npm / dotenv

dotenv

What changed in dotenv 17 to 18, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.

2 breaking6 new APIs and options1 performance4 behavior and defaults1 tooling8 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

dotenv 1818 changes

Support for .env.vault has been removed.
18.0.0release notes
Preloading has been removed; use the CLI with dotenv run -- your-command instead.
18.0.0release notes

Pass fast: true to opt in to the approximately 2x faster character-scanner parser.
18.0.0release notes
Set DOTENV_FAST=true to opt in to the approximately 2x faster character-scanner parser.
18.0.0release notes
Dotenv now provides a CLI command to run a command with environment variables injected.
18.0.0release notes
The CLI accepts --fast to opt in to the approximately 2x faster character-scanner parser.
18.0.0release notes

Undefined settings such as quiet: true are treated as null rather than falsey.
18.0.7release notes
Importing dotenv/config now defaults quiet to true.
18.0.4release notes
The injecting message is sent to stderr rather than stdout.
18.0.0release notes

The fast parser strips appended extra quotes.
18.0.8release notes
The CLI honors the DOTENV_QUIET setting in the .env file.
18.0.7release notes
Uses smarter parseBoolean logic instead of Boolean() to fix override behavior.
18.0.6release notes
Fixes a missing TypeScript module declaration.
18.0.5release notes
Patches the DOTENV_QUIET setting when it is inside an .env file.
18.0.3release notes
Additional edge cases in the fast parser were patched.
18.0.2release notes
Config logging now handles file URLs.
18.0.1release notes

Adds focused dotenv and dotenvx agent skills for discovery via the skills.sh ecosystem.
17.4.0release notes
DotenvPopulateInput now accepts the NodeJS.ProcessEnv type.
17.2.4release notes

Tightens up log output; injection messages now use the format ◇ injecting env (14) from .env.
17.4.0release notes