@dotenvx/dotenvx 1.24.2 → 1.24.4

package/CHANGELOG.md

@@ -2,21 +2,33 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-## [Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.24.2...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.24.4...main)
 
-## 1.24.2
+## [1.24.4](https://github.com/dotenvx/dotenvx/compare/v1.24.3...v1.24.4)
+
+### Changed
+
+* do not expand command substitution ([#456](https://github.com/dotenvx/dotenvx/pull/456))
+
+## [1.24.3](https://github.com/dotenvx/dotenvx/compare/v1.24.2...v1.24.3)
+
+### Changed
+
+* 🐞 fix command substitution for more complex commands ([#455](https://github.com/dotenvx/dotenvx/pull/455))
+
+## [1.24.2](https://github.com/dotenvx/dotenvx/compare/v1.24.1...v1.24.2)
 
 ### Changed
 
 * treat pre-existing expandable values as literal in `process.env` ([#450](https://github.com/dotenvx/dotenvx/pull/450))
 
-## 1.24.1
+## [1.24.1](https://github.com/dotenvx/dotenvx/compare/v1.24.0...v1.24.1)
 
 ### Changed
 
 * bump `cross-spawn` to prevent potential ReDoS [CVE-2024-21538](https://github.com/advisories/ghsa-3xgq-45jj-v275) ([#449](https://github.com/dotenvx/dotenvx/pull/449))
 
-## 1.24.0
+## [1.24.0](https://github.com/dotenvx/dotenvx/compare/v1.23.0...v1.24.0)
 
 ### Added
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.24.2",
+  "version": "1.24.4",
   "name": "@dotenvx/dotenvx",
   "description": "a better dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/lib/helpers/parse.js

@@ -44,12 +44,17 @@ class Parse {
       }
 
       // eval empty, double, or backticks
+      let evaled = false
       if (quote !== "'" && (!this.inProcessEnv(key) || this.processEnv[key] === this.parsed[key])) {
-        this.parsed[key] = this.eval(this.parsed[key])
+        const priorEvaled = this.parsed[key]
+        this.parsed[key] = this.eval(priorEvaled)
+        if (priorEvaled !== this.parsed[key]) {
+          evaled = true
+        }
       }
 
       // expand empty, double, or backticks
-      if (quote !== "'" && !this.processEnv[key]) {
+      if (!evaled && quote !== "'" && !this.processEnv[key]) {
         this.parsed[key] = resolveEscapeSequences(this.expand(this.parsed[key]))
       }
 
@@ -122,12 +127,13 @@ class Parse {
   }
 
   eval (value) {
-    const matches = value.match(/\$\([^()]+\)/) || []
+    // Match everything between the outermost $() using a regex with non-capturing groups
+    const matches = value.match(/\$\(([^)]+(?:\)[^(]*)*)\)/g) || []
 
     return matches.reduce(function (newValue, match) {
-      const command = match.substring(2, match.length - 1) // get command
-      const value = chomp(execSync(command).toString()) // execute command
-      return newValue.replace(match, value) // replace with command value
+      const command = match.slice(2, -1) // Extract command by removing $() wrapper
+      const result = chomp(execSync(command).toString()) // execute command
+      return newValue.replace(match, result) // Replace match with result
     }, value)
   }