@dotenvx/dotenvx 2.22.0 → 2.24.0

package/CHANGELOG.md

@@ -2,7 +2,28 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.22.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.24.0...main)
+
+## [2.24.0](https://github.com/dotenvx/dotenvx/compare/v2.23.0...v2.24.0) (2026-09-10)
+
+### Changed
+
+* Do not expand nested commands ([#965](https://github.com/dotenvx/dotenvx/pull/965))
+
+### Removed
+
+* BREAKING: Remove the `-p` shorthand for `--plain`; use `--plain` instead
+
+## [2.23.0](https://github.com/dotenvx/dotenvx/compare/v2.22.0...v2.23.0) (2026-08-31)
+
+### Added
+
+* Support comma-separated env file paths with `-f` and the `config({ path })` option. Example: `dotenvx run -f .env.local,.env -- node index.js`
+* Add `DOTENV_PATH` (or `DOTENV_F`) to support the same. Example: `DOTENV_PATH=.env.local,.env`
+
+### Changed
+
+* Rename `DOTENV_CONFIG_*` variables to `DOTENV_CONVENTION`, `DOTENV_IGNORE`, and `DOTENV_QUIET`, while retaining their existing `DOTENV_CONFIG_*` names as fallbacks
 
 ## [2.22.0](https://github.com/dotenvx/dotenvx/compare/v2.21.0...v2.22.0) (2026-08-27)
 

package/README.md

@@ -747,12 +747,12 @@ $ echo "HELLO=local" > .env.local
 
 $ echo "HELLO=World" > .env
 
-$ dotenvx run -f .env.local -f .env -- node index.js
+$ dotenvx run -f .env.local,.env -- node index.js
 [dotenvx@1.X.X] injecting env (1) from .env.local,.env
 Hello local
 ```
 
-Note subsequent files do NOT override pre-existing variables defined in previous files or env. This follows historic principle. For example, above `local` wins – from the first file.
+Comma-separate multiple files after a single `-f`. Subsequent files do NOT override pre-existing variables defined in previous files or env. This follows historic principle. For example, above `local` wins – from the first file.
 
 </details>
 
@@ -763,7 +763,7 @@ $ echo "HELLO=local" > .env.local
 
 $ echo "HELLO=World" > .env
 
-$ dotenvx run -f .env.local -f .env --overload -- node index.js
+$ dotenvx run -f .env.local,.env --overload -- node index.js
 [dotenvx@1.X.X] injecting env (1) from .env.local,.env
 Hello World
 ```
@@ -814,10 +814,10 @@ $ dotenvx run -f .env.production --quiet -- node index.js
 Hello production
 ```
 
-You can also set `DOTENV_CONFIG_QUIET=true`.
+You can also set `DOTENV_QUIET=true`.
 
 ```sh
-$ DOTENV_CONFIG_QUIET=true dotenvx run -f .env.production -- node index.js
+$ DOTENV_QUIET=true dotenvx run -f .env.production -- node index.js
 Hello production
 ```
 
@@ -1267,7 +1267,7 @@ Hello World
 ```
 
 </details>
-<details><summary>`run` - multiple `-f` flags</summary><br>
+<details><summary>`run -f` - multiple files</summary><br>
 
 Compose multiple `.env` files for environment variables loading, as you need.
 
@@ -1276,12 +1276,12 @@ $ echo "HELLO=local" > .env.local
 $ echo "HELLO=World" > .env
 $ echo "console.log('Hello ' + process.env.HELLO)" > index.js
 
-$ dotenvx run -f .env.local -f .env -- node index.js
+$ dotenvx run -f .env.local,.env -- node index.js
 [dotenvx@1.X.X] injecting env (1) from .env.local, .env
 Hello local
 ```
 
-Note subsequent files do NOT override pre-existing variables defined in previous files or env. This follows historic principle. For example, above `local` wins – from the first file.
+Comma-separate multiple files after a single `-f`. Subsequent files do NOT override pre-existing variables defined in previous files or env. This follows historic principle. For example, above `local` wins – from the first file.
 
 </details>
 <details><summary>`run --env HELLO=String`</summary><br>
@@ -1371,7 +1371,7 @@ $ echo "HELLO=local" > .env.local
 $ echo "HELLO=World" > .env
 $ echo "console.log('Hello ' + process.env.HELLO)" > index.js
 
-$ dotenvx run -f .env.local -f .env --overload -- node index.js
+$ dotenvx run -f .env.local,.env --overload -- node index.js
 [dotenvx@1.X.X] injecting env (1) from .env.local, .env
 Hello World
 ```
@@ -1530,10 +1530,10 @@ $ dotenvx run -f .env.production --quiet -- node index.js
 Hello production
 ```
 
-You can also set `DOTENV_CONFIG_QUIET=true`.
+You can also set `DOTENV_QUIET=true`.
 
 ```sh
-$ DOTENV_CONFIG_QUIET=true dotenvx run -f .env.production -- node index.js
+$ DOTENV_QUIET=true dotenvx run -f .env.production -- node index.js
 Hello production
 ```
 
@@ -1603,10 +1603,10 @@ $ dotenvx run -f .env.missing --ignore=MISSING_ENV_FILE -- node index.js
 ...
 ```
 
-You can also set `DOTENV_CONFIG_IGNORE="MISSING_ENV_FILE"`. It is parsed as a comma-separated list.
+You can also set `DOTENV_IGNORE="MISSING_ENV_FILE"`. It is parsed as a comma-separated list.
 
 ```sh
-$ DOTENV_CONFIG_IGNORE="MISSING_ENV_FILE,OTHER_ERROR_CODE" dotenvx run -f .env.missing -- node index.js
+$ DOTENV_IGNORE="MISSING_ENV_FILE,OTHER_ERROR_CODE" dotenvx run -f .env.missing -- node index.js
 ```
 </details>
 <details><summary>`run --convention=nextjs`</summary><br>
@@ -1625,10 +1625,10 @@ $ dotenvx run --convention=nextjs -- node index.js
 Hello development local
 ```
 
-You can also set `DOTENV_CONFIG_CONVENTION=nextjs`.
+You can also set `DOTENV_CONVENTION=nextjs`.
 
 ```sh
-$ DOTENV_CONFIG_CONVENTION=nextjs dotenvx run -- node index.js
+$ DOTENV_CONVENTION=nextjs dotenvx run -- node index.js
 [dotenvx@1.X.X] injecting env (1) from .env.development.local, .env.local, .env.development, .env
 Hello development local
 ```
@@ -1663,10 +1663,10 @@ $ NODE_ENV=development dotenvx run --convention=flow -- node index.js
 Hello development local
 ```
 
-You can also set `DOTENV_CONFIG_CONVENTION=flow`.
+You can also set `DOTENV_CONVENTION=flow`.
 
 ```sh
-$ NODE_ENV=development DOTENV_CONFIG_CONVENTION=flow dotenvx run -- node index.js
+$ NODE_ENV=development DOTENV_CONVENTION=flow dotenvx run -- node index.js
 [dotenvx@1.X.X] injecting env (1) from .env.development.local, .env.development, .env.local, .env
 Hello development local
 ```
@@ -1794,10 +1794,10 @@ Ignore multiple error codes by separating them with spaces.
 $ dotenvx get HELLO --ignore=MISSING_ENV_FILE MISSING_KEY
 ```
 
-You can also set `DOTENV_CONFIG_IGNORE`. Its value is a comma-separated list.
+You can also set `DOTENV_IGNORE`. Its value is a comma-separated list.
 
 ```sh
-$ DOTENV_CONFIG_IGNORE=MISSING_ENV_FILE,OTHER dotenvx get HELLO
+$ DOTENV_IGNORE=MISSING_ENV_FILE,OTHER dotenvx get HELLO
 ```
 
 </details>
@@ -1887,10 +1887,10 @@ $ dotenvx get HELLO --convention=nextjs
 development local
 ```
 
-You can also set `DOTENV_CONFIG_CONVENTION=nextjs`.
+You can also set `DOTENV_CONVENTION=nextjs`.
 
 ```sh
-$ DOTENV_CONFIG_CONVENTION=nextjs dotenvx get HELLO
+$ DOTENV_CONVENTION=nextjs dotenvx get HELLO
 development local
 ```
 
@@ -1920,10 +1920,10 @@ $ NODE_ENV=development dotenvx get HELLO --convention=flow
 development local
 ```
 
-You can also set `DOTENV_CONFIG_CONVENTION=flow`.
+You can also set `DOTENV_CONVENTION=flow`.
 
 ```sh
-$ NODE_ENV=development DOTENV_CONFIG_CONVENTION=flow dotenvx get HELLO
+$ NODE_ENV=development DOTENV_CONVENTION=flow dotenvx get HELLO
 development local
 ```
 
@@ -2801,10 +2801,10 @@ Ignore multiple error codes by separating them with spaces.
 $ dotenvx validate --ignore=MISSING_ENV_FILE MISSING_ENV_EXAMPLE
 ```
 
-You can also set `DOTENV_CONFIG_IGNORE`. Its value is a comma-separated list.
+You can also set `DOTENV_IGNORE`. Its value is a comma-separated list.
 
 ```sh
-$ DOTENV_CONFIG_IGNORE=MISSING_ENV_FILE,OTHER dotenvx validate
+$ DOTENV_IGNORE=MISSING_ENV_FILE,OTHER dotenvx validate
 ```
 
 </details>
@@ -2833,7 +2833,7 @@ Pass multiple `.env` files to generate your `.env.example` file from the combina
 $ echo "HELLO=World" > .env
 $ echo "DB_HOST=example.com" > .env.production
 
-$ dotenvx genexample -f .env -f .env.production
+$ dotenvx genexample -f .env,.env.production
 ▣ generated (.env.example)
 ```
 
@@ -3413,10 +3413,10 @@ Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)
 Hello World
 ```
 
-You can also set `DOTENV_CONFIG_QUIET=true`.
+You can also set `DOTENV_QUIET=true`.
 
 ```sh
-$ DOTENV_CONFIG_QUIET=true node index.js
+$ DOTENV_QUIET=true node index.js
 Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)
 Hello World
 ```
@@ -3521,10 +3521,10 @@ This is equivalent to using `--convention=nextjs` with the CLI:
 $ dotenvx run --convention=nextjs -- node index.js
 ```
 
-You can also set `DOTENV_CONFIG_CONVENTION=nextjs`.
+You can also set `DOTENV_CONVENTION=nextjs`.
 
 ```sh
-$ DOTENV_CONFIG_CONVENTION=nextjs node index.js
+$ DOTENV_CONVENTION=nextjs node index.js
 ```
 
 </details>
@@ -3727,9 +3727,16 @@ There are global settings available that can be configured as environment variab
 
 ```ini
 # config
-DOTENV_CONFIG_CONVENTION= # set to a default convention like 'nextjs' or 'flow'
-DOTENV_CONFIG_IGNORE= # MISSING_ENV_FILE,OTHER
-DOTENV_CONFIG_QUIET= # set to "true" to default to --quiet
+DOTENV_CONVENTION= # set to a default convention like 'nextjs' or 'flow'
+DOTENV_PATH= # path to your env file; comma-separate multiple paths
+DOTENV_F= # synonym for DOTENV_PATH
+DOTENV_IGNORE= # MISSING_ENV_FILE,OTHER
+DOTENV_QUIET= # set to "true" to default to --quiet
+
+# legacy aliases (still supported)
+DOTENV_CONFIG_CONVENTION=
+DOTENV_CONFIG_IGNORE=
+DOTENV_CONFIG_QUIET=
 
 # armor
 DOTENVX_ARMOR_TOKEN= # for api calls

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.22.0",
+  "version": "2.24.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/get.js

@@ -7,6 +7,7 @@ const Session = require('../../db/session')
 const getResolver = require('./../../lib/resolvers/get')
 const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
 const normalizeDotenvConfigIgnore = require('../../lib/helpers/normalizeDotenvConfigIgnore')
+const normalizeDotenvConfigPath = require('../../lib/helpers/normalizeDotenvConfigPath')
 const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
 const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
 const mask = require('../../lib/helpers/mask')
@@ -26,7 +27,7 @@ async function get (key) {
   const ignore = options.ignore || []
   let errorCount = 0
 
-  const envs = buildCommandEnvs(this.envs, options.convention)
+  const envs = buildCommandEnvs(normalizeDotenvConfigPath(this.envs), options.convention)
 
   try {
     const sesh = new Session()

package/src/cli/actions/run.js

@@ -9,6 +9,7 @@ const Session = require('../../db/session')
 const normalizeDotenvConfigQuiet = require('../../lib/helpers/normalizeDotenvConfigQuiet')
 const normalizeDotenvConfigConvention = require('../../lib/helpers/normalizeDotenvConfigConvention')
 const normalizeDotenvConfigIgnore = require('../../lib/helpers/normalizeDotenvConfigIgnore')
+const normalizeDotenvConfigPath = require('../../lib/helpers/normalizeDotenvConfigPath')
 const buildCommandEnvs = require('../../lib/helpers/buildCommandEnvs')
 const resolveEnvKeysFile = require('../../lib/helpers/resolveEnvKeysFile')
 const mask = require('../../lib/helpers/mask')
@@ -106,7 +107,7 @@ async function run () {
   }
 
   try {
-    let envs = buildCommandEnvs(this.envs, options.convention)
+    let envs = buildCommandEnvs(normalizeDotenvConfigPath(this.envs), options.convention)
     envs = determine(envs, process.env)
 
     const {

package/src/cli/dotenvx.js

@@ -16,8 +16,15 @@ const normalizeDotenvConfigQuiet = require('./../lib/helpers/normalizeDotenvConf
 const envs = []
 function collectEnvs (type) {
   return function (value, previous) {
-    envs.push({ type, value })
-    return (previous || []).concat([value])
+    const values = type === 'envFile'
+      ? value.split(',').map(item => item.trim()).filter(Boolean)
+      : [value]
+
+    for (const item of values) {
+      envs.push({ type, value: item })
+    }
+
+    return (previous || []).concat(values)
   }
 }
 
@@ -120,7 +127,7 @@ program.command('set')
   .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('-c, --encrypt', 'encrypt value', true)
-  .option('-p, --plain', 'store value as plain text', false)
+  .option('--plain', 'store value as plain text', false)
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')

package/src/cli/help.js

@@ -162,8 +162,8 @@ Examples:
   dotenvx curl "https://armor.dotenvx.com/api/teams/TEAM/join_requests/123/decline" --request POST
   dotenvx curl "https://armor.dotenvx.com/api/armor/TEAM/settings/join_requests" --data '{"value":true}'
   dotenvx curl "https://armor.dotenvx.com/api/logs?team=TEAM"
-  dotenvx curl "https://armor.dotenvx.com/api/logs?team=TEAM&events=keypair/access&user=USERNAME&keypair=KEYPAIR_ID&page=1&per=100"
-  dotenvx curl "https://armor.dotenvx.com/api/logs?team=TEAM&user=missing&keypair=missing"
+  dotenvx curl "https://armor.dotenvx.com/api/logs?team=TEAM&action=keypair/access&actor=USERNAME&result=success&resource=keypair/KEYPAIR_ID&page=1&per=100"
+  dotenvx curl "https://armor.dotenvx.com/api/logs?team=TEAM&actor=missing&resource=missing"
   `
 }
 

package/src/lib/helpers/dotenvOptionPaths.js

@@ -5,7 +5,11 @@ function dotenvOptionPaths (options) {
 
   if (options && options.path) {
     if (!Array.isArray(options.path)) {
-      optionPaths = [resolveHome(options.path)]
+      if (typeof options.path === 'string') {
+        optionPaths = options.path.split(',').map(filepath => filepath.trim()).filter(Boolean).map(resolveHome)
+      } else {
+        optionPaths = [resolveHome(options.path)]
+      }
     } else {
       optionPaths = [] // reset default
 

package/src/lib/helpers/executeCommand.js

@@ -108,7 +108,7 @@ async function executeCommand (commandArgs, env, sensitiveValues = []) {
   /* c8 ignore stop */
 
   try {
-    // ensure the first command is expanded
+    // Expand only the executable; child arguments and separators pass through unchanged.
     try {
       commandArgs[0] = path.resolve(which.sync(`${commandArgs[0]}`))
       logger.debug(`expanding process command to [${commandArgs.join(' ')}]`)
@@ -116,22 +116,6 @@ async function executeCommand (commandArgs, env, sensitiveValues = []) {
       logger.debug(`could not expand process command. using [${commandArgs.join(' ')}]`)
     }
 
-    // expand any other commands that follow a --
-    let expandNext = false
-    for (let i = 0; i < commandArgs.length; i++) {
-      if (commandArgs[i] === '--') {
-        expandNext = true
-      } else if (expandNext) {
-        try {
-          commandArgs[i] = path.resolve(which.sync(`${commandArgs[i]}`))
-          logger.debug(`expanding process command to [${commandArgs.join(' ')}]`)
-        } catch (e) {
-          logger.debug(`could not expand process command. using [${commandArgs.join(' ')}]`)
-        }
-        expandNext = false
-      }
-    }
-
     const redactStdout = sensitiveValues.length > 0
     const redactStderr = sensitiveValues.length > 0
     const usePty = redactStdout && Boolean(

package/src/lib/helpers/normalizeDotenvConfigConvention.js

@@ -1,8 +1,10 @@
 function normalizeDotenvConfigConvention (
   /** @type {import('../main').DotenvConfigOptions} */ options
 ) {
-  if (!options.convention && process.env.DOTENV_CONFIG_CONVENTION) {
-    options.convention = process.env.DOTENV_CONFIG_CONVENTION
+  const convention = process.env.DOTENV_CONVENTION || process.env.DOTENV_CONFIG_CONVENTION
+
+  if (!options.convention && convention) {
+    options.convention = convention
   }
 
   return options

package/src/lib/helpers/normalizeDotenvConfigIgnore.js

@@ -1,7 +1,8 @@
 function normalizeDotenvConfigIgnore (
   /** @type {import('../main').DotenvConfigOptions} */ options
 ) {
-  const configIgnore = (process.env.DOTENV_CONFIG_IGNORE || '')
+  const configuredIgnore = process.env.DOTENV_IGNORE ?? process.env.DOTENV_CONFIG_IGNORE ?? ''
+  const configIgnore = configuredIgnore
     .split(',')
     .map(code => code.trim())
     .filter(Boolean)

package/src/lib/helpers/normalizeDotenvConfigPath.js

@@ -0,0 +1,14 @@
+const TYPE_ENV_FILE = 'envFile'
+
+function normalizeDotenvConfigPath (envs = [], processEnv = process.env) {
+  if (envs.some(env => env.type === TYPE_ENV_FILE)) return envs
+
+  const configuredEnvFiles = processEnv.DOTENV_PATH || processEnv.DOTENV_F
+  if (!configuredEnvFiles) return envs
+
+  const envFiles = configuredEnvFiles.split(',').map(value => value.trim()).filter(Boolean)
+
+  return envFiles.map(value => ({ type: TYPE_ENV_FILE, value })).concat(envs)
+}
+
+module.exports = normalizeDotenvConfigPath

package/src/lib/helpers/normalizeDotenvConfigQuiet.js

@@ -1,7 +1,9 @@
 function normalizeDotenvConfigQuiet (
   /** @type {import('../main').DotenvConfigOptions} */ options
 ) {
-  if (process.env.DOTENV_CONFIG_QUIET === 'true') {
+  const quiet = process.env.DOTENV_QUIET ?? process.env.DOTENV_CONFIG_QUIET
+
+  if (quiet === 'true') {
     options.quiet = true
   }
 

package/src/lib/main.js

@@ -27,6 +27,7 @@ const Errors = require('./helpers/errors')
 const normalizeDotenvConfigQuiet = require('./helpers/normalizeDotenvConfigQuiet')
 const normalizeDotenvConfigConvention = require('./helpers/normalizeDotenvConfigConvention')
 const normalizeDotenvConfigIgnore = require('./helpers/normalizeDotenvConfigIgnore')
+const normalizeDotenvConfigPath = require('./helpers/normalizeDotenvConfigPath')
 const mask = require('./helpers/mask')
 const maskProcessedEnvs = require('./helpers/maskProcessedEnvs')
 
@@ -75,7 +76,7 @@ const config = function (options = {}) {
   const noKeychain = resolveNoKeychain(options)
 
   try {
-    let envs = buildConfigEnvs(options)
+    let envs = normalizeDotenvConfigPath(buildConfigEnvs(options))
     if (!options.envs) {
       envs = determine(envs, processEnv)
     }