@dotenvx/dotenvx 2.23.0 → 2.24.1

package/CHANGELOG.md

@@ -2,7 +2,23 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.23.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.24.1...main)
+
+## [2.24.1](https://github.com/dotenvx/dotenvx/compare/v2.24.0...v2.24.1) (2026-09-11)
+
+### Changed
+
+* Upgraded to latest [@dotenvx/primitives](https://www.npmjs.com/package/@dotenvx/primitives)
+
+## [2.24.0](https://github.com/dotenvx/dotenvx/compare/v2.23.0...v2.24.0) (2026-09-10)
+
+### Changed
+
+* Do not expand nested commands ([#965](https://github.com/dotenvx/dotenvx/pull/965))
+
+### Removed
+
+* BREAKING: Remove the `-p` shorthand for `--plain`; use `--plain` instead
 
 ## [2.23.0](https://github.com/dotenvx/dotenvx/compare/v2.22.0...v2.23.0) (2026-08-31)
 

package/README.md

@@ -747,12 +747,12 @@ $ echo "HELLO=local" > .env.local
 
 $ echo "HELLO=World" > .env
 
-$ dotenvx run -f .env.local -f .env -- node index.js
+$ dotenvx run -f .env.local,.env -- node index.js
 [dotenvx@1.X.X] injecting env (1) from .env.local,.env
 Hello local
 ```
 
-Note subsequent files do NOT override pre-existing variables defined in previous files or env. This follows historic principle. For example, above `local` wins – from the first file.
+Comma-separate multiple files after a single `-f`. Subsequent files do NOT override pre-existing variables defined in previous files or env. This follows historic principle. For example, above `local` wins – from the first file.
 
 </details>
 
@@ -763,7 +763,7 @@ $ echo "HELLO=local" > .env.local
 
 $ echo "HELLO=World" > .env
 
-$ dotenvx run -f .env.local -f .env --overload -- node index.js
+$ dotenvx run -f .env.local,.env --overload -- node index.js
 [dotenvx@1.X.X] injecting env (1) from .env.local,.env
 Hello World
 ```
@@ -1267,7 +1267,7 @@ Hello World
 ```
 
 </details>
-<details><summary>`run` - multiple `-f` flags</summary><br>
+<details><summary>`run -f` - multiple files</summary><br>
 
 Compose multiple `.env` files for environment variables loading, as you need.
 
@@ -1276,12 +1276,12 @@ $ echo "HELLO=local" > .env.local
 $ echo "HELLO=World" > .env
 $ echo "console.log('Hello ' + process.env.HELLO)" > index.js
 
-$ dotenvx run -f .env.local -f .env -- node index.js
+$ dotenvx run -f .env.local,.env -- node index.js
 [dotenvx@1.X.X] injecting env (1) from .env.local, .env
 Hello local
 ```
 
-Note subsequent files do NOT override pre-existing variables defined in previous files or env. This follows historic principle. For example, above `local` wins – from the first file.
+Comma-separate multiple files after a single `-f`. Subsequent files do NOT override pre-existing variables defined in previous files or env. This follows historic principle. For example, above `local` wins – from the first file.
 
 </details>
 <details><summary>`run --env HELLO=String`</summary><br>
@@ -1371,7 +1371,7 @@ $ echo "HELLO=local" > .env.local
 $ echo "HELLO=World" > .env
 $ echo "console.log('Hello ' + process.env.HELLO)" > index.js
 
-$ dotenvx run -f .env.local -f .env --overload -- node index.js
+$ dotenvx run -f .env.local,.env --overload -- node index.js
 [dotenvx@1.X.X] injecting env (1) from .env.local, .env
 Hello World
 ```
@@ -2833,7 +2833,7 @@ Pass multiple `.env` files to generate your `.env.example` file from the combina
 $ echo "HELLO=World" > .env
 $ echo "DB_HOST=example.com" > .env.production
 
-$ dotenvx genexample -f .env -f .env.production
+$ dotenvx genexample -f .env,.env.production
 ▣ generated (.env.example)
 ```
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.23.0",
+  "version": "2.24.1",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -53,7 +53,7 @@
   },
   "funding": "https://dotenvx.com",
   "dependencies": {
-    "@dotenvx/primitives": "^2.2.0",
+    "@dotenvx/primitives": "^3.0.2",
     "@dotenvx/tooling": "^1.0.3",
     "yocto-spinner": "^1.2.1"
   },

package/src/cli/dotenvx.js

@@ -127,7 +127,7 @@ program.command('set')
   .option('-f, --env-file <path>', 'path(s) to your env file(s)', collectEnvs('envFile'), [])
   .option('-fk, --env-keys-file <path>', 'path to your .env.keys file (default: same path as your env file)')
   .option('-c, --encrypt', 'encrypt value', true)
-  .option('-p, --plain', 'store value as plain text', false)
+  .option('--plain', 'store value as plain text', false)
   .option('--no-create', 'do not create .env file(s) when missing')
   .option('--no-armor', 'disable Dotenvx Armor features')
   .option('--no-native', 'disable OS secret store features')

package/src/lib/helpers/executeCommand.js

@@ -108,7 +108,7 @@ async function executeCommand (commandArgs, env, sensitiveValues = []) {
   /* c8 ignore stop */
 
   try {
-    // ensure the first command is expanded
+    // Expand only the executable; child arguments and separators pass through unchanged.
     try {
       commandArgs[0] = path.resolve(which.sync(`${commandArgs[0]}`))
       logger.debug(`expanding process command to [${commandArgs.join(' ')}]`)
@@ -116,22 +116,6 @@ async function executeCommand (commandArgs, env, sensitiveValues = []) {
       logger.debug(`could not expand process command. using [${commandArgs.join(' ')}]`)
     }
 
-    // expand any other commands that follow a --
-    let expandNext = false
-    for (let i = 0; i < commandArgs.length; i++) {
-      if (commandArgs[i] === '--') {
-        expandNext = true
-      } else if (expandNext) {
-        try {
-          commandArgs[i] = path.resolve(which.sync(`${commandArgs[i]}`))
-          logger.debug(`expanding process command to [${commandArgs.join(' ')}]`)
-        } catch (e) {
-          logger.debug(`could not expand process command. using [${commandArgs.join(' ')}]`)
-        }
-        expandNext = false
-      }
-    }
-
     const redactStdout = sensitiveValues.length > 0
     const redactStderr = sensitiveValues.length > 0
     const usePty = redactStdout && Boolean(

package/src/lib/helpers/parseWithDecryptor.js

@@ -1,4 +1,4 @@
-const { parse, parseSync } = require('@dotenvx/primitives')
+const { parse, parseSync, parsearrays } = require('@dotenvx/primitives')
 const SERVER_SIDE_DECRYPTION_REQUIRED = 'SERVER_SIDE_DECRYPTION_REQUIRED'
 
 function decryptOptions (error) {
@@ -27,21 +27,29 @@ function failedKeyAccessFallback (result, error) {
 }
 
 async function parseWithDecryptor (src, options = {}) {
+  return parseWith(src, options, parse)
+}
+
+parseWithDecryptor.arrays = async function parsearraysWithDecryptor (src, options = {}) {
+  return parseWith(src, options, parsearrays)
+}
+
+async function parseWith (src, options, parser) {
   try {
-    return await parse(src, options)
+    return await parser(src, options)
   } catch (error) {
     if (error.code !== SERVER_SIDE_DECRYPTION_REQUIRED || typeof options.decryptor !== 'function') {
       if (typeof options.provider !== 'function') throw error
 
-      const result = await parse(src, parseOptionsWithoutProvider(options))
+      const result = await parser(src, parseOptionsWithoutProvider(options))
       return failedKeyAccessFallback(result, error)
     }
 
     try {
       const result = await options.decryptor(src, decryptOptions(error))
-      return await parse(result.src, parseOptionsWithoutProvider(options))
+      return await parser(result.src, parseOptionsWithoutProvider(options))
     } catch (decryptorError) {
-      const result = await parse(src, parseOptionsWithoutProvider(options))
+      const result = await parser(src, parseOptionsWithoutProvider(options))
       return failedKeyAccessFallback(result, decryptorError)
     }
   }

package/src/lib/transforms/decrypt.js

@@ -44,7 +44,7 @@ async function decrypt (options = {}) {
       const encoding = await detectEncoding(filepath)
       row.envSrc = await fsx.readFileX(filepath, { encoding })
 
-      const { parsed, errors } = await parseWithDecryptor(row.envSrc, { fk, ik, ek, array: true, provider, decryptor })
+      const { parsed, errors } = await parseWithDecryptor.arrays(row.envSrc, { fk, ik, ek, provider, decryptor })
 
       if (errors.length > 0) {
         row.error = parseError(errors[0])