# What changed in python-dotenv

> 15 changes in python-dotenv 1 from its official release notes, upgrade guides and advisories: 2 breaking, 1 security. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/pypi/python-dotenv/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## python-dotenv 1

### Breaking changes

- The CLI set and unset commands no longer follow symlinks in some situations. (1.2.2) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2)
- set_key and unset_key no longer follow symlinks in some situations; use follow_symlinks=True to restore that behavior in all cases. (1.2.2) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2)

### Security

- python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback (1.2.2) — [security advisory](https://github.com/advisories/GHSA-MF9W-MJ56-HR94)

### Performance

- Caches the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file. (1.2.3) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.3)

### Behavior and default changes

- The command now forwards flags directly to the specified command. (1.2.2) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2)

### Fixes and other changes

- The command no longer exits with code 1 for empty string values such as KEY=. (1.2.4) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.4)
- With --no-override, variable references use the same precedence as load_dotenv(override=False), using existing environment values instead of values from the .env file. (1.2.4) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.4)
- An unquoted empty value followed by an inline comment is parsed as an empty string instead of the comment text. (1.2.4) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.4)
- Prints a friendly error instead of a traceback when no command is given. (1.2.3) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.3)
- A leading UTF-8 BOM is stripped from .env file contents so the first variable is no longer silently lost. (1.2.3) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.3)
- set_key escapes backslashes so values containing them survive a write/read round-trip; quoted values ending in an escaped backslash are no longer mis-parsed. (1.2.3) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.3)
- set_key, unset_key, and CLI set and unset now preserve the original file mode; newly created or non-regular files use mode 0o600. (1.2.2) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2)
- PyPy support is updated to version 3.11. (1.2.2) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2)
- Python 3.14, including the free-threaded build, is supported. (1.2.2) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2)
- Python 3.9 is supported. (1.2.2) — [release notes](https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2)