@dotenvx/dotenvx 2.3.2 → 2.3.4

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.3.2...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v2.3.4...main)
+
+## [2.3.4](https://github.com/dotenvx/dotenvx/compare/v2.3.3...v2.3.4) (2026-07-09)
+
+### Removed
+
+* Replace various deps with `@dotenvx/tooling` ([#879](https://github.com/dotenvx/dotenvx/pull/879))
+
+## [2.3.3](https://github.com/dotenvx/dotenvx/compare/v2.3.2...v2.3.3) (2026-07-09)
+
+### Removed
+
+* Remove `dotenv` and `commander` for `@dotenvx/tooling` ([#878](https://github.com/dotenvx/dotenvx/pull/878))
 
 ## [2.3.2](https://github.com/dotenvx/dotenvx/compare/v2.3.1...v2.3.2) (2026-07-09)
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.3.2",
+  "version": "2.3.4",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
@@ -43,23 +43,9 @@
   },
   "funding": "https://dotenvx.com",
   "dependencies": {
-    "@dotenvx/primitives": "^1.7.2",
-    "commander": "^11.1.0",
-    "conf": "^10.2.0",
-    "dotenv": "^17.4.2",
-    "enquirer": "^2.4.1",
-    "env-paths": "^2.2.1",
-    "execa": "^5.1.1",
-    "fdir": "^6.2.0",
-    "ignore": "^7.0.5",
-    "object-treeify": "1.1.33",
-    "open": "^8.4.2",
-    "picomatch": "^4.0.4",
-    "synckit": "0.11.13",
-    "systeminformation": "^5.31.11",
-    "undici": "^7.11.0",
-    "which": "^6.0.1",
-    "yocto-spinner": "^1.2.0"
+    "@dotenvx/primitives": "^1.8.1",
+    "@dotenvx/tooling": "^1.0.2",
+    "yocto-spinner": "^1.2.1"
   },
   "devDependencies": {
     "@yao-pkg/pkg": "^6.12.0",

package/src/cli/actions/ls.js

@@ -1,4 +1,4 @@
-const treeify = require('object-treeify')
+const { objectTreeify: treeify } = require('@dotenvx/tooling')
 
 const { logger } = require('./../../shared/logger')
 

package/src/cli/commands/armor.js

@@ -1,5 +1,4 @@
 const executeDynamic = require('./../../lib/helpers/executeDynamic')
-const Session = require('./../../db/session')
 
 function configureArmorCommand (armor) {
   armor
@@ -12,77 +11,85 @@ function configureArmorCommand (armor) {
         return executeDynamic(armor, 'armor', [command, ...(args || [])])
       }
 
+      const Session = require('./../../db/session')
       const sesh = new Session()
       await sesh.notifyUpdate()
       this.help()
     })
 
   // dotenvx armor up
-  const upAction = require('./../actions/armor/up')
   armor
     .command('up')
     .description('armor key')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('--token <token>', 'set token')
     .option('--team <team>', 'team to armor private key for')
-    .action(upAction)
+    .action(function (...args) {
+      return require('./../actions/armor/up').apply(this, args)
+    })
 
   // dotenvx armor down
-  const downAction = require('./../actions/armor/down')
   armor
     .command('down')
     .description('dearmor key')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('--token <token>', 'set token')
     .option('--team <team>', 'team to dearmor private key from')
-    .action(downAction)
+    .action(function (...args) {
+      return require('./../actions/armor/down').apply(this, args)
+    })
 
   // dotenvx armor push
-  const pushAction = require('./../actions/armor/push')
   armor
     .command('push')
     .description('push armored key (from .env.keys)')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('--token <token>', 'set token')
     .option('--team <team>', 'team to push armored private key for')
-    .action(pushAction)
+    .action(function (...args) {
+      return require('./../actions/armor/push').apply(this, args)
+    })
 
   // dotenvx armor pull
-  const pullAction = require('./../actions/armor/pull')
   armor
     .command('pull')
     .description('pull armored key (into .env.keys)')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('--token <token>', 'set token')
     .option('--team <team>', 'team to pull armored private key from')
-    .action(pullAction)
+    .action(function (...args) {
+      return require('./../actions/armor/pull').apply(this, args)
+    })
 
   // dotenvx armor move
-  const moveAction = require('./../actions/armor/move')
   armor
     .command('move')
     .description('move armored key (to other team)')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('--token <token>', 'set token')
-    .action(moveAction)
+    .action(function (...args) {
+      return require('./../actions/armor/move').apply(this, args)
+    })
 
   // dotenvx armor login
-  const loginAction = require('./../actions/login')
   armor
     .command('login')
     .description('log in to Dotenvx Armor')
     .allowUnknownOption()
     .option('--hostname <hostname>', 'set Armor ⛨ hostname')
-    .action(loginAction)
+    .action(function (...args) {
+      return require('./../actions/login').apply(this, args)
+    })
 
   // dotenvx armor logout
-  const logoutAction = require('./../actions/logout')
   armor
     .command('logout')
     .description('log out of Dotenvx Armor')
     .allowUnknownOption()
     .option('--hostname <hostname>', 'set Armor ⛨ hostname')
-    .action(logoutAction)
+    .action(function (...args) {
+      return require('./../actions/logout').apply(this, args)
+    })
 
   return armor
 }

package/src/cli/commands/ext.js

@@ -1,4 +1,4 @@
-const { Command } = require('commander')
+const { Command } = require('@dotenvx/tooling')
 
 const examples = require('./../examples')
 const executeExtension = require('../../lib/helpers/executeExtension')

package/src/cli/commands/lock.js

@@ -5,21 +5,23 @@ function configureLockCommand (lock) {
       this.help()
     })
 
-  const upAction = require('./../actions/lock/up')
   lock
     .command('up')
     .description('lock key in .env.keys')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
-    .action(upAction)
+    .action(function (...args) {
+      return require('./../actions/lock/up').apply(this, args)
+    })
 
-  const downAction = require('./../actions/lock/down')
   lock
     .command('down')
     .description('unlock key in .env.keys')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
-    .action(downAction)
+    .action(function (...args) {
+      return require('./../actions/lock/down').apply(this, args)
+    })
 
   return lock
 }

package/src/cli/commands/native.js

@@ -5,37 +5,41 @@ function configureNativeCommand (native) {
       this.help()
     })
 
-  const upAction = require('./../actions/keychain/up')
   native
     .command('up')
     .description('store key in OS secret store')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
-    .action(upAction)
+    .action(function (...args) {
+      return require('./../actions/keychain/up').apply(this, args)
+    })
 
-  const downAction = require('./../actions/keychain/down')
   native
     .command('down')
     .description('move key from OS secret store to .env.keys')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
-    .action(downAction)
+    .action(function (...args) {
+      return require('./../actions/keychain/down').apply(this, args)
+    })
 
-  const pushAction = require('./../actions/keychain/push')
   native
     .command('push')
     .description('push key to OS secret store from .env.keys')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
-    .action(pushAction)
+    .action(function (...args) {
+      return require('./../actions/keychain/push').apply(this, args)
+    })
 
-  const pullAction = require('./../actions/keychain/pull')
   native
     .command('pull')
     .description('pull key from OS secret store into .env.keys')
     .option('-f, --env-file <path>', 'path to your env file')
     .option('-fk, --env-keys-file <path>', 'path to your .env.keys file', '.env.keys')
-    .action(pullAction)
+    .action(function (...args) {
+      return require('./../actions/keychain/pull').apply(this, args)
+    })
 
   return native
 }

package/src/cli/dotenvx.js

@@ -1,14 +1,12 @@
 #!/usr/bin/env node
 
 /* c8 ignore start */
-const { Command } = require('commander')
+const { Command } = require('@dotenvx/tooling')
 const program = new Command()
 
-const { setLogLevel, logger } = require('../shared/logger')
+const { setLogLevel } = require('../shared/logger')
 const examples = require('./examples')
 const packageJson = require('./../lib/helpers/packageJson')
-const Errors = require('./../lib/helpers/errors')
-const getCommanderVersion = require('./../lib/helpers/getCommanderVersion')
 const executeDynamic = require('./../lib/helpers/executeDynamic')
 const removeDynamicHelpSection = require('./../lib/helpers/removeDynamicHelpSection')
 const removeOptionsHelpParts = require('./../lib/helpers/removeOptionsHelpParts')
@@ -23,14 +21,6 @@ function collectEnvs (type) {
   }
 }
 
-// surface hoisting problems
-const commanderVersion = getCommanderVersion()
-if (commanderVersion && parseInt(commanderVersion.split('.')[0], 10) >= 12) {
-  const message = `dotenvx depends on commander@11.x.x but you are attempting to hoist commander@${commanderVersion}`
-  const error = new Errors({ message }).dangerousDependencyHoist()
-  logger.error(error.messageWithHelp)
-}
-
 // global log levels
 program
   .usage('run -- yourcommand')

package/src/db/device.js

@@ -1,4 +1,4 @@
-const Conf = require('conf')
+const { Conf } = require('@dotenvx/tooling')
 const { derive, keypair } = require('@dotenvx/primitives')
 
 const encryptDeviceValue = require('./../lib/helpers/encryptDeviceValue')

package/src/db/session.js

@@ -1,8 +1,6 @@
 const fs = require('fs')
 const path = require('path')
-const Conf = require('conf')
-const dotenv = require('dotenv')
-const envPaths = require('env-paths')
+const { Conf, dotenv, envPaths } = require('@dotenvx/tooling')
 
 const jsonToEnv = require('./../lib/helpers/jsonToEnv')
 const packageJson = require('./../lib/helpers/packageJson')
@@ -148,9 +146,9 @@ class Session {
   }
 
   async systemInformation () {
-    const si = require('systeminformation')
-    const system = await si.system()
-    const osInfo = await si.osInfo()
+    const { systeminformation } = require('@dotenvx/tooling')
+    const system = await systeminformation.system()
+    const osInfo = await systeminformation.osInfo()
 
     return {
       system_uuid: system.uuid,

package/src/lib/helpers/errors.js

@@ -4,7 +4,6 @@ const ISSUE_BY_CODE = {
   COMMAND_EXITED_WITH_CODE: 'https://github.com/dotenvx/dotenvx/issues/new',
   COMMAND_SUBSTITUTION_FAILED: 'https://github.com/dotenvx/dotenvx/issues/532',
   DECRYPTION_FAILED: 'https://github.com/dotenvx/dotenvx/issues/757',
-  DANGEROUS_DEPENDENCY_HOIST: 'https://github.com/dotenvx/dotenvx/issues/622',
   INVALID_COLOR: 'must be 256 colors',
   INVALID_CONVENTION: 'https://github.com/dotenvx/dotenvx/issues/761',
   INVALID_PASSPHRASE: 'try again with the correct passphrase',
@@ -98,18 +97,6 @@ class Errors {
     return e
   }
 
-  dangerousDependencyHoist () {
-    const code = 'DANGEROUS_DEPENDENCY_HOIST'
-    const message = `[${code}] your environment has hoisted an incompatible version of a dotenvx dependency: ${this.message}`
-    const help = `fix: [${ISSUE_BY_CODE[code]}]`
-
-    const e = new Error(message)
-    e.code = code
-    e.help = help
-    e.messageWithHelp = `${message}. ${help}`
-    return e
-  }
-
   invalidColor () {
     const code = 'INVALID_COLOR'
     const message = `[${code}] Invalid color ${this.color}`

package/src/lib/helpers/execute.js

@@ -1,4 +1,4 @@
-const execa = require('execa')
+const { execa } = require('@dotenvx/tooling')
 /* c8 ignore start */
 const pkgArgs = process.pkg ? { PKG_EXECPATH: '' } : {}
 /* c8 ignore stop */

package/src/lib/helpers/executeCommand.js

@@ -1,5 +1,5 @@
 const path = require('path')
-const which = require('which')
+const { which } = require('@dotenvx/tooling')
 const execute = require('./../../lib/helpers/execute')
 const { logger } = require('./../../shared/logger')
 const Errors = require('./errors')

package/src/lib/helpers/http.js

@@ -1,4 +1,4 @@
-const { request } = require('undici')
+const { request } = require('@dotenvx/tooling')
 
 async function http (url, opts = {}) {
   return await request(url, opts)

package/src/lib/helpers/keypairMetadata.js

@@ -1,6 +1,6 @@
 const path = require('path')
 const fs = require('fs')
-const execa = require('execa')
+const { execa } = require('@dotenvx/tooling')
 const { scan } = require('@dotenvx/primitives')
 const canonicalEnvFilename = require('./canonicalEnvFilename')
 const environment = require('../conventions/environment')

package/src/lib/helpers/openUrl.js

@@ -1,4 +1,4 @@
-const open = require('open')
+const { open } = require('@dotenvx/tooling')
 
 async function openUrl (url) {
   return await open(url, { wait: false })

package/src/lib/helpers/prompts.js

@@ -1,4 +1,4 @@
-const Enquirer = require('enquirer')
+const { Enquirer } = require('@dotenvx/tooling')
 
 const enquirer = new Enquirer()
 

package/src/lib/providers/index.js

@@ -4,7 +4,7 @@ const armorProvider = require('./armor/index')
 const keychainProvider = require('./keychain/index')
 
 function syncArmorProvider (publicKeyHex) {
-  const { createSyncFn } = require('synckit')
+  const { createSyncFn } = require('@dotenvx/tooling')
   const runProviderSync = createSyncFn(require.resolve('./worker.js'))
   return runProviderSync(require.resolve('./armor/index'), publicKeyHex)
 }

package/src/lib/providers/worker.js

@@ -1,4 +1,4 @@
-const { runAsWorker } = require('synckit')
+const { runAsWorker } = require('@dotenvx/tooling')
 
 runAsWorker(async (providerPath, publicKeyHex) => {
   const provider = require(providerPath)

package/src/lib/resolvers/ls.js

@@ -1,6 +1,6 @@
-const { fdir: Fdir } = require('fdir')
+const { Fdir } = require('@dotenvx/tooling')
 const path = require('path')
-const picomatch = require('picomatch')
+const { match } = require('@dotenvx/primitives')
 
 function patternsFor (value) {
   if (!Array.isArray(value)) {
@@ -25,8 +25,8 @@ function ls (options = {}) {
   const excludeEnvFile = options.excludeEnvFile || []
   const excludePatterns = excludePatternsFor(excludeEnvFile)
   const excludes = excludePatterns.length > 0 ? ignore.concat(excludePatterns) : ignore
-  const exclude = picomatch(excludes, { dot: true })
-  const include = picomatch(patternsFor(envFile), {
+  const exclude = match(excludes, { dot: true })
+  const include = match(patternsFor(envFile), {
     dot: true,
     ignore: excludes
   })

package/src/lib/services/doctor.js

@@ -1,6 +1,6 @@
-const { fdir: Fdir } = require('fdir')
+const { Fdir } = require('@dotenvx/tooling')
 const path = require('path')
-const picomatch = require('picomatch')
+const { match } = require('@dotenvx/primitives')
 const fsx = require('./../helpers/fsx')
 
 const patterns = [
@@ -33,7 +33,7 @@ class Doctor {
       '**/coverage/**',
       '**/.next/**'
     ]
-    this.exclude = picomatch(this.ignore)
+    this.exclude = match(this.ignore)
   }
 
   run () {

package/src/lib/services/prebuild.js

@@ -1,7 +1,7 @@
 /* istanbul ignore file */
 const fsx = require('./../helpers/fsx')
 const path = require('path')
-const ignore = require('ignore')
+const { ignore } = require('@dotenvx/tooling')
 
 const ls = require('../resolvers/ls')
 const Errors = require('../helpers/errors')

package/src/lib/services/precommit.js

@@ -1,7 +1,7 @@
 /* istanbul ignore file */
 const fsx = require('./../helpers/fsx')
 const path = require('path')
-const ignore = require('ignore')
+const { ignore } = require('@dotenvx/tooling')
 
 const ls = require('../resolvers/ls')
 const { sealed } = require('@dotenvx/primitives')

package/src/lib/helpers/getCommanderVersion.js

@@ -1,10 +0,0 @@
-const fs = require('fs')
-const path = require('path')
-
-function getCommanderVersion () {
-  const commanderMain = require.resolve('commander')
-  const pkgPath = path.join(commanderMain, '..', 'package.json')
-  return JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version
-}
-
-module.exports = getCommanderVersion