@dotenvx/dotenvx 2.16.1 → 2.17.1

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.16.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.17.1...main)
+
+## [2.17.1](https://github.com/dotenvx/dotenvx/compare/v2.17.0...v2.17.1) (2026-07-21)
+
+### Changed
+
+* Handle `ctrl + c` better ([#916](https://github.com/dotenvx/dotenvx/pull/916))
+
+## [2.17.0](https://github.com/dotenvx/dotenvx/compare/v2.16.1...v2.17.0) (2026-07-21)
+
+### Added
+
+* Add support for Bitwarden `bw://` secrets in your .env files. ([#915](https://github.com/dotenvx/dotenvx/pull/915))
 
 ## [2.16.1](https://github.com/dotenvx/dotenvx/compare/v2.16.0...v2.16.1) (2026-07-21)
 

package/README.md

@@ -166,6 +166,19 @@ Hello World
 
 see [1Password guide](https://dotenvx.com/docs/secrets-in-1password)
 
+</details>
+<details><summary>Bitwarden 🛡️</summary><br>
+
+Run with secrets resolved directly from Bitwarden Password Manager.
+
+```sh
+$ echo 'HELLO="bw://My Hello Login/password"' > .env
+$ dotenvx run -- sh -c 'echo Hello $HELLO'
+Hello World
+```
+
+Install the [Bitwarden Password Manager CLI](https://bitwarden.com/help/cli/) before running dotenvx.
+
 </details>
 <details><summary>TypeScript 📘</summary><br>
 
@@ -1193,6 +1206,38 @@ $ dotenvx run --no-1password -- node index.js
 
 The same flag is available for `dotenvx get` and `dotenvx validate`.
 
+</details>
+<details><summary>`run` - Bitwarden</summary><br>
+
+Resolve `bw://` references directly from your `.env` file through the [Bitwarden Password Manager CLI](https://bitwarden.com/help/cli/).
+
+```ini
+# .env
+API_KEY="bw://My GitHub Account/password"
+```
+
+The reference format is `bw://<item>/<field>`. The item can be a human-readable Bitwarden search term or an exact item UUID. Quote the dotenv value when the item name contains spaces.
+
+Supported fields are:
+
+- `username`
+- `password`
+- `uri`
+
+When the vault is locked in an interactive terminal, dotenvx prompts for your Bitwarden master password.
+
+Human-readable names are convenient, but must identify a single item. If multiple items match, Bitwarden returns an error. Use the item UUID when you need an unambiguous reference.
+
+If Bitwarden cannot resolve a reference, dotenvx reports the error and leaves the original `bw://` value unresolved.
+
+Use `--no-bitwarden` to skip Bitwarden resolution intentionally.
+
+```sh
+$ dotenvx run --no-bitwarden -- node index.js
+```
+
+The same flag is available for `dotenvx get` and `dotenvx validate`.
+
 </details>
 <details><summary>`run -f <directory>`</summary><br>
 
@@ -3310,6 +3355,30 @@ Set `no1Password` to leave `op://` values unresolved and avoid calling `op`.
 require('@dotenvx/dotenvx').config({no1Password: true})
 ```
 
+</details>
+<details><summary>`config(noBitwarden:)` - noBitwarden</summary><br>
+
+By default, `config()` automatically resolves `bw://` values through the installed [Bitwarden Password Manager CLI](https://bitwarden.com/help/cli/).
+
+```ini
+# .env
+API_KEY="bw://My GitHub Account/password"
+```
+
+```js
+// index.js
+require('@dotenvx/dotenvx').config()
+
+console.log(process.env.API_KEY)
+```
+
+Set `noBitwarden` to leave `bw://` values unresolved and avoid calling `bw`.
+
+```js
+// index.js
+require('@dotenvx/dotenvx').config({noBitwarden: true})
+```
+
 </details>
 <details><summary>`parse(src)`</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.16.1",
+  "version": "2.17.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -53,7 +53,7 @@
   "funding": "https://dotenvx.com",
   "dependencies": {
     "@dotenvx/primitives": "^2.1.0",
-    "@dotenvx/tooling": "^1.0.2",
+    "@dotenvx/tooling": "^1.0.3",
     "yocto-spinner": "^1.2.1"
   },
   "devDependencies": {

package/src/cli/actions/get.js

@@ -120,6 +120,10 @@ async function get (key) {
     }
   } catch (error) {
     if (spinner) spinner.stop()
+    if (error.code === 'PROMPT_CANCELLED') {
+      process.exit(130)
+      return
+    }
     catchAndLog(error)
     process.exit(1)
   }

package/src/cli/actions/run.js

@@ -210,6 +210,10 @@ async function run () {
     logger.success(`⟐ ${msg}`)
   } catch (error) {
     if (spinner) spinner.stop()
+    if (error.code === 'PROMPT_CANCELLED') {
+      process.exit(130)
+      return
+    }
     catchAndLog(error)
     process.exit(1)
   }

package/src/lib/helpers/resolveBitwardenPassword.js

@@ -5,7 +5,6 @@ const createSpinner = require('./createSpinner')
 const createElapsedStatus = require('./createElapsedStatus')
 
 const FIELDS = new Set(['username', 'password', 'uri'])
-const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 
 function execFileAsync (command, args, options) {
   return new Promise((resolve, reject) => {
@@ -21,9 +20,12 @@ function isSecretReference (value) {
 }
 
 function parseSecretReference (value) {
-  const [itemId, field, ...extra] = value.slice('bw://'.length).split('/')
+  const reference = value.slice('bw://'.length)
+  const separatorIndex = reference.lastIndexOf('/')
+  const item = reference.slice(0, separatorIndex)
+  const field = reference.slice(separatorIndex + 1)
 
-  if (!UUID.test(itemId) || !field || extra.length > 0) {
+  if (separatorIndex < 1 || !field) {
     throw new Error('invalid Bitwarden Password Manager reference')
   }
 
@@ -31,7 +33,7 @@ function parseSecretReference (value) {
     throw new Error(`unsupported Bitwarden Password Manager field ${field}`)
   }
 
-  return { itemId, field }
+  return { item, field }
 }
 
 async function session (options) {
@@ -105,19 +107,19 @@ async function resolveBitwardenPassword (parsed, options = {}) {
       if (!isSecretReference(value)) continue
 
       try {
-        const { itemId, field } = parseSecretReference(value)
+        const { item, field } = parseSecretReference(value)
         if (options.session) startStatus()
         const bwSession = await session(options)
-        const stdout = await execFileAsync('bw', ['get', field, itemId], {
+        const stdout = await execFileAsync('bw', ['get', field, item], {
           encoding: 'utf8',
           windowsHide: true,
           env: { ...process.env, BW_SESSION: bwSession }
         })
         parsed[key] = secretValue(stdout)
       } catch (error) {
+        if (error && error.code === 'PROMPT_CANCELLED') throw error
         errors.push(resolutionError(key, error))
         unresolved.push(key)
-        delete parsed[key]
       }
     }
   } finally {
@@ -138,13 +140,13 @@ function resolveBitwardenPasswordSync (parsed) {
     if (!isSecretReference(value)) continue
 
     try {
-      const { itemId, field } = parseSecretReference(value)
+      const { item, field } = parseSecretReference(value)
       if (!process.env.BW_SESSION) {
         const error = new Error('Bitwarden Password Manager requires an unlocked BW_SESSION')
         error.code = 'BW_SESSION_MISSING'
         throw error
       }
-      const stdout = execFileSync('bw', ['get', field, itemId], {
+      const stdout = execFileSync('bw', ['get', field, item], {
         encoding: 'utf8',
         windowsHide: true,
         stdio: ['ignore', 'pipe', 'pipe']
@@ -153,7 +155,6 @@ function resolveBitwardenPasswordSync (parsed) {
     } catch (error) {
       errors.push(resolutionError(key, error))
       unresolved.push(key)
-      delete parsed[key]
     }
   }
 

package/src/lib/helpers/resolveOnePassword.js

@@ -44,7 +44,6 @@ async function resolveOnePassword (parsed, options = {}) {
       } catch (error) {
         errors.push(resolutionError(key, error))
         unresolved.push(key)
-        delete parsed[key]
       }
     }
   } finally {
@@ -73,7 +72,6 @@ function resolveOnePasswordSync (parsed) {
     } catch (error) {
       errors.push(resolutionError(key, error))
       unresolved.push(key)
-      delete parsed[key]
     }
   }
 

package/src/lib/resolvers/envs.js

@@ -106,20 +106,19 @@ async function injectEnv ({ env, overload, processEnv, envKeysFilepath, provider
     if (!no1Password) {
       const result = await resolveOnePassword(row.injected, { onStatus })
       row.errors.push(...result.errors)
-      for (const key of result.unresolved) delete row.parsed[key]
       Object.assign(row.parsed, row.injected)
     }
 
     if (!noBitwarden) {
       const passwordResult = await resolveBitwardenPassword(row.injected, { onStatus })
       row.errors.push(...passwordResult.errors)
-      for (const key of passwordResult.unresolved) delete row.parsed[key]
 
       Object.assign(row.parsed, row.injected)
     }
 
     inject(processEnv, row.parsed)
   } catch (e) {
+    if (e.code === 'PROMPT_CANCELLED') throw e
     row.errors = [e]
   }
 
@@ -160,14 +159,12 @@ function injectEnvSync ({ env, overload, processEnv, envKeysFilepath, provider,
     if (!no1Password) {
       const result = resolveOnePassword.sync(row.injected)
       row.errors.push(...result.errors)
-      for (const key of result.unresolved) delete row.parsed[key]
       Object.assign(row.parsed, row.injected)
     }
 
     if (!noBitwarden) {
       const passwordResult = resolveBitwardenPassword.sync(row.injected)
       row.errors.push(...passwordResult.errors)
-      for (const key of passwordResult.unresolved) delete row.parsed[key]
 
       Object.assign(row.parsed, row.injected)
     }
@@ -217,20 +214,19 @@ async function injectEnvFile ({ env, overload, processEnv, envKeysFilepath, prov
     if (!no1Password) {
       const result = await resolveOnePassword(row.injected, { onStatus })
       row.errors.push(...result.errors)
-      for (const key of result.unresolved) delete row.parsed[key]
       Object.assign(row.parsed, row.injected)
     }
 
     if (!noBitwarden) {
       const passwordResult = await resolveBitwardenPassword(row.injected, { onStatus })
       row.errors.push(...passwordResult.errors)
-      for (const key of passwordResult.unresolved) delete row.parsed[key]
 
       Object.assign(row.parsed, row.injected)
     }
 
     inject(processEnv, parsed)
   } catch (e) {
+    if (e.code === 'PROMPT_CANCELLED') throw e
     if (e.code === 'ENOENT' || e.code === 'EISDIR') {
       row.errors = [new Errors({ envFilepath: env.value, filepath }).missingEnvFile()]
     } else {
@@ -278,14 +274,12 @@ function injectEnvFileSync ({ env, overload, processEnv, envKeysFilepath, provid
     if (!no1Password) {
       const result = resolveOnePassword.sync(row.injected)
       row.errors.push(...result.errors)
-      for (const key of result.unresolved) delete row.parsed[key]
       Object.assign(row.parsed, row.injected)
     }
 
     if (!noBitwarden) {
       const passwordResult = resolveBitwardenPassword.sync(row.injected)
       row.errors.push(...passwordResult.errors)
-      for (const key of passwordResult.unresolved) delete row.parsed[key]
 
       Object.assign(row.parsed, row.injected)
     }