# What changed in @dotenvx/dotenvx

> 201 changes in @dotenvx/dotenvx 1 to 2 from its official release notes, upgrade guides and advisories: 43 breaking, 3 deprecations, 12 security, 43 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@dotenvx/dotenvx/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @dotenvx/dotenvx 2

### Breaking changes

- File key storage is now the default in non-interactive mode. (2.38.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.38.0)
- Lock commands and support for unlocking were removed because passwords are too difficult to manage securely. (2.34.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.34.0)
- Automatically redacts stdout and stderr from config() when an Envfile is present. (2.33.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.33.0)
- Applies Envfile encryption rules to set. (2.33.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.33.0)
- The first file wins when combining Envfile rules. (2.33.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.33.0)
- Dotenvspec is now the filename. (2.32.3) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.32.3)
- The picker now presents three initial custody options: Local, Dotenvx Armor, and Password Managers. (2.32.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.32.1)
- Replaces the removed `dotenvx init` command. (2.32.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.32.0)
- The Envfile file was renamed to Envspec. (2.32.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.32.0)
- Replaces `dotenvx validate` and now works from Envfile only; support for .env.example is dropped. (2.31.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.31.0)
- Removes the command; use `dotenvx init` instead. (2.31.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.31.0)
- The command is renamed to `dotenvx check`; switch to using an Envfile. (2.31.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.31.0)
- Only the owner can read from or write to the .env.keys file. (2.28.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.28.2)
- The `run --validate` flag was removed; it is to be replaced with a modern validation scheme. (2.27.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.27.0)
- The `validate` command against `.env.example` was removed; it is to be replaced with a modern validation scheme. (2.27.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.27.0)
- Private keys are stored in the OS secret store by default rather than in .env.keys. (2.25.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.25.0)
- Nested commands are no longer expanded. (2.24.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.24.0)
- The -p shorthand for --plain was removed; use --plain instead. (2.24.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.24.0)
- Keys are redacted by default, except keys ending in _PLAIN. (2.11.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.11.1)
- Informational messages such as `injected env` are sent to stderr instead of stdout, making it more reliable to pipe output to a file without `--quiet`. (2.11.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.11.0)
- ls from @dotenvx/dotenvx is now async/await, so callers must handle it asynchronously. (2.9.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.9.0)
- Renames the `keychain` commands to `native` to make way for Windows and Linux. (2.3.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.3.0)
- Removes `--no-ops`; use `--no-armor` instead. (2.3.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.3.0)
- The login command is now under armor. (2.2.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.2.2)
- The logout command is now under armor. (2.2.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.2.2)
- genexample is now a top-level command. (2.2.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.2.1)
- get returns exit code 1 when decryption errors are reported. (2.1.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.1.0)
- The library doctor export is removed from lib/main. (2.0.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.0.0)
- The library genexample export is removed from lib/main. (2.0.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.0.0)
- The library get operation is async only, so callers must use it asynchronously. (2.0.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.0.0)
- The library keypair export is removed from lib/main. (2.0.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.0.0)
- The rotate command is removed; the notes say it will return in a future release with a more complete implementation for local and armored keys. (2.0.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.0.0)
- The library set operation is async only, so callers must use it asynchronously. (2.0.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.0.0)

### Security

- Secrets references are supported as safe from dotenvx protect. (2.30.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.30.0)
- Adds a command to prevent plaintext .env files from being committed to code on a machine. (2.29.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.29.0)
- The private key is sent to keychain via stdin instead of argv, addressing a security report. (2.28.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.28.1)
- Install verified binaries directly from GitHub Releases. (2.22.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.22.0)
- Adds `--redact` to keep secrets out of command output. (2.10.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.10.0)
- Adds a command for password protecting private keys. (2.3.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.3.0)
- Adds a command for password protecting private keys. (2.3.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.3.0)
- Supports restricted read permissions for .env.keys. (2.1.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.1.2)

### Deprecations

- The command is deprecated; use dotenvx protect instead. (2.29.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.29.0)
- The command is deprecated; use dotenvx protect --docker instead. (2.29.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.29.0)
- The command is deprecated; use dotenvx protect instead. (2.29.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.29.0)

### New APIs and options

- Adds getSync as a convenience. (2.38.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.38.0)
- Adds Enclaved as an Armor key type, for software enclaved on remote providers such as Vercel and GitHub Actions. (2.37.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.37.0)
- Adds `encrypt --with` to bring a public key and encrypt locally for decryption only on remote software enclaves. (2.35.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.35.0)
- Selects combinations of .env files through Envfile profiles. (2.33.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.33.0)
- Selects combinations of .env files through Envfile profiles. (2.33.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.33.0)
- Envfile is now the filename developers should use. (2.32.4) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.32.4)
- You can choose where to custody keys: locally in the OS, 1Password, Bitwarden, or .env.keys, or with managed custody through Armor. (2.28.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.28.0)
- Private keys can now be stored in Bitwarden or 1Password. (2.26.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.26.0)
- The DOTENV_CONFIG_* variable is renamed to this variable; its existing name remains supported as a fallback. (2.23.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.23.0)
- This environment variable accepts comma-separated env file paths. (2.23.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.23.0)
- The DOTENV_CONFIG_* variable is renamed to this variable; its existing name remains supported as a fallback. (2.23.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.23.0)
- This environment variable accepts comma-separated env file paths. (2.23.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.23.0)
- The -f option accepts comma-separated env file paths. (2.23.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.23.0)
- Adds support for the DOTENV_CONFIG_IGNORE global convenience. (2.17.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.17.2)
- Supports Bitwarden secrets in .env files using the bw:// scheme. (2.17.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.17.0)
- Adds support for -ek to dotenvx get. (2.16.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.16.0)
- Adds support for -ik to dotenvx get. (2.16.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.16.0)
- You can use 1Password op:// secrets in .env files. (2.15.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.15.0)
- Adds --validate to check environment variables against .env.example. (2.14.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.14.0)
- Adds the --eval-export flag to get. (2.13.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.13.0)
- The --mask option is supported with get, run, and decrypt. (2.7.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.7.0)
- The native up, down, pull, and push commands are supported on Windows. (2.5.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.6.0), [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.5.0)
- config(path:) supports a directory such as app/web, which is useful for monorepos. (2.4.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.4.1)
- Select commands now support multiple -fk flags. (2.4.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.4.0)
- Use these commands to move your private keys to your macOS Keychain. (2.2.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.2.0)
- Adds support for the nextjs convention through DOTENV_CONFIG_CONVENTION. (2.1.4) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.1.4)
- Supports DOTENV_CONFIG_QUIET=true as a synonym for the --quiet flag. (2.1.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.1.1)
- The set command gains an interactive input mode. (2.1.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.1.0)
- Adds keyring support for local and armor providers, with the aim of enabling future providers. (2.0.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.0.0)

### Performance

- Startup time for the CLI is improved. (2.32.3) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.32.3)
- The bundle size was improved. (2.32.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.32.2)

### Behavior and default changes

- Uses atomic file writes in `protect`. (2.35.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.35.0)
- Applies Envfile encryption rules to encrypt. (2.33.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.33.0)
- Applies Envfile encryption rules to protect. (2.33.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.33.0)
- Validates final values when Envfile rules are combined. (2.33.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.33.0)
- Envspec rules now guide check, run, encrypt, and protect. (2.32.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.32.0)
- armor up should read from the OS secret store, 1Password, and Bitwarden. (2.31.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.31.1)
- Some commands are moved under a hidden menu. (2.28.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.28.1)
- The path option accepts comma-separated env file paths. (2.23.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.23.0)
- The DOTENV_CONFIG_* variable is renamed to this variable; its existing name remains supported as a fallback. (2.23.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.23.0)
- Installation falls back to ~/.local/bin when /usr/local/bin is not writable. (2.22.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.22.0)
- Exempts .env.vault from precommit and prebuild sealed checks because vault-format ciphertext is already safe to commit. (2.20.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.20.0)
- Pressing Enter opens the approval URL for convenience. (2.19.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.19.1)
- Curl requests now include a device identifier. (2.17.4) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.17.4)
- Pkg-ed binaries support nested node invocations. (2.11.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.11.2)
- The default encrypted .env file is simplified to contain just HELLO="World". (2.11.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.11.1)
- The -f flag now supports directories. (2.4.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.4.0)
- The set command now permits an empty value. (2.3.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.3.2)
- prebuild now respects _PLAIN. (2.1.5) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.1.5)
- precommit now respects _PLAIN. (2.1.5) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.1.5)
- Keys with the _PLAIN suffix can be left unencrypted when using set or encrypt. (2.1.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.1.0)
- Library parse now uses primitive parsing while preserving dotenvx-style errors for encrypted values. (2.0.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.0.0)

### Tooling

- Adds the dotenvx armor invite command. (2.36.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.36.0)
- The command now returns provider information. (2.34.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.34.0)
- Validates final values when Envfile rules are combined. (2.33.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.33.0)
- Adds a command for giving feedback on the CLI. (2.31.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.31.0)
- Adds a command for generating your Envfile. (2.31.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.31.0)
- CLI audit logging is added for Armor customers. (2.30.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.30.0)
- Adds the down command for 1Password integration. (2.26.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.26.1)
- Adds the pull command for 1Password integration. (2.26.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.26.1)
- Adds the push command for 1Password integration. (2.26.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.26.1)
- Adds the up command for 1Password integration. (2.26.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.26.1)
- Adds the down command for Bitwarden integration. (2.26.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.26.1)
- Adds the pull command for Bitwarden integration. (2.26.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.26.1)
- Adds the push command for Bitwarden integration. (2.26.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.26.1)
- Adds the up command for Bitwarden integration. (2.26.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.26.1)
- Adds dec as a shorthand for decrypt. (2.21.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.21.0)
- Adds enc as a shorthand for encrypt. (2.21.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.21.0)
- Adds a convenient alias for shorter commands such as dx run -- and dx enc. (2.21.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.21.0)
- Patches the TypeScript types for path. (2.21.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.21.0)
- Adds a command for deleting a key from a .env file. (2.20.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.20.0)
- Adds a command to open armored key details in a browser. (2.19.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.19.0)
- Adds a command for making authenticated API calls to the Dotenvx Armor API, allowing you to control your account from an agent. (2.18.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.18.0)
- `.env.example` files in subdirectories are exempt from precommit. (2.17.3) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.17.3)
- Adds a command to pre-check validation against the .env.example file. (2.14.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.14.0)
- Supports running `claude` and `codex` with `dotenvx run --`. (2.11.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.11.1)
- Adds a convenience method for updating dotenvx. (2.11.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.11.0)
- Adds the dotenvx armor status command. (2.7.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.7.2)
- The login command attempts to store DOTENVX_ARMOR_TOKEN in the native OS secret store. Current Armor users can run dotenvx armor logout and then dotenvx armor login to use this immediately. (2.7.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.7.1)

### Fixes and other changes

- Fixes an atomic edge case when writing .env and .env.keys files. (2.34.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.34.2)
- The CLI no longer writes the public key when the user presses Ctrl+C or a prompt fails. (2.34.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.34.1)
- Restores ESM named imports such as `import { config } from '@dotenvx/dotenvx'`, which were broken in 2.30.0. (2.31.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.31.0)
- Handles accent marks when using ext precommit. (2.20.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.20.1)
- Patched the injected message when the preset value is encrypted. (2.18.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.18.1)
- Handles ctrl + c better. (2.17.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.17.1)
- Dotenvx no longer reports child errors; the child reports them instead. (2.16.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.16.1)
- Time spent waiting on 1Password is now communicated with elapsed time, making the wait clearer to users. (2.15.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.15.1)
- Makes get --eval POSIX safe. (2.13.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.13.0)
- Escaped apostrophes in single-quoted values now correctly resolve to apostrophes. (2.12.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.12.0)
- Improves command substitution for nested commands. (2.11.3) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.11.3)
- Adds support for Enclaved Armored Keys. (2.8.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.8.0)
- Adds a FILE_NOT_WRITABLE error for user convenience. (2.8.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.8.0)
- With --quiet, the spinner and its stderr messages are no longer displayed. (2.7.3) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.7.3)
- Corrects default valuation interpolation for empty strings. (2.3.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.3.1)
- Patches an edge case involving a custom unspecified -f and the --env flag. (2.1.3) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v2.1.3)

## @dotenvx/dotenvx 1

### Breaking changes

- The update available notification is shown only for armor commands. (1.73.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.73.1)
- stderr changed to inherit for dotenvx-armor integration. (1.71.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.71.1)
- The fully deprecated opsOff option was removed in favor of noOps. (1.69.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.69.0)
- SIGINT handling now respects handler completion. (1.61.4) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.61.4)
- Ops users now see stderr surfaced. (1.61.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.61.2)
- Error logs are improved and most are compacted to a single line. (1.57.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.57.1)
- CLI output colors and formatting changed. (1.57.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.57.0)
- Support for .env.vault files is removed. (1.56.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.56.0)
- The `ops observe` command was removed; download dotenvx-ops if needed. (1.54.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.54.0)
- The radar command was removed; it had been replaced by ops. (1.53.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.53.0)

### Security

- Adds a command to armor a private key, helping move private keys off device and under access control with Dotenvx Ops. (1.64.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.64.0)
- Guards against command substitution following encrypted: values. (1.61.6) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.61.6)
- Adds a security feature for hardening private keys when dotenvx-ops is installed. (1.55.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.55.0)
- Adds a hint about .env.keys, noting that Dotenvx Armor can securely armor private keys as an alternative to manually copying them in and out of 1Password. (1.51.3) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.51.3)

### New APIs and options

- An override package is additionally published for use with @dotenvx/next-env. (1.74.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.74.0)
- Optional --token support is added for automation by Armor users. (1.71.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.71.0)
- Passes -f to ops, allowing the option to be used with the ops command. (1.68.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.68.1)
- The parse API now supports the ignore option. (1.68.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.68.0)
- A simpler --no-spinner flag is passed to ops to improve spinner message blinking. (1.65.3) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.65.3)
- Duplicate keys can now be replaced with different values. (1.65.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.65.0)
- Adds a command to dearmor a private key. (1.64.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.64.0)
- The --env flag supports encrypted values. (1.63.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.63.0)
- Adds support for colon format to match Cloudflare Wrangler's --var flag format. (1.63.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.63.0)
- Adds support for passing env sources to config({ envs }), enabling simpler Cloudflare Worker integration. (1.62.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.62.0)
- Supports the --hostname flag for dotenvx-ops.login. (1.61.5) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.61.5)
- Pass this option to prevent file creation. (1.59.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.59.0)
- Adds --pp as shorthand for --pretty-print, toward sunsetting -pp. (1.56.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.56.0)
- main.set now accepts log level options, allowing developers to configure its logging level. (1.52.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.52.0)

### Performance

- Coldstarts are faster. (1.61.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.61.1)

### Behavior and default changes

- The ext commands become first-class. (1.75.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.75.0)
- Minor messaging improvements, especially when using armored keys. (1.69.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.69.2)
- Improves coordination of spinner messages between dotenvx and dotenvx-ops. (1.65.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.65.2)
- Prompts from ops should bubble up. (1.65.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.65.1)
- Now creates a .env file if one does not exist. (1.59.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.59.0)
- Now creates a .env file if one does not exist. (1.59.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.59.0)
- The runtime injection message now uses the format `⟐ injecting env (N) from FILE · dotenvx@VERSION`. (1.58.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.58.0)
- Respect the dotenvx-ops status setting when it is on or off. (1.55.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.55.1)

### Tooling

- Armor commands are available directly inside dotenvx and remain optional under the professional security section. (1.73.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.73.0)
- The login command is now a first-class dotenvx command; login remains optional and is only needed for Armor features. (1.72.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.72.0)
- Commands are forwarded to Dotenvx Armor Key Guard approvals. (1.71.3) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.71.3)
- A prompt lets developers choose between local storage and armored storage. (1.67.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.67.0)
- Adds the `dotenvx doctor` command. (1.66.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.66.0)
- Adds a command to pull an armored key into .env.keys. (1.64.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.64.0)
- Adds a command to push an armored key from .env.keys. (1.64.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.64.0)
- Adds a login command that proxies to dotenvx-ops login. (1.61.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.61.0)
- Adds a logout command that proxies to dotenvx-ops logout. (1.61.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.61.0)
- Adds loading messages while run injects, encrypt and set encrypt, decrypt and get decrypt, rotate rotates, and keypair retrieves. (1.60.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.60.0)
- Type information was added for opsOff. (1.51.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.51.1)

### Fixes and other changes

- The release is published as named binaries, changing how developers obtain the executable. (1.75.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.75.1)
- dotenvx now bundles @dotenvx/next-env for user convenience. (1.74.3) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.74.3)
- Fixed provenance for @dotenvx/next-env. (1.74.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.74.2)
- Touched up `dotenvx decrypt` when armor is installed. (1.71.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.71.2)
- Touched up `dotenvx get` when armor is installed. (1.71.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.71.2)
- Touched up `dotenvx set` when armor is installed. (1.71.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.71.2)
- Dotenvx Ops/Vlt is now named Dotenvx Armor. (1.70.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.70.0)
- The precommit and prebuild shorthands were patched. (1.61.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.61.1)
- Communicates whether Ops stored keys are local keys or armored keys. (1.60.2) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.60.2)
- Adds the missing + key ⛨ marker for Ops stored keys. (1.60.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.60.1)
- The message shown when already installed was improved. (1.57.5) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.57.5)
- The success message shown after installation was simplified. (1.57.3) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.57.3)
- Leading glyphs provide a visual status language for successful actions, no-ops, warnings, and errors. (1.57.1) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.57.1)
- The ops off flag is now respected by get, keypair, rotate, and encrypt. (1.56.0) — [release notes](https://github.com/dotenvx/dotenvx/releases/tag/v1.56.0)