@dotenvx/dotenvx 1.61.5 → 1.62.0

package/CHANGELOG.md

@@ -2,7 +2,32 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.61.5...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.62.0...main)
+
+## [1.62.0](https://github.com/dotenvx/dotenvx/compare/v1.61.6...v1.62.0) (2026-04-23)
+
+### Added
+
+* Add support for `config({ envs })`. unlocks simpler cloudflare worker integration ([#803](https://github.com/dotenvx/dotenvx/pull/803))
+
+```js
+import envSrc from '../.env.txt'
+import dotenvx from '@dotenvx/dotenvx'
+
+export default {
+  async fetch(request, env, ctx) {
+    dotenvx.config({ envs: [{ type: 'env', value: envSrc, privateKeyName: 'DOTENV_PRIVATE_KEY' }] processEnv: env })
+
+    return new Response(`Hello ${env.HELLO}`)
+  },
+};
+```
+
+## [1.61.6](https://github.com/dotenvx/dotenvx/compare/v1.61.5...v1.61.6) (2026-04-23)
+
+### Changed
+
+* Guard against command substitution following `encrypted:` ([#802](https://github.com/dotenvx/dotenvx/pull/802))
 
 ## [1.61.5](https://github.com/dotenvx/dotenvx/compare/v1.61.4...v1.61.5) (2026-04-22)
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.61.5",
+  "version": "1.62.0",
   "name": "@dotenvx/dotenvx",
   "description": "secrets for agents–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/run.js

@@ -8,6 +8,7 @@ const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
 
 const conventions = require('./../../lib/helpers/conventions')
+const { determine } = require('./../../lib/helpers/envResolution')
 
 async function run () {
   const options = this.opts()
@@ -45,6 +46,7 @@ async function run () {
     } else {
       envs = this.envs
     }
+    envs = determine(envs, process.env)
 
     const {
       processedEnvs,

package/src/lib/helpers/buildEnvs.js

@@ -2,6 +2,10 @@ const conventions = require('./conventions')
 const dotenvOptionPaths = require('./dotenvOptionPaths')
 
 function buildEnvs (options) {
+  if (options.envs) {
+    return options.envs
+  }
+
   // build envs using user set option.path
   const optionPaths = dotenvOptionPaths(options) // [ '.env' ]
 

package/src/lib/helpers/executeExtension.js

@@ -23,7 +23,7 @@ function executeExtension (ext, command, rawArgs) {
   const result = childProcess.spawnSync(`dotenvx-ext-${command}`, forwardedArgs, { stdio: 'inherit', env })
   if (result.error) {
     // list known extension here for convenience to the user
-    if (['vault', 'hub'].includes(command)) {
+    if (['vault'].includes(command)) {
       logger.warn(`[INSTALLATION_NEEDED] install dotenvx-ext-${command} to use [dotenvx ext ${command}] commands`)
       logger.help('? see installation instructions [https://github.com/dotenvx/dotenvx-ext-vault]')
     } else {

package/src/lib/helpers/parse.js

@@ -1,4 +1,5 @@
 const decryptKeyValue = require('./cryptography/decryptKeyValue')
+const isEncrypted = require('./cryptography/isEncrypted')
 const evalKeyValue = require('./evalKeyValue')
 const resolveEscapeSequences = require('./resolveEscapeSequences')
 
@@ -44,9 +45,11 @@ class Parse {
         this.errors.push(e)
       }
 
+      const encryptedPrefixed = isEncrypted(this.parsed[key]) // do not eval encrypted prefix
+
       // eval empty, double, or backticks
       let evaled = false
-      if (quote !== "'" && (!this.inProcessEnv(key) || this.processEnv[key] === this.parsed[key])) {
+      if (!encryptedPrefixed && quote !== "'" && (!this.inProcessEnv(key) || this.processEnv[key] === this.parsed[key])) {
         const priorEvaled = this.parsed[key]
         // eval
         try {
@@ -60,7 +63,7 @@ class Parse {
       }
 
       // expand empty, double, or backticks
-      if (!evaled && quote !== "'" && (!this.processEnv[key] || this.overload)) {
+      if (!encryptedPrefixed && !evaled && quote !== "'" && (!this.processEnv[key] || this.overload)) {
         this.parsed[key] = resolveEscapeSequences(this.expand(this.parsed[key]))
       }
 

package/src/lib/main.d.ts

@@ -50,6 +50,15 @@ export function parse<T extends DotenvParseOutput = DotenvParseOutput>(
 ): T;
 
 export interface DotenvConfigOptions {
+  /**
+   * Specify explicit env sources. When set, `path` and `convention` are ignored.
+   *
+   * @default undefined
+   * @example require('@dotenvx/dotenvx').config({ envs: [{ type: 'envFile', value: '.env' }] })
+   * @example require('@dotenvx/dotenvx').config({ envs: [{ type: 'env', value: 'HELLO=World', privateKeyName: 'DOTENV_PRIVATE_KEY' }] })
+   */
+  envs?: DotenvConfigEnv[];
+
   /**
    * Specify a custom path if your file containing environment variables is located elsewhere.
    * Can also be an array of strings, specifying multiple paths.
@@ -161,6 +170,21 @@ export interface DotenvConfigOptions {
   opsOff?: boolean;
 }
 
+export type DotenvConfigEnv =
+  | DotenvConfigEnvFile
+  | DotenvConfigEnvSrc;
+
+export interface DotenvConfigEnvFile {
+  type: 'envFile';
+  value: string | URL;
+}
+
+export interface DotenvConfigEnvSrc {
+  type: 'env';
+  value: string | Buffer;
+  privateKeyName?: string;
+}
+
 export interface DotenvConfigOutput {
   error?: Error;
   parsed?: DotenvParseOutput;

package/src/lib/main.js

@@ -16,6 +16,7 @@ const Session = require('./../db/session')
 
 // helpers
 const buildEnvs = require('./helpers/buildEnvs')
+const { determine } = require('./helpers/envResolution')
 const Parse = require('./helpers/parse')
 const fsx = require('./helpers/fsx')
 const localDisplayPath = require('./helpers/localDisplayPath')
@@ -50,7 +51,10 @@ const config = function (options = {}) {
   const noOps = resolveNoOps(options)
 
   try {
-    const envs = buildEnvs(options)
+    let envs = buildEnvs(options)
+    if (!options.envs) {
+      envs = determine(envs, processEnv)
+    }
     const {
       processedEnvs,
       readableFilepaths,
@@ -103,7 +107,7 @@ const config = function (options = {}) {
       }
     }
 
-    let msg = `injecting env (${uniqueInjectedKeys.length})`
+    let msg = `injected env (${uniqueInjectedKeys.length})`
     if (readableFilepaths.length > 0) {
       msg += ` from ${readableFilepaths.join(', ')}`
     }

package/src/lib/services/get.js

@@ -1,5 +1,6 @@
 const Run = require('./run')
 const Errors = require('./../helpers/errors')
+const { determine } = require('./../helpers/envResolution')
 
 class Get {
   constructor (key, envs = [], overload = false, all = false, envKeysFilepath = null, noOps = false) {
@@ -13,13 +14,15 @@ class Get {
 
   runSync () {
     const processEnv = { ...process.env }
-    const { processedEnvs } = new Run(this.envs, this.overload, processEnv, this.envKeysFilepath, this.noOps).runSync()
+    const envs = determine(this.envs, processEnv)
+    const { processedEnvs } = new Run(envs, this.overload, processEnv, this.envKeysFilepath, this.noOps).runSync()
     return this._result(processedEnvs, processEnv)
   }
 
   async run () {
     const processEnv = { ...process.env }
-    const { processedEnvs } = await new Run(this.envs, this.overload, processEnv, this.envKeysFilepath, this.noOps).run()
+    const envs = determine(this.envs, processEnv)
+    const { processedEnvs } = await new Run(envs, this.overload, processEnv, this.envKeysFilepath, this.noOps).run()
     return this._result(processedEnvs, processEnv)
   }
 

package/src/lib/services/run.js

@@ -15,13 +15,9 @@ const {
   keyValuesSync
 } = require('./../helpers/keyResolution')
 
-const {
-  determine
-} = require('./../helpers/envResolution')
-
 class Run {
   constructor (envs = [], overload = false, processEnv = process.env, envKeysFilepath = null, noOps = false) {
-    this.envs = determine(envs, processEnv)
+    this.envs = envs
     this.overload = overload
     this.processEnv = processEnv
     this.envKeysFilepath = envKeysFilepath
@@ -46,7 +42,7 @@ class Run {
       if (env.type === TYPE_ENV_FILE) {
         this._injectEnvFileSync(env.value)
       } else if (env.type === TYPE_ENV) {
-        this._injectEnv(env.value)
+        this._injectEnv(env.value, env.privateKeyName)
       }
     }
 
@@ -72,7 +68,7 @@ class Run {
       if (env.type === TYPE_ENV_FILE) {
         await this._injectEnvFile(env.value)
       } else if (env.type === TYPE_ENV) {
-        this._injectEnv(env.value)
+        this._injectEnv(env.value, env.privateKeyName)
       }
     }
 
@@ -86,19 +82,23 @@ class Run {
     }
   }
 
-  _injectEnv (env) {
+  _injectEnv (env, privateKeyName = null) {
     const row = {}
     row.type = TYPE_ENV
     row.string = env
 
     try {
+      const privateKey = privateKeyName ? this.processEnv[privateKeyName] || null : null
+
       const {
         parsed,
         errors,
         injected,
         preExisted
-      } = new Parse(env, null, this.processEnv, this.overload).run()
+      } = new Parse(env, privateKey, this.processEnv, this.overload, privateKeyName).run()
 
+      row.privateKeyName = privateKeyName
+      row.privateKey = privateKey
       row.parsed = parsed
       row.errors = errors
       row.injected = injected