@dotenvx/dotenvx 2.19.2 → 2.20.1

package/CHANGELOG.md

@@ -2,13 +2,23 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.19.2...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.20.1...main)
 
-## [2.19.2](https://github.com/dotenvx/dotenvx/compare/v2.19.1...v2.19.2) (2026-08-03)
+## [2.20.1](https://github.com/dotenvx/dotenvx/compare/v2.20.0...v2.20.1) (2026-08-07)
 
 ### Changed
 
-* Example `.env.vault` from precommit ([#935](https://github.com/dotenvx/dotenvx/pull/935))
+* Handle accent marks for `ext precommit` ([#936](https://github.com/dotenvx/dotenvx/pull/936))
+
+## [2.20.0](https://github.com/dotenvx/dotenvx/compare/v2.19.1...v2.20.0) (2026-08-07)
+
+### Added
+
+* Add `dotenvx del` command for deleting a key from a .env file ([#939](https://github.com/dotenvx/dotenvx/pull/939))
+
+### Changed
+
+* Exempt `.env.vault` from `precommit`/`prebuild` sealed checks (vault-format ciphertext is already safe to commit)
 
 ## [2.19.1](https://github.com/dotenvx/dotenvx/compare/v2.19.0...v2.19.1) (2026-07-29)
 

package/README.md

@@ -2211,6 +2211,30 @@ Do not create a missing `.env` file.
 $ dotenvx set HELLO World -f .env.production --no-create
 ```
 
+</details>
+<details><summary>`del KEY`</summary><br>
+
+Delete a key from your `.env` file.
+
+```sh
+$ echo "HELLO=World" > .env
+
+$ dotenvx del HELLO
+◇ removed HELLO (.env)
+```
+
+</details>
+<details><summary>`del KEY -f`</summary><br>
+
+Delete a key from another `.env` file.
+
+```sh
+$ echo "HELLO=production" > .env.production
+
+$ dotenvx del HELLO -f .env.production
+◇ removed HELLO (.env.production)
+```
+
 </details>
 <details><summary>`encrypt`</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.19.2",
+  "version": "2.20.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -52,7 +52,7 @@
   },
   "funding": "https://dotenvx.com",
   "dependencies": {
-    "@dotenvx/primitives": "^2.1.1",
+    "@dotenvx/primitives": "^2.2.0",
     "@dotenvx/tooling": "^1.0.3",
     "yocto-spinner": "^1.2.1"
   },
@@ -67,7 +67,7 @@
     "tap": "^21.7.4"
   },
   "overrides": {
-    "brace-expansion": "^5.0.8",
+    "brace-expansion": "^5.0.9",
     "minimatch": "^10.2.5"
   },
   "publishConfig": {

package/src/cli/actions/del.js

@@ -0,0 +1,56 @@
+const fsx = require('./../../lib/helpers/fsx')
+const { logger } = require('./../../shared/logger')
+
+const delTransform = require('./../../lib/transforms/del')
+
+const catchAndLog = require('../../lib/helpers/catchAndLog')
+const createSpinner = require('../../lib/helpers/createSpinner')
+
+async function del (key) {
+  const options = this.opts()
+  const spinnerOptions = typeof this.optsWithGlobals === 'function' ? this.optsWithGlobals() : options
+  const spinner = await createSpinner({ ...spinnerOptions, ...options, text: 'deleting' })
+
+  logger.debug(`key: ${key}`)
+  logger.debug(`options: ${JSON.stringify(options)}`)
+
+  const envs = this.envs || []
+
+  let errorCount = 0
+
+  try {
+    const { processedEnvs, changedFilepaths, unchangedFilepaths } = await delTransform({ envs, key })
+
+    if (spinner) spinner.stop()
+    for (const processedEnv of processedEnvs) {
+      logger.verbose(`deleting for ${processedEnv.envFilepath}`)
+      if (processedEnv.error) {
+        errorCount += 1
+        logger.error(processedEnv.error.messageWithHelp || processedEnv.error.message)
+      } else if (processedEnv.changed) {
+        await fsx.writeFileX(processedEnv.filepath, processedEnv.envSrc)
+        logger.verbose(`${processedEnv.key} deleted (${processedEnv.envFilepath})`)
+      } else {
+        logger.verbose(`no change ${processedEnv.envFilepath} (${processedEnv.filepath})`)
+      }
+    }
+
+    if (changedFilepaths.length > 0) {
+      logger.success(`◇ removed ${key} (${changedFilepaths.join(',')})`)
+    } else if (unchangedFilepaths.length > 0) {
+      logger.info(`○ no change (${unchangedFilepaths})`)
+    } else {
+      // do nothing - scenario when no .env files found
+    }
+
+    if (errorCount > 0) {
+      process.exit(1)
+    }
+  } catch (error) {
+    if (spinner) spinner.stop()
+    catchAndLog(error)
+    process.exit(1)
+  }
+}
+
+module.exports = del

package/src/cli/dotenvx.js

@@ -129,6 +129,18 @@ program.command('set')
     return require('./actions/set').apply(this, args)
   })
 
+// dotenvx del
+program.command('del')
+  .usage('<KEY> [options]')
+  .description('delete a single environment variable')
+  .addHelpText('after', help.del)
+  .argument('KEY', 'KEY')
+  .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
+  .action(function (...args) {
+    this.envs = envs
+    return require('./actions/del').apply(this, args)
+  })
+
 // dotenvx encrypt
 program.command('encrypt')
   .description('encrypt .env file(s)')
@@ -317,7 +329,7 @@ program.addHelpText('after', 'Professional Security: ')
 program.addHelpText('after', '  lock                     ⊡ lock private keys with a local passphrase')
 program.addHelpText('after', '  native                   ⌥ move private keys into your OS secret store')
 program.addHelpText('after', '  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]')
-program.addHelpText('after', '  curl                     ⛨ call authenticated api to Dotenvx Armor [www.dotenvx.com/armor]')
+program.addHelpText('after', '  curl                     ⛨ call authenticated api Dotenvx Armor [www.dotenvx.com/armor]')
 
 // dotenvx native
 require('./commands/native')(program.command('native', { hidden: true }))

package/src/cli/help.js

@@ -90,6 +90,17 @@ Examples:
   `
 }
 
+const del = function () {
+  return `
+Examples:
+
+  \`\`\`
+  $ dotenvx del KEY
+  $ dotenvx del KEY -f .env.production
+  \`\`\`
+  `
+}
+
 const curl = function () {
   return `
 Endpoints:
@@ -130,5 +141,6 @@ module.exports = {
   prebuild,
   gitignore,
   set,
+  del,
   curl
 }

package/src/lib/services/precommit.js

@@ -123,8 +123,11 @@ class Precommit {
         return true
       }
 
-      const output = childProcess.execSync('git diff HEAD --name-only').toString()
-      const files = output.split('\n')
+      // -z separates paths with NUL and prints them verbatim. without it git c-quotes
+      // any path holding non-ascii or special characters ("caf\303\251/.env"), which
+      // never matches filePath - the file would be skipped and its secrets committed.
+      const output = childProcess.execSync('git diff HEAD --name-only -z').toString()
+      const files = output.split('\0')
       return files.includes(filePath)
     } catch (error) {
       // consider file to be committed if there is an error (not using git)

package/src/lib/transforms/del.js

@@ -0,0 +1,58 @@
+const fsx = require('./../helpers/fsx')
+const path = require('path')
+const { remove } = require('@dotenvx/primitives')
+
+const TYPE_ENV_FILE = 'envFile'
+
+const Errors = require('./../helpers/errors')
+const { determine } = require('./../helpers/envResolution')
+const detectEncoding = require('./../helpers/detectEncoding')
+
+async function delTransform (options = {}) {
+  const envs = options.envs || []
+  const key = options.key
+
+  const processedEnvs = []
+  const changedFilepaths = []
+  const unchangedFilepaths = []
+
+  for (const env of determine(envs, process.env)) {
+    if (env.type !== TYPE_ENV_FILE) {
+      continue
+    }
+
+    const envFilepath = env.envFilepath || env.value
+    const filepath = env.filepath || path.resolve(envFilepath)
+    const row = { key, type: TYPE_ENV_FILE, filepath, envFilepath, changed: false }
+
+    try {
+      const encoding = await detectEncoding(filepath)
+      const before = await fsx.readFileX(filepath, { encoding })
+      const after = remove(before, key)
+
+      row.envSrc = after
+      if (after !== before) {
+        row.changed = true
+        changedFilepaths.push(envFilepath)
+      } else {
+        unchangedFilepaths.push(envFilepath)
+      }
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        row.error = new Errors({ envFilepath, filepath }).missingEnvFile()
+      } else {
+        row.error = error
+      }
+    }
+
+    processedEnvs.push(row)
+  }
+
+  return {
+    processedEnvs,
+    changedFilepaths,
+    unchangedFilepaths
+  }
+}
+
+module.exports = delTransform