@dotenvx/dotenvx 2.1.1 → 2.1.3

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.1.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.1.3...main)
+
+## [2.1.3](https://github.com/dotenvx/dotenvx/compare/v2.1.2...v2.1.3) (2026-07-02)
+
+### Changed
+
+* Patch edge case when custom unspecified `-f` and `--env` flag ([#868](https://github.com/dotenvx/dotenvx/pull/868))
+
+## [2.1.2](https://github.com/dotenvx/dotenvx/compare/v2.1.1...v2.1.2) (2026-07-02)
+
+### Changed
+
+* Support restricted read permissions to `.env.keys` ([#676](https://github.com/dotenvx/dotenvx/issues/676), [#867](https://github.com/dotenvx/dotenvx/pull/867))
 
 ## [2.1.1](https://github.com/dotenvx/dotenvx/compare/v2.1.0...v2.1.1) (2026-07-02)
 

package/README.md

@@ -672,6 +672,13 @@ $ dotenvx run -f .env.production --quiet -- node index.js
 Hello production
 ```
 
+You can also set `DOTENV_CONFIG_QUIET=true`.
+
+```sh
+$ DOTENV_CONFIG_QUIET=true dotenvx run -f .env.production -- node index.js
+Hello production
+```
+
 </details>
 <details><summary>`--log-level` flag</summary><br>
 
@@ -723,6 +730,22 @@ $ dotenvx encrypt
 
 > A `DOTENV_PUBLIC_KEY` (encryption key) and a `DOTENV_PRIVATE_KEY` (decryption key) are generated using the same public-key cryptography as [Bitcoin](https://en.bitcoin.it/wiki/Secp256k1).
 
+### Protect `.env.keys` from agents
+
+After encryption, `DOTENV_PUBLIC_KEY` lives in your encrypted `.env` file. This means agents and automation can keep running `dotenvx set` and `dotenvx encrypt` without reading `.env.keys`.
+
+```sh
+$ chmod a-r .env.keys
+
+$ dotenvx set HELLO World
+◈ encrypted HELLO (.env)
+
+$ dotenvx encrypt
+◈ encrypted (.env)
+```
+
+Keep `.env.keys` unreadable by agents, while still letting them safely update encrypted values.
+
 More examples
 
 <details><summary>`.env`</summary><br>
@@ -1231,6 +1254,13 @@ $ dotenvx run -f .env.production --quiet -- node index.js
 Hello production
 ```
 
+You can also set `DOTENV_CONFIG_QUIET=true`.
+
+```sh
+$ DOTENV_CONFIG_QUIET=true dotenvx run -f .env.production -- node index.js
+Hello production
+```
+
 </details>
 <details><summary>`run --log-level`</summary><br>
 
@@ -1572,6 +1602,8 @@ $ dotenvx set HELLO Dotenvx
 set HELLO with encryption (.env)
 ```
 
+Works with unreadable `.env.keys` when `.env` already contains `DOTENV_PUBLIC_KEY`.
+
 </details>
 <details><summary>`set KEY value -f`</summary><br>
 
@@ -1646,6 +1678,20 @@ $ dotenvx set HELLO Dotenvx --plain
 set HELLO (.env)
 ```
 
+</details>
+<details><summary>`set KEY_PLAIN value`</summary><br>
+
+Set a plaintext key/value inside an encrypted `.env` file by ending the key with `_PLAIN`.
+
+```sh
+$ touch .env
+
+$ dotenvx set HELLO_PLAIN Dotenvx
+set HELLO_PLAIN (.env)
+```
+
+Keys ending in `_PLAIN` are not encrypted by `dotenvx set` or `dotenvx encrypt`.
+
 </details>
 <details><summary>`encrypt`</summary><br>
 
@@ -1660,6 +1706,8 @@ $ dotenvx encrypt
 ⮕  next run [DOTENV_PRIVATE_KEY='122...0b8' dotenvx run -- yourcommand] to test decryption locally
 ```
 
+Works with unreadable `.env.keys` when `.env` already contains `DOTENV_PUBLIC_KEY`.
+
 </details>
 <details><summary>`encrypt -f`</summary><br>
 
@@ -1755,6 +1803,20 @@ $ dotenvx encrypt -ek "HO*"
 ◈ encrypted (.env)
 ```
 
+</details>
+<details><summary>`encrypt KEY_PLAIN`</summary><br>
+
+Skip encryption for keys ending in `_PLAIN`.
+
+```sh
+$ echo "HELLO=Dotenvx\nHELLO_PLAIN=visible" > .env
+
+$ dotenvx encrypt
+◈ encrypted (.env)
+```
+
+`HELLO` is encrypted. `HELLO_PLAIN` stays plaintext.
+
 </details>
 <details><summary>`encrypt --stdout`</summary><br>
 
@@ -2398,6 +2460,14 @@ Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)
 Hello Dotenvx
 ```
 
+You can also set `DOTENV_CONFIG_QUIET=true`.
+
+```sh
+$ DOTENV_CONFIG_QUIET=true node index.js
+Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)
+Hello Dotenvx
+```
+
 </details>
 <details><summary>`config(strict: true)` - strict</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.1.1",
+  "version": "2.1.3",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/lib/helpers/envResolution/determine.js

@@ -17,13 +17,16 @@ function envsFromDotenvPrivateKey (privateKeyNames) {
 
 function determine (envs = [], processEnv) {
   const privateKeyNames = dotenvPrivateKeyNames(processEnv)
-  if (!envs || envs.length <= 0) {
-    // if process.env.DOTENV_PRIVATE_KEY or process.env.DOTENV_PRIVATE_KEY_${environment} is set, assume inline encryption methodology
-    if (privateKeyNames.length > 0) {
-      return envsFromDotenvPrivateKey(privateKeyNames)
-    }
 
-    return DEFAULT_ENVS // default to .env file expectation
+  // https://github.com/dotenvx/dotenvx/issues/670
+  let defaults = DEFAULT_ENVS // default to .env file expectation
+  // if process.env.DOTENV_PRIVATE_KEY or process.env.DOTENV_PRIVATE_KEY_${environment} is set, assume inline encryption methodology
+  if (privateKeyNames.length > 0) {
+    defaults = envsFromDotenvPrivateKey(privateKeyNames)
+  }
+
+  if (!envs || envs.length <= 0) {
+    return defaults
   } else {
     let fileAlreadySpecified = false
 
@@ -39,7 +42,7 @@ function determine (envs = [], processEnv) {
     }
 
     // no .env file specified as a flag so default to .env
-    return [...DEFAULT_ENVS, ...envs]
+    return [...defaults, ...envs]
   }
 }
 

package/src/lib/transforms/encrypt.js

@@ -45,8 +45,16 @@ async function encryptTransform (options = {}) {
   // set up keysSrc
   let keysSrc
   if (await fsx.exists(fk)) {
-    const encoding = await detectEncoding(fk)
-    keysSrc = await fsx.readFileX(fk, { encoding })
+    try {
+      const encoding = await detectEncoding(fk)
+      keysSrc = await fsx.readFileX(fk, { encoding })
+    } catch (err) {
+      if (err.code === 'EACCES' || err.code === 'EPERM') {
+        // do nothing (scenario: chmod a-r .env.keys)
+      } else {
+        throw err
+      }
+    }
   }
 
   for (const env of determine(envs, process.env)) {

package/src/lib/transforms/set.js

@@ -46,8 +46,16 @@ async function setTransform (options = {}) {
   // set up keysSrc
   let keysSrc
   if (await fsx.exists(fk)) {
-    const encoding = await detectEncoding(fk)
-    keysSrc = await fsx.readFileX(fk, { encoding })
+    try {
+      const encoding = await detectEncoding(fk)
+      keysSrc = await fsx.readFileX(fk, { encoding })
+    } catch (err) {
+      if (err.code === 'EACCES' || err.code === 'EPERM') {
+        // do nothing (scenario: chmod a-r .env.keys)
+      } else {
+        throw err
+      }
+    }
   }
 
   for (const env of determine(envs, process.env)) {