Adds the pull command for 1Password integration.

    2.26.1release notes

  • Adds the push command for 1Password integration.

    2.26.1release notes

  • Adds the up command for 1Password integration.

    2.26.1release notes

  • Adds the down command for Bitwarden integration.

    2.26.1release notes

  • Adds the pull command for Bitwarden integration.

    2.26.1release notes

  • Adds the push command for Bitwarden integration.

    2.26.1release notes

  • Adds the up command for Bitwarden integration.

    2.26.1release notes

  • Adds dec as a shorthand for decrypt.

    2.21.0release notes

  • Adds enc as a shorthand for encrypt.

    2.21.0release notes

  • Adds a convenient alias for shorter commands such as dx run -- and dx enc.

    2.21.0release notes

  • Patches the TypeScript types for path.

    2.21.0release notes

  • Adds a command for deleting a key from a .env file.

    2.20.0release notes

  • Adds a command to open armored key details in a browser.

    2.19.0release notes

  • Adds a command for making authenticated API calls to the Dotenvx Armor API, allowing you to control your account from an agent.

    2.18.0release notes

  • .env.example files in subdirectories are exempt from precommit.

    2.17.3release notes

  • Adds a command to pre-check validation against the .env.example file.

    2.14.0release notes

  • Supports running claude and codex with dotenvx run --.

    2.11.1release notes

  • Adds a convenience method for updating dotenvx.

    2.11.0release notes

  • Adds the dotenvx armor status command.

    2.7.2release notes

  • The login command attempts to store DOTENVX_ARMOR_TOKEN in the native OS secret store. Current Armor users can run dotenvx armor logout and then dotenvx armor login to use this immediately.

    2.7.1release notes

Fixes and other changes 16

  • Fixes an atomic edge case when writing .env and .env.keys files.

    2.34.2release notes

  • The CLI no longer writes the public key when the user presses Ctrl+C or a prompt fails.

    2.34.1release notes

  • Restores ESM named imports such as import { config } from '@dotenvx/dotenvx', which were broken in 2.30.0.

    2.31.0release notes

  • Handles accent marks when using ext precommit.

    2.20.1release notes

  • Patched the injected message when the preset value is encrypted.

    2.18.1release notes

  • Handles ctrl + c better.

    2.17.1release notes

  • Dotenvx no longer reports child errors; the child reports them instead.

    2.16.1release notes

  • Time spent waiting on 1Password is now communicated with elapsed time, making the wait clearer to users.

    2.15.1release notes

  • Makes get --eval POSIX safe.

    2.13.0release notes

  • Escaped apostrophes in single-quoted values now correctly resolve to apostrophes.

    2.12.0release notes

  • Improves command substitution for nested commands.

    2.11.3release notes

  • Adds support for Enclaved Armored Keys.

    2.8.0release notes

  • Adds a FILE_NOT_WRITABLE error for user convenience.

    2.8.0release notes

  • With --quiet, the spinner and its stderr messages are no longer displayed.

    2.7.3release notes

  • Corrects default valuation interpolation for empty strings.

    2.3.1release notes

  • Patches an edge case involving a custom unspecified -f and the --env flag.

    2.1.3release notes

@dotenvx/dotenvx 162 changes

Breaking changes 10

  • The update available notification is shown only for armor commands.

    1.73.1release notes

  • stderr changed to inherit for dotenvx-armor integration.

    1.71.1release notes

  • The fully deprecated opsOff option was removed in favor of noOps.

    1.69.0release notes

  • SIGINT handling now respects handler completion.

    1.61.4release notes

  • Ops users now see stderr surfaced.

    1.61.2release notes

  • Error logs are improved and most are compacted to a single line.

    1.57.1release notes

  • CLI output colors and formatting changed.

    1.57.0release notes

  • Support for .env.vault files is removed.

    1.56.0release notes

  • The ops observe command was removed; download dotenvx-ops if needed.

    1.54.0release notes

  • The radar command was removed; it had been replaced by ops.

    1.53.0release notes

Security 4

  • Adds a command to armor a private key, helping move private keys off device and under access control with Dotenvx Ops.

    1.64.0release notes

  • Guards against command substitution following encrypted: values.

    1.61.6release notes

  • Adds a security feature for hardening private keys when dotenvx-ops is installed.

    1.55.0release notes

  • Adds a hint about .env.keys, noting that Dotenvx Armor can securely armor private keys as an alternative to manually copying them in and out of 1Password.

    1.51.3release notes

New APIs and options 14

  • An override package is additionally published for use with @dotenvx/next-env.

    1.74.0release notes

  • Optional --token support is added for automation by Armor users.

    1.71.0release notes

  • Passes -f to ops, allowing the option to be used with the ops command.

    1.68.1release notes

  • The parse API now supports the ignore option.

    1.68.0release notes

  • A simpler --no-spinner flag is passed to ops to improve spinner message blinking.

    1.65.3release notes

  • Duplicate keys can now be replaced with different values.

    1.65.0release notes

  • Adds a command to dearmor a private key.

    1.64.0release notes

  • The --env flag supports encrypted values.

    1.63.0release notes

  • Adds support for colon format to match Cloudflare Wrangler's --var flag format.

    1.63.0release notes

  • Adds support for passing env sources to config({ envs }), enabling simpler Cloudflare Worker integration.

    1.62.0release notes

  • Supports the --hostname flag for dotenvx-ops.login.

    1.61.5release notes

  • Pass this option to prevent file creation.

    1.59.0release notes

  • Adds --pp as shorthand for --pretty-print, toward sunsetting -pp.

    1.56.0release notes

  • main.set now accepts log level options, allowing developers to configure its logging level.

    1.52.0release notes

Performance 1

Behavior and default changes 8

  • The ext commands become first-class.

    1.75.0release notes

  • Minor messaging improvements, especially when using armored keys.

    1.69.2release notes

  • Improves coordination of spinner messages between dotenvx and dotenvx-ops.

    1.65.2release notes

  • Prompts from ops should bubble up.

    1.65.1release notes

  • Now creates a .env file if one does not exist.

    1.59.0release notes

  • Now creates a .env file if one does not exist.

    1.59.0release notes

  • The runtime injection message now uses the format ⟐ injecting env (N) from FILE · dotenvx@VERSION.

    1.58.0release notes

  • Respect the dotenvx-ops status setting when it is on or off.

    1.55.1release notes

Tooling 11

  • Armor commands are available directly inside dotenvx and remain optional under the professional security section.

    1.73.0release notes

  • The login command is now a first-class dotenvx command; login remains optional and is only needed for Armor features.

    1.72.0release notes

  • Commands are forwarded to Dotenvx Armor Key Guard approvals.

    1.71.3release notes

  • A prompt lets developers choose between local storage and armored storage.

    1.67.0release notes

  • Adds the dotenvx doctor command.

    1.66.0release notes

  • Adds a command to pull an armored key into .env.keys.

    1.64.0release notes

  • Adds a command to push an armored key from .env.keys.

    1.64.0release notes

  • Adds a login command that proxies to dotenvx-ops login.

    1.61.0release notes

  • Adds a logout command that proxies to dotenvx-ops logout.

    1.61.0release notes

  • Adds loading messages while run injects, encrypt and set encrypt, decrypt and get decrypt, rotate rotates, and keypair retrieves.

    1.60.0release notes

  • Type information was added for opsOff.

    1.51.1release notes

Fixes and other changes 14

  • The release is published as named binaries, changing how developers obtain the executable.

    1.75.1release notes

  • dotenvx now bundles @dotenvx/next-env for user convenience.

    1.74.3release notes

  • Fixed provenance for @dotenvx/next-env.

    1.74.2release notes

  • Touched up dotenvx decrypt when armor is installed.

    1.71.2release notes

  • Touched up dotenvx get when armor is installed.

    1.71.2release notes

  • Touched up dotenvx set when armor is installed.

    1.71.2release notes

  • Dotenvx Ops/Vlt is now named Dotenvx Armor.

    1.70.0release notes

  • The precommit and prebuild shorthands were patched.

    1.61.1release notes

  • Communicates whether Ops stored keys are local keys or armored keys.

    1.60.2release notes

  • Adds the missing + key ⛨ marker for Ops stored keys.

    1.60.1release notes

  • The message shown when already installed was improved.

    1.57.5release notes

  • The success message shown after installation was simplified.

    1.57.3release notes

  • Leading glyphs provide a visual status language for successful actions, no-ops, warnings, and errors.

    1.57.1release notes

  • The ops off flag is now respected by get, keypair, rotate, and encrypt.

    1.56.0release notes