@dotenvx/dotenvx 1.75.0 → 1.75.1

package/CHANGELOG.md

@@ -2,7 +2,17 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.75.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.75.1...main)
+
+## [1.75.1](https://github.com/dotenvx/dotenvx/compare/v1.75.0...v1.75.1) (2026-06-20)
+
+### Changed
+
+* Publish as named binaries ([#851](https://github.com/dotenvx/dotenvx/pull/851))
+
+### Removed
+
+* Remove references to `dotenvx-vlt` (now dotenvx-armor) ([#849](https://github.com/dotenvx/dotenvx/pull/849))
 
 ## [1.75.0](https://github.com/dotenvx/dotenvx/compare/v1.74.4...v1.75.0) (2026-06-19)
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.75.0",
+  "version": "1.75.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -43,7 +43,7 @@
   },
   "funding": "https://dotenvx.com",
   "dependencies": {
-    "@dotenvx/primitives": "^0.7.1",
+    "@dotenvx/primitives": "^0.8.0",
     "commander": "^11.1.0",
     "conf": "^10.2.0",
     "dotenv": "^17.2.1",

package/src/lib/helpers/append.js

@@ -1,5 +1,5 @@
 const quotes = require('./quotes')
-const dotenvParse = require('./dotenvParse')
+const { scan } = require('@dotenvx/primitives')
 const escapeForRegex = require('./escapeForRegex')
 const escapeDollarSigns = require('./escapeDollarSigns')
 
@@ -7,11 +7,12 @@ function append (src, key, appendValue) {
   let output
   let newPart = ''
 
-  const parsed = dotenvParse(src, true, true) // skip expanding \n and skip converting \r\n
+  const { parsed } = scan(src, { expandDoubleQuotedNewlines: false, convertWindowsNewlines: false })
   const _quotes = quotes(src)
   if (Object.prototype.hasOwnProperty.call(parsed, key)) {
     const quote = _quotes[key]
-    const originalValue = parsed[key]
+    const values = parsed[key]
+    const originalValue = values[values.length - 1]
 
     newPart += `${key}=${quote}${originalValue},${appendValue}${quote}`
 

package/src/lib/helpers/cryptography/index.js

@@ -10,8 +10,5 @@ module.exports = {
   provision: require('./provision'),
   provisionSync: require('./provisionSync'),
   provisionWithPrivateKey: require('./provisionWithPrivateKey'),
-  mutateSrc: require('./mutateSrc'),
-
-  // other
-  isFullyEncrypted: require('./../isFullyEncrypted')
+  mutateSrc: require('./mutateSrc')
 }

package/src/lib/helpers/executeDynamic.js

@@ -45,7 +45,6 @@ function dynamicAttempts (command, forwardedArgs) {
   if (command === 'vlt') {
     return [
       ['dotenvx-armor', forwardedArgs],
-      ['dotenvx-vlt', forwardedArgs],
       ['dotenvx-ops', forwardedArgs]
     ]
   }
@@ -53,8 +52,7 @@ function dynamicAttempts (command, forwardedArgs) {
   if (command === 'ops') {
     return [
       ['dotenvx-armor', forwardedArgs],
-      ['dotenvx-ops', forwardedArgs],
-      ['dotenvx-vlt', forwardedArgs]
+      ['dotenvx-ops', forwardedArgs]
     ]
   }
 

package/src/lib/helpers/keyResolution/keyValues.js

@@ -1,7 +1,7 @@
 const path = require('path')
+const { scan } = require('@dotenvx/primitives')
 
 const fsx = require('./../fsx')
-const dotenvParse = require('./../dotenvParse')
 const keyNamesForEnvFile = require('./keyNamesForEnvFile')
 const readProcessKey = require('./readProcessKey')
 const readFileKey = require('./readFileKey')
@@ -16,7 +16,7 @@ async function invertForPrivateKeyName (filepath) {
   }
 
   const envSrc = await fsx.readFileX(filepath)
-  const envParsed = dotenvParse(envSrc)
+  const { parsed: envParsed } = scan(envSrc)
 
   let publicKeyName
   for (const keyName of Object.keys(envParsed)) {

package/src/lib/helpers/keyResolution/keyValuesFromEnvSrc.js

@@ -1,6 +1,6 @@
 const path = require('path')
+const { scan } = require('@dotenvx/primitives')
 
-const dotenvParse = require('./../dotenvParse')
 const readFileKeySync = require('./readFileKeySync')
 const armorKeypairSync = require('../cryptography/armorKeypairSync')
 
@@ -23,14 +23,19 @@ function publicKeyNameFromEnvSrc (envParsed) {
   return null
 }
 
+function finalValue (parsed, keyName) {
+  const values = parsed[keyName]
+  return values ? values[values.length - 1] : undefined
+}
+
 function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
   let keysFilepath = opts.keysFilepath || null
   const noArmor = opts.noArmor === true
   const processEnv = opts.processEnv || process.env
-  const envParsed = dotenvParse(src)
+  const { parsed: envParsed } = scan(src)
 
   const publicKeyName = publicKeyNameFromEnvSrc(envParsed)
-  const publicKeyValue = publicKeyName ? readProcessKey(processEnv, publicKeyName) || envParsed[publicKeyName] || null : null
+  const publicKeyValue = publicKeyName ? readProcessKey(processEnv, publicKeyName) || finalValue(envParsed, publicKeyName) || null : null
 
   if (!privateKeyName && publicKeyName) {
     privateKeyName = publicKeyName.replace(PUBLIC_KEY_SCHEMA, PRIVATE_KEY_SCHEMA)

package/src/lib/helpers/keyResolution/keyValuesSync.js

@@ -1,7 +1,7 @@
 const path = require('path')
+const { scan } = require('@dotenvx/primitives')
 
 const fsx = require('./../fsx')
-const dotenvParse = require('./../dotenvParse')
 const keyNamesForEnvFile = require('./keyNamesForEnvFile')
 const readProcessKey = require('./readProcessKey')
 const readFileKeySync = require('./readFileKeySync')
@@ -16,7 +16,7 @@ function invertForPrivateKeyName (filepath) {
   }
 
   const envSrc = fsx.readFileXSync(filepath)
-  const envParsed = dotenvParse(envSrc)
+  const { parsed: envParsed } = scan(envSrc)
 
   let publicKeyName
   for (const keyName of Object.keys(envParsed)) {

package/src/lib/helpers/keyResolution/readFileKey.js

@@ -1,5 +1,5 @@
 const fsx = require('./../fsx')
-const dotenvParse = require('./../dotenvParse')
+const { scan } = require('@dotenvx/primitives')
 
 async function readFileKey (keyName, filepath) {
   if (!(await fsx.exists(filepath))) {
@@ -7,10 +7,12 @@ async function readFileKey (keyName, filepath) {
   }
 
   const src = await fsx.readFileX(filepath)
-  const parsed = dotenvParse(src)
+  const { parsed } = scan(src)
+  const values = parsed[keyName]
 
-  if (parsed[keyName] && parsed[keyName].length > 0) {
-    return parsed[keyName]
+  if (values && values.length > 0) {
+    const value = values[values.length - 1]
+    return value || undefined
   }
 }
 

package/src/lib/helpers/keyResolution/readFileKeySync.js

@@ -1,13 +1,15 @@
 const fsx = require('./../fsx')
-const dotenvParse = require('./../dotenvParse')
+const { scan } = require('@dotenvx/primitives')
 
 function readFileKeySync (keyName, filepath) {
   if (fsx.existsSync(filepath)) {
     const src = fsx.readFileXSync(filepath)
-    const parsed = dotenvParse(src)
+    const { parsed } = scan(src)
+    const values = parsed[keyName]
 
-    if (parsed[keyName] && parsed[keyName].length > 0) {
-      return parsed[keyName]
+    if (values && values.length > 0) {
+      const value = values[values.length - 1]
+      return value || undefined
     }
   }
 }

package/src/lib/helpers/keypairMetadata.js

@@ -1,7 +1,7 @@
 const path = require('path')
 const fs = require('fs')
 const execa = require('execa')
-const dotenvParse = require('./dotenvParse')
+const { scan } = require('@dotenvx/primitives')
 const canonicalEnvFilename = require('./canonicalEnvFilename')
 const environment = require('./envResolution/environment')
 const sanitizeCommandForMetadata = require('./sanitizeCommandForMetadata')
@@ -56,7 +56,7 @@ function envKeys (envFile) {
     return null
   }
 
-  const parsed = dotenvParse(src)
+  const { parsed } = scan(src)
 
   if (!parsed || Object.keys(parsed).length === 0) return null
 

package/src/lib/helpers/readEnvKey.js

@@ -1,5 +1,5 @@
 const fs = require('fs')
-const dotenvParse = require('./dotenvParse')
+const { scan } = require('@dotenvx/primitives')
 const Errors = require('./errors')
 
 function ignored (error, options) {
@@ -17,8 +17,9 @@ function readEnvKey (key, filepath, options = {}) {
     return undefined
   }
 
-  const parsed = dotenvParse(src)
-  const value = parsed[key]
+  const { parsed } = scan(src)
+  const values = parsed[key]
+  const value = values ? values[values.length - 1] : undefined
   if (value === undefined) {
     const error = new Errors({ key }).missingKey()
     if (ignored(error, options)) return undefined

package/src/lib/helpers/replace.js

@@ -1,4 +1,4 @@
-const dotenvParse = require('./dotenvParse')
+const { scan } = require('@dotenvx/primitives')
 const escapeForRegex = require('./escapeForRegex')
 
 function replaceExistingValue (src, key, originalValue, replaceValue) {
@@ -45,7 +45,7 @@ function replace (src, key, replaceValue) {
   let output
   let newPart = ''
 
-  const parsed = dotenvParse(src, true, true, true) // skip expanding \n and skip converting \r\n
+  const { parsed } = scan(src, { expandDoubleQuotedNewlines: false, convertWindowsNewlines: false })
   if (Object.prototype.hasOwnProperty.call(parsed, key)) {
     const allValues = parsed[key]
     let duplicateOutput = src

package/src/lib/services/decrypt.js

@@ -1,7 +1,7 @@
 const fsx = require('./../helpers/fsx')
 const path = require('path')
 const picomatch = require('picomatch')
-const { encrypted } = require('@dotenvx/primitives')
+const { encrypted, scan } = require('@dotenvx/primitives')
 
 const TYPE_ENV_FILE = 'envFile'
 
@@ -21,7 +21,6 @@ const {
 } = require('./../helpers/cryptography')
 
 const replace = require('./../helpers/replace')
-const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 
 class Decrypt {
@@ -75,7 +74,7 @@ class Decrypt {
     try {
       const encoding = await detectEncoding(filepath)
       let envSrc = await fsx.readFileX(filepath, { encoding })
-      const envParsed = dotenvParse(envSrc, false, false, true)
+      const envParsed = scan(envSrc).parsed
 
       const { privateKeyName } = keyNamesForEnvFile(envFilepath)
       const { privateKeyValue, privateKeySource } = await keyValues(envFilepath, {

package/src/lib/services/encrypt.js

@@ -1,7 +1,7 @@
 const fsx = require('./../helpers/fsx')
 const path = require('path')
 const picomatch = require('picomatch')
-const { encrypted } = require('@dotenvx/primitives')
+const { encrypted, scan } = require('@dotenvx/primitives')
 
 const TYPE_ENV_FILE = 'envFile'
 
@@ -24,7 +24,6 @@ const {
 } = require('./../helpers/cryptography')
 
 const replace = require('./../helpers/replace')
-const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 const SAMPLE_ENV_KIT = require('./../helpers/kits/sample')
 
@@ -97,7 +96,7 @@ class Encrypt {
         row.kitCreated = 'sample'
         row.changed = true
       }
-      const envParsed = dotenvParse(envSrc, false, false, true)
+      const envParsed = scan(envSrc).parsed
 
       let publicKey
       let privateKey

package/src/lib/services/genexample.js

@@ -4,7 +4,19 @@ const path = require('path')
 const Errors = require('../helpers/errors')
 const findEnvFiles = require('../helpers/findEnvFiles')
 const replace = require('../helpers/replace')
-const dotenvParse = require('../helpers/dotenvParse')
+const { scan } = require('@dotenvx/primitives')
+
+function finalValues (src) {
+  const { parsed } = scan(src)
+  const result = {}
+
+  for (const key in parsed) {
+    const values = parsed[key]
+    result[key] = values[values.length - 1]
+  }
+
+  return result
+}
 
 class Genexample {
   constructor (directory = '.', envFile) {
@@ -40,7 +52,7 @@ class Genexample {
 
       // get the original src
       let src = fsx.readFileXSync(filepath)
-      const parsed = dotenvParse(src)
+      const parsed = finalValues(src)
       for (const key in parsed) {
         // used later
         keys.add(key)
@@ -65,7 +77,7 @@ class Genexample {
       // it already exists (which means the user might have it modified a way in which they prefer, so replace exampleSrc with their existing .env.example)
       exampleSrc = fsx.readFileXSync(this.exampleFilepath)
 
-      const parsed = dotenvParse(exampleSrc)
+      const parsed = finalValues(exampleSrc)
       for (const key of [...keys]) {
         if (key in parsed) {
           preExisted[key] = parsed[key]

package/src/lib/services/prebuild.js

@@ -5,8 +5,8 @@ const ignore = require('ignore')
 
 const Ls = require('../services/ls')
 const Errors = require('../helpers/errors')
+const { sealed } = require('@dotenvx/primitives')
 
-const isFullyEncrypted = require('./../helpers/isFullyEncrypted')
 const MISSING_DOCKERIGNORE = '.env.keys' // by default only ignore .env.keys. all other .env* files COULD be included - as long as they are encrypted
 
 class Prebuild {
@@ -54,7 +54,7 @@ class Prebuild {
       } else {
         if (file !== '.env.example' && file !== '.env.x') {
           const src = fsx.readFileXSync(file)
-          const encrypted = isFullyEncrypted(src)
+          const encrypted = sealed(src)
 
           // if contents are encrypted don't raise an error
           if (!encrypted) {

package/src/lib/services/precommit.js

@@ -4,8 +4,8 @@ const path = require('path')
 const ignore = require('ignore')
 
 const Ls = require('../services/ls')
+const { sealed } = require('@dotenvx/primitives')
 
-const isFullyEncrypted = require('./../helpers/isFullyEncrypted')
 const InstallPrecommitHook = require('./../helpers/installPrecommitHook')
 const Errors = require('./../helpers/errors')
 const childProcess = require('child_process')
@@ -70,7 +70,7 @@ class Precommit {
           } else {
             if (file !== '.env.example' && file !== '.env.x') {
               const src = fsx.readFileXSync(file)
-              const encrypted = isFullyEncrypted(src)
+              const encrypted = sealed(src)
 
               // if contents are encrypted don't raise an error
               if (!encrypted) {

package/src/lib/services/rotate.js

@@ -1,7 +1,7 @@
 const fsx = require('./../helpers/fsx')
 const path = require('path')
 const picomatch = require('picomatch')
-const { encrypted } = require('@dotenvx/primitives')
+const { encrypted, scan } = require('@dotenvx/primitives')
 
 const TYPE_ENV_FILE = 'envFile'
 
@@ -25,7 +25,6 @@ const {
 
 const append = require('./../helpers/append')
 const replace = require('./../helpers/replace')
-const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 
 class Rotate {
@@ -81,7 +80,7 @@ class Rotate {
     try {
       const encoding = await detectEncoding(filepath)
       let envSrc = await fsx.readFileX(filepath, { encoding })
-      const envParsed = dotenvParse(envSrc, false, false, true)
+      const envParsed = scan(envSrc).parsed
 
       const { publicKeyName, privateKeyName } = keyNamesForEnvFile(envFilepath)
       const { privateKeyValue } = await keyValues(envFilepath, {

package/src/lib/services/sets.js

@@ -1,6 +1,6 @@
 const fsx = require('./../helpers/fsx')
 const path = require('path')
-const { encrypted } = require('@dotenvx/primitives')
+const { encrypted, scan } = require('@dotenvx/primitives')
 
 const TYPE_ENV_FILE = 'envFile'
 
@@ -25,12 +25,16 @@ const {
 } = require('./../helpers/cryptography')
 
 const replace = require('./../helpers/replace')
-const dotenvParse = require('./../helpers/dotenvParse')
 const detectEncoding = require('./../helpers/detectEncoding')
 const detectEncodingSync = require('./../helpers/detectEncodingSync')
 
 function allValuesForKey (envSrc, key) {
-  return dotenvParse(envSrc, false, false, true)[key] || []
+  return scan(envSrc).parsed[key] || []
+}
+
+function finalValueForKey (envSrc, key) {
+  const values = allValuesForKey(envSrc, key)
+  return values.length > 0 ? values[values.length - 1] : null
 }
 
 class Sets {
@@ -119,8 +123,7 @@ class Sets {
         seededWithInitialKey = true
       }
 
-      const envParsed = dotenvParse(envSrc)
-      row.originalValue = envParsed[row.key] || null
+      row.originalValue = finalValueForKey(envSrc, row.key)
       if (seededWithInitialKey) {
         row.originalValue = null
       }
@@ -236,8 +239,7 @@ class Sets {
         seededWithInitialKey = true
       }
 
-      const envParsed = dotenvParse(envSrc)
-      row.originalValue = envParsed[row.key] || null
+      row.originalValue = finalValueForKey(envSrc, row.key)
       if (seededWithInitialKey) {
         row.originalValue = null
       }

package/src/lib/helpers/dotenvParse.js

@@ -1,55 +0,0 @@
-// historical dotenv.parse - https://github.com/motdotla/dotenv)
-const LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg
-
-function dotenvParse (src, skipExpandForDoubleQuotes = false, skipConvertingWindowsNewlines = false, collectAllValues = false) {
-  const obj = {}
-
-  // Convert buffer to string
-  let lines = src.toString()
-
-  // Convert line breaks to same format
-  if (!skipConvertingWindowsNewlines) {
-    lines = lines.replace(/\r\n?/mg, '\n')
-  }
-
-  let match
-  while ((match = LINE.exec(lines)) != null) {
-    const key = match[1]
-
-    // Default undefined or null to empty string
-    let value = (match[2] || '')
-
-    // Remove whitespace
-    value = value.trim()
-
-    // Check if double quoted
-    const maybeQuote = value[0]
-
-    // Remove surrounding quotes
-    value = value.replace(/^(['"`])([\s\S]*)\1$/mg, '$2')
-
-    // Expand newlines if double quoted
-    if (maybeQuote === '"' && !skipExpandForDoubleQuotes) {
-      value = value.replace(/\\n/g, '\n') // newline
-      value = value.replace(/\\r/g, '\r') // carriage return
-      value = value.replace(/\\t/g, '\t') // tabs
-    }
-
-    if (collectAllValues) {
-      // handle scenario where user mistakenly includes plaintext duplicate in .env:
-      //
-      // # .env
-      // HELLO="World"
-      // HELLO="encrypted:1234"
-      obj[key] = obj[key] || []
-      obj[key].push(value)
-    } else {
-      // Add to object
-      obj[key] = value
-    }
-  }
-
-  return obj
-}
-
-module.exports = dotenvParse

package/src/lib/helpers/isFullyEncrypted.js

@@ -1,27 +0,0 @@
-const { encrypted } = require('@dotenvx/primitives')
-const dotenvParse = require('./dotenvParse')
-const isPublicKey = require('./cryptography/isPublicKey')
-
-function isFullyEncrypted (src) {
-  const parsed = dotenvParse(src, false, false, true) // collect all values
-
-  for (const [key, values] of Object.entries(parsed)) {
-    // handle scenario where user mistakenly includes plaintext duplicate in .env:
-    //
-    // # .env
-    // HELLO="World"
-    // HELLO="encrypted:1234"
-    //
-    // key => [value1, ...]
-    for (const value of values) {
-      const result = encrypted(value) || isPublicKey(key)
-      if (!result) {
-        return false
-      }
-    }
-  }
-
-  return true
-}
-
-module.exports = isFullyEncrypted