@dotenvx/dotenvx 2.3.1 → 2.3.3

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.3.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.3.3...main)
+
+## [2.3.3](https://github.com/dotenvx/dotenvx/compare/v2.3.2...v2.3.3) (2026-07-09)
+
+### Removed
+
+* Remove `dotenv` and `commander` for `@dotenvx/tooling` ([#878](https://github.com/dotenvx/dotenvx/pull/878))
+
+## [2.3.2](https://github.com/dotenvx/dotenvx/compare/v2.3.1...v2.3.2) (2026-07-09)
+
+### Changed
+
+* Permit empty value for `set` ([#877](https://github.com/dotenvx/dotenvx/pull/877))
 
 ## [2.3.1](https://github.com/dotenvx/dotenvx/compare/v2.3.0...v2.3.1) (2026-07-08)
 

package/README.md

@@ -122,7 +122,7 @@ Hello Dotenvx # with dotenvx
 > :-D
 ```
 
-see [extended quickstart guide](https://dotenvx.com/docs/quickstart)
+see [quickstart guides](https://dotenvx.com/docs/quickstart)
 
 More examples
 
@@ -152,6 +152,59 @@ $ dotenvx run -- npx tsx index.ts
 Hello Dotenvx
 ```
 
+</details>
+<details><summary>Astro 🚀</summary><br>
+
+Preface Astro scripts with `dotenvx run --` and read your env values in Astro.
+
+```json
+{
+  "scripts": {
+    "dev": "dotenvx run -- astro dev",
+    "build": "dotenvx run -- astro build",
+    "preview": "dotenvx run -- astro preview"
+  }
+}
+```
+
+```astro
+export async function GET() {
+  return new Response(
+    JSON.stringify({
+      HELLO: process.env.HELLO,
+    }),
+    {
+      status: 200,
+      headers: {
+        "Content-Type": "application/json",
+      },
+    }
+  );
+}
+```
+
+see [astro guide](https://dotenvx.com/docs/secrets-in-astro)
+
+</details>
+<details><summary>Expo 🧭</summary><br>
+
+Preface Expo scripts with `dotenvx run --`.
+
+```json
+{
+  "scripts": {
+    "start": "dotenvx run -- expo start",
+    "reset-project": "node ./scripts/reset-project.js",
+    "android": "dotenvx run -- expo start --android",
+    "ios": "dotenvx run -- expo start --ios",
+    "web": "dotenvx run -- expo start --web",
+    "lint": "expo lint"
+  }
+}
+```
+
+see [expo guide](https://dotenvx.com/docs/secrets-in-expo)
+
 </details>
 <details><summary>Next.js ▲</summary><br>
 
@@ -222,6 +275,20 @@ export default {
 }
 ```
 
+</details>
+<details><summary>Bun 🥟</summary><br>
+
+```sh
+$ echo "HELLO=Test" > .env.test
+$ echo "console.log('Hello ' + process.env.HELLO)" > index.js
+
+$ bun index.js
+Hello undefined
+
+$ dotenvx run -f .env.test -- bun index.js
+Hello Test
+```
+
 </details>
 <details><summary>Deno 🦕</summary><br>
 
@@ -246,20 +313,6 @@ Hello Dotenvx
 > 
 > Instead, use `dotenvx` as designed, by installing the cli as a binary - via curl, brew, etc.
 
-</details>
-<details><summary>Bun 🥟</summary><br>
-
-```sh
-$ echo "HELLO=Test" > .env.test
-$ echo "console.log('Hello ' + process.env.HELLO)" > index.js
-
-$ bun index.js
-Hello undefined
-
-$ dotenvx run -f .env.test -- bun index.js
-Hello Test
-```
-
 </details>
 <details><summary>Python 🐍</summary><br>
 
@@ -730,22 +783,6 @@ $ dotenvx encrypt
 
 > A `DOTENV_PUBLIC_KEY` (encryption key) and a `DOTENV_PRIVATE_KEY` (decryption key) are generated using the same public-key cryptography as [Bitcoin](https://en.bitcoin.it/wiki/Secp256k1).
 
-### Protect `.env.keys` from agents
-
-After encryption, `DOTENV_PUBLIC_KEY` lives in your encrypted `.env` file. This means agents and automation can keep running `dotenvx set` and `dotenvx encrypt` without reading `.env.keys`.
-
-```sh
-$ chmod a-r .env.keys
-
-$ dotenvx set HELLO World
-◈ encrypted HELLO (.env)
-
-$ dotenvx encrypt
-◈ encrypted (.env)
-```
-
-Keep `.env.keys` unreadable by agents, while still letting them safely update encrypted values.
-
 More examples
 
 <details><summary>`.env`</summary><br>
@@ -843,6 +880,23 @@ $ dotenvx encrypt --stdout > .env.encrypted
 > 
 > If your organization's compliance department requires [NIST approved curves](https://csrc.nist.gov/projects/elliptic-curve-cryptography) or other curves like `curve25519`, please reach out at [security@dotenvx.com](mailto:security@dotenvx.com).
 
+</details>
+<details><summary>agents</summary><br>
+
+After encryption, `DOTENV_PUBLIC_KEY` lives in your encrypted `.env` file. This means agents and automation can keep running `dotenvx set` and `dotenvx encrypt` without reading `.env.keys`.
+
+```sh
+$ chmod a-r .env.keys
+
+$ dotenvx set HELLO World
+◈ encrypted HELLO (.env)
+
+$ dotenvx encrypt
+◈ encrypted (.env)
+```
+
+Keep `.env.keys` unreadable by agents, while still letting them safely update encrypted values.
+
 </details>
 
 &nbsp;
@@ -2942,7 +2996,8 @@ This is known as *Decryption at Access* and is written about in [the whitepaper]
   * [PHP](https://dotenvx.com/docs/languages/php)
   * [Rust](https://dotenvx.com/docs/languages/rust)
 * [Frameworks](https://dotenvx.com/docs#frameworks)
-  * [Astro](https://dotenvx.com/docs/frameworks/astro)
+  * [Astro](https://dotenvx.com/docs/secrets-in-astro)
+  * [Expo](https://dotenvx.com/docs/secrets-in-expo)
   * [Express](https://dotenvx.com/docs/frameworks/express)
   * [Next](https://dotenvx.com/docs/frameworks/next)
   * [Remix](https://dotenvx.com/docs/frameworks/remix)

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.3.1",
+  "version": "2.3.3",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -44,9 +44,8 @@
   "funding": "https://dotenvx.com",
   "dependencies": {
     "@dotenvx/primitives": "^1.7.2",
-    "commander": "^11.1.0",
+    "@dotenvx/tooling": "^0.2.0",
     "conf": "^10.2.0",
-    "dotenv": "^17.4.2",
     "enquirer": "^2.4.1",
     "env-paths": "^2.2.1",
     "execa": "^5.1.1",

package/src/cli/actions/set.js

@@ -21,7 +21,7 @@ async function set (key, value) {
     settingSymbol = '◇'
   }
 
-  if (typeof value === 'undefined') {
+  if (value === undefined || value === null) {
     if (!process.stdin.isTTY) {
       catchAndLog(new Errors({ key }).missingValue())
       process.exit(1)
@@ -47,12 +47,6 @@ async function set (key, value) {
     }
   }
 
-  if (value === '') {
-    catchAndLog(new Errors({ key }).missingValue())
-    process.exit(1)
-    return
-  }
-
   const spinner = await createSpinner({ ...options, text: settingMessage })
   const sesh = new Session()
 

package/src/cli/commands/ext.js

@@ -1,4 +1,4 @@
-const { Command } = require('commander')
+const { Command } = require('@dotenvx/tooling')
 
 const examples = require('./../examples')
 const executeExtension = require('../../lib/helpers/executeExtension')

package/src/cli/dotenvx.js

@@ -1,14 +1,12 @@
 #!/usr/bin/env node
 
 /* c8 ignore start */
-const { Command } = require('commander')
+const { Command } = require('@dotenvx/tooling')
 const program = new Command()
 
-const { setLogLevel, logger } = require('../shared/logger')
+const { setLogLevel } = require('../shared/logger')
 const examples = require('./examples')
 const packageJson = require('./../lib/helpers/packageJson')
-const Errors = require('./../lib/helpers/errors')
-const getCommanderVersion = require('./../lib/helpers/getCommanderVersion')
 const executeDynamic = require('./../lib/helpers/executeDynamic')
 const removeDynamicHelpSection = require('./../lib/helpers/removeDynamicHelpSection')
 const removeOptionsHelpParts = require('./../lib/helpers/removeOptionsHelpParts')
@@ -23,14 +21,6 @@ function collectEnvs (type) {
   }
 }
 
-// surface hoisting problems
-const commanderVersion = getCommanderVersion()
-if (commanderVersion && parseInt(commanderVersion.split('.')[0], 10) >= 12) {
-  const message = `dotenvx depends on commander@11.x.x but you are attempting to hoist commander@${commanderVersion}`
-  const error = new Errors({ message }).dangerousDependencyHoist()
-  logger.error(error.messageWithHelp)
-}
-
 // global log levels
 program
   .usage('run -- yourcommand')

package/src/db/session.js

@@ -1,7 +1,7 @@
 const fs = require('fs')
 const path = require('path')
 const Conf = require('conf')
-const dotenv = require('dotenv')
+const { dotenv } = require('@dotenvx/tooling')
 const envPaths = require('env-paths')
 
 const jsonToEnv = require('./../lib/helpers/jsonToEnv')

package/src/lib/helpers/errors.js

@@ -4,7 +4,6 @@ const ISSUE_BY_CODE = {
   COMMAND_EXITED_WITH_CODE: 'https://github.com/dotenvx/dotenvx/issues/new',
   COMMAND_SUBSTITUTION_FAILED: 'https://github.com/dotenvx/dotenvx/issues/532',
   DECRYPTION_FAILED: 'https://github.com/dotenvx/dotenvx/issues/757',
-  DANGEROUS_DEPENDENCY_HOIST: 'https://github.com/dotenvx/dotenvx/issues/622',
   INVALID_COLOR: 'must be 256 colors',
   INVALID_CONVENTION: 'https://github.com/dotenvx/dotenvx/issues/761',
   INVALID_PASSPHRASE: 'try again with the correct passphrase',
@@ -98,18 +97,6 @@ class Errors {
     return e
   }
 
-  dangerousDependencyHoist () {
-    const code = 'DANGEROUS_DEPENDENCY_HOIST'
-    const message = `[${code}] your environment has hoisted an incompatible version of a dotenvx dependency: ${this.message}`
-    const help = `fix: [${ISSUE_BY_CODE[code]}]`
-
-    const e = new Error(message)
-    e.code = code
-    e.help = help
-    e.messageWithHelp = `${message}. ${help}`
-    return e
-  }
-
   invalidColor () {
     const code = 'INVALID_COLOR'
     const message = `[${code}] Invalid color ${this.color}`

package/src/lib/helpers/getCommanderVersion.js

@@ -1,10 +0,0 @@
-const fs = require('fs')
-const path = require('path')
-
-function getCommanderVersion () {
-  const commanderMain = require.resolve('commander')
-  const pkgPath = path.join(commanderMain, '..', 'package.json')
-  return JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version
-}
-
-module.exports = getCommanderVersion