-
-
Notifications
You must be signed in to change notification settings - Fork 921
correctly track which keys were written to process.env #879
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR enhances environment variable injection by tracking which keys are actually written to process.env and reflecting that in the log output.
- Return a
populatedobject frompopulateto record written keys - Use
populatedinstead ofparsedAllto compute keys count for logging - Update the log message formatting and add assignments to
populatedin both override and default branches
Comments suppressed due to low confidence (4)
lib/main.js:341
- Add unit tests for
populateto verify the returnedpopulatedobject contains exactly the keys that were written toprocess.env, including both override and default branches.
const populated = {}
lib/main.js:338
- Update the function’s documentation or add a JSDoc block to describe the new return value (
populated) and its behavior, so consumers know about the API change.
function populate (processEnv, parsed, options = {}) {
lib/main.js:370
- Introducing a return value in
populateis an API change; consider whether this requires a major version bump or an explicit note in the changelog to avoid breaking downstream users.
return populated
lib/main.js:277
- [nitpick] The bracketed '[tip]' prefix differs from the existing emoji style in logs; consider aligning log message formatting with the project’s established conventions.
_log(`injecting env (${keysCount}) from ${shortPaths.join(',')} – [tip] encrypt with dotenvx: https://dotenvx.com`)
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #879 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 3 3
Lines 431 436 +5
=========================================
+ Hits 431 436 +5 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | npm | dotenv | 16.6.1 | 17.2.1 | ## [v17.2.1](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1721-2025-07-24) ##### Changed - Fix clickable tip links by removing parentheses ([#897](motdotla/dotenv#897)) ## [v17.2.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1720-2025-07-09) ##### Added - Optionally specify `DOTENV_CONFIG_QUIET=true` in your environment or `.env` file to quiet the runtime log ([#889](motdotla/dotenv#889)) - Just like dotenv any `DOTENV_CONFIG_` environment variables take precedence over any code set options like `({quiet: false})` ```ini ``` ## [v17.1.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1710-2025-07-07) ##### Added - Add additional security and configuration tips to the runtime log ([#884](motdotla/dotenv#884)) - Dim the tips text from the main injection information text ```js const TIPS = [ '🔐 encrypt with dotenvx: https://dotenvx.com', '🔐 prevent committing .env to code: https://dotenvx.com/precommit', '🔐 prevent building .env in docker: https://dotenvx.com/prebuild', '🛠️ run anywhere with `dotenvx run -- yourcommand`', '⚙️ specify custom .env file path with { path: \'/custom/path/.env\' }', '⚙️ enable debug logging with { debug: true }', '⚙️ override existing env vars with { override: true }', '⚙️ suppress all logs with { quiet: true }', '⚙️ write to custom object with { processEnv: myObject }', '⚙️ load multiple .env files with { path: [\'.env.local\', \'.env\'] }' ] ``` ## [v17.0.1](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1701-2025-07-01) ##### Changed - Patched injected log to count only populated/set keys to process.env ([#879](motdotla/dotenv#879)) ## [v17.0.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1700-2025-06-27) ##### Changed - Default `quiet` to false - informational (file and keys count) runtime log message shows by default ([#875](motdotla/dotenv#874))
| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | npm | dotenv | 16.6.1 | 17.2.1 | ## [v17.2.1](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1721-2025-07-24) ##### Changed - Fix clickable tip links by removing parentheses ([#897](motdotla/dotenv#897)) ## [v17.2.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1720-2025-07-09) ##### Added - Optionally specify `DOTENV_CONFIG_QUIET=true` in your environment or `.env` file to quiet the runtime log ([#889](motdotla/dotenv#889)) - Just like dotenv any `DOTENV_CONFIG_` environment variables take precedence over any code set options like `({quiet: false})` ```ini ``` ## [v17.1.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1710-2025-07-07) ##### Added - Add additional security and configuration tips to the runtime log ([#884](motdotla/dotenv#884)) - Dim the tips text from the main injection information text ```js const TIPS = [ '🔐 encrypt with dotenvx: https://dotenvx.com', '🔐 prevent committing .env to code: https://dotenvx.com/precommit', '🔐 prevent building .env in docker: https://dotenvx.com/prebuild', '🛠️ run anywhere with `dotenvx run -- yourcommand`', '⚙️ specify custom .env file path with { path: \'/custom/path/.env\' }', '⚙️ enable debug logging with { debug: true }', '⚙️ override existing env vars with { override: true }', '⚙️ suppress all logs with { quiet: true }', '⚙️ write to custom object with { processEnv: myObject }', '⚙️ load multiple .env files with { path: [\'.env.local\', \'.env\'] }' ] ``` ## [v17.0.1](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1701-2025-07-01) ##### Changed - Patched injected log to count only populated/set keys to process.env ([#879](motdotla/dotenv#879)) ## [v17.0.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1700-2025-06-27) ##### Changed - Default `quiet` to false - informational (file and keys count) runtime log message shows by default ([#875](motdotla/dotenv#874))
| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | npm | dotenv | 16.6.1 | 17.2.1 | ## [v17.2.1](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1721-2025-07-24) ##### Changed - Fix clickable tip links by removing parentheses ([#897](motdotla/dotenv#897)) ## [v17.2.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1720-2025-07-09) ##### Added - Optionally specify `DOTENV_CONFIG_QUIET=true` in your environment or `.env` file to quiet the runtime log ([#889](motdotla/dotenv#889)) - Just like dotenv any `DOTENV_CONFIG_` environment variables take precedence over any code set options like `({quiet: false})` ```ini ``` ## [v17.1.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1710-2025-07-07) ##### Added - Add additional security and configuration tips to the runtime log ([#884](motdotla/dotenv#884)) - Dim the tips text from the main injection information text ```js const TIPS = [ '🔐 encrypt with dotenvx: https://dotenvx.com', '🔐 prevent committing .env to code: https://dotenvx.com/precommit', '🔐 prevent building .env in docker: https://dotenvx.com/prebuild', '🛠️ run anywhere with `dotenvx run -- yourcommand`', '⚙️ specify custom .env file path with { path: \'/custom/path/.env\' }', '⚙️ enable debug logging with { debug: true }', '⚙️ override existing env vars with { override: true }', '⚙️ suppress all logs with { quiet: true }', '⚙️ write to custom object with { processEnv: myObject }', '⚙️ load multiple .env files with { path: [\'.env.local\', \'.env\'] }' ] ``` ## [v17.0.1](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1701-2025-07-01) ##### Changed - Patched injected log to count only populated/set keys to process.env ([#879](motdotla/dotenv#879)) ## [v17.0.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1700-2025-06-27) ##### Changed - Default `quiet` to false - informational (file and keys count) runtime log message shows by default ([#875](motdotla/dotenv#874))
| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | npm | dotenv | 16.6.1 | 17.2.1 | ## [v17.2.1](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1721-2025-07-24) ##### Changed - Fix clickable tip links by removing parentheses ([#897](motdotla/dotenv#897)) ## [v17.2.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1720-2025-07-09) ##### Added - Optionally specify `DOTENV_CONFIG_QUIET=true` in your environment or `.env` file to quiet the runtime log ([#889](motdotla/dotenv#889)) - Just like dotenv any `DOTENV_CONFIG_` environment variables take precedence over any code set options like `({quiet: false})` ```ini ``` ## [v17.1.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1710-2025-07-07) ##### Added - Add additional security and configuration tips to the runtime log ([#884](motdotla/dotenv#884)) - Dim the tips text from the main injection information text ```js const TIPS = [ '🔐 encrypt with dotenvx: https://dotenvx.com', '🔐 prevent committing .env to code: https://dotenvx.com/precommit', '🔐 prevent building .env in docker: https://dotenvx.com/prebuild', '🛠️ run anywhere with `dotenvx run -- yourcommand`', '⚙️ specify custom .env file path with { path: \'/custom/path/.env\' }', '⚙️ enable debug logging with { debug: true }', '⚙️ override existing env vars with { override: true }', '⚙️ suppress all logs with { quiet: true }', '⚙️ write to custom object with { processEnv: myObject }', '⚙️ load multiple .env files with { path: [\'.env.local\', \'.env\'] }' ] ``` ## [v17.0.1](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1701-2025-07-01) ##### Changed - Patched injected log to count only populated/set keys to process.env ([#879](motdotla/dotenv#879)) ## [v17.0.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1700-2025-06-27) ##### Changed - Default `quiet` to false - informational (file and keys count) runtime log message shows by default ([#875](motdotla/dotenv#874))
| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | npm | dotenv | 16.6.1 | 17.2.1 | ## [v17.2.1](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1721-2025-07-24) ##### Changed - Fix clickable tip links by removing parentheses ([#897](motdotla/dotenv#897)) ## [v17.2.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1720-2025-07-09) ##### Added - Optionally specify `DOTENV_CONFIG_QUIET=true` in your environment or `.env` file to quiet the runtime log ([#889](motdotla/dotenv#889)) - Just like dotenv any `DOTENV_CONFIG_` environment variables take precedence over any code set options like `({quiet: false})` ```ini ``` ## [v17.1.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1710-2025-07-07) ##### Added - Add additional security and configuration tips to the runtime log ([#884](motdotla/dotenv#884)) - Dim the tips text from the main injection information text ```js const TIPS = [ '🔐 encrypt with dotenvx: https://dotenvx.com', '🔐 prevent committing .env to code: https://dotenvx.com/precommit', '🔐 prevent building .env in docker: https://dotenvx.com/prebuild', '🛠️ run anywhere with `dotenvx run -- yourcommand`', '⚙️ specify custom .env file path with { path: \'/custom/path/.env\' }', '⚙️ enable debug logging with { debug: true }', '⚙️ override existing env vars with { override: true }', '⚙️ suppress all logs with { quiet: true }', '⚙️ write to custom object with { processEnv: myObject }', '⚙️ load multiple .env files with { path: [\'.env.local\', \'.env\'] }' ] ``` ## [v17.0.1](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1701-2025-07-01) ##### Changed - Patched injected log to count only populated/set keys to process.env ([#879](motdotla/dotenv#879)) ## [v17.0.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1700-2025-06-27) ##### Changed - Default `quiet` to false - informational (file and keys count) runtime log message shows by default ([#875](motdotla/dotenv#874))
| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | npm | dotenv | 16.6.1 | 17.2.1 | ## [v17.2.1](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1721-2025-07-24) ##### Changed - Fix clickable tip links by removing parentheses ([#897](motdotla/dotenv#897)) ## [v17.2.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1720-2025-07-09) ##### Added - Optionally specify `DOTENV_CONFIG_QUIET=true` in your environment or `.env` file to quiet the runtime log ([#889](motdotla/dotenv#889)) - Just like dotenv any `DOTENV_CONFIG_` environment variables take precedence over any code set options like `({quiet: false})` ```ini ``` ## [v17.1.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1710-2025-07-07) ##### Added - Add additional security and configuration tips to the runtime log ([#884](motdotla/dotenv#884)) - Dim the tips text from the main injection information text ```js const TIPS = [ '🔐 encrypt with dotenvx: https://dotenvx.com', '🔐 prevent committing .env to code: https://dotenvx.com/precommit', '🔐 prevent building .env in docker: https://dotenvx.com/prebuild', '🛠️ run anywhere with `dotenvx run -- yourcommand`', '⚙️ specify custom .env file path with { path: \'/custom/path/.env\' }', '⚙️ enable debug logging with { debug: true }', '⚙️ override existing env vars with { override: true }', '⚙️ suppress all logs with { quiet: true }', '⚙️ write to custom object with { processEnv: myObject }', '⚙️ load multiple .env files with { path: [\'.env.local\', \'.env\'] }' ] ``` ## [v17.0.1](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1701-2025-07-01) ##### Changed - Patched injected log to count only populated/set keys to process.env ([#879](motdotla/dotenv#879)) ## [v17.0.0](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1700-2025-06-27) ##### Changed - Default `quiet` to false - informational (file and keys count) runtime log message shows by default ([#875](motdotla/dotenv#874))
No description provided.