@gemeentenijmegen/webapp 1.0.1 → 1.1.1

package/node_modules/dotenv/README.md

@@ -1,3 +1,9 @@
+<div align="center">
+🎉 announcing <a href="https://github.com/dotenvx/dotenvx">dotenvx</a>. <em>run anywhere, multi-environment, encrypted envs</em>.
+</div>
+
+&nbsp;
+
 <div align="center">
 
 <p>
@@ -48,7 +54,7 @@ Dotenv is a zero-dependency module that loads environment variables from a `.env
 
 [![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat-square)](https://github.com/feross/standard)
 [![LICENSE](https://img.shields.io/github/license/motdotla/dotenv.svg)](LICENSE)
-[![dotenv-vault](https://badge.dotenv.org/works-with.svg?r=1)](https://www.dotenv.org/r/github.com/dotenv-org/dotenv-vault?r=1) 
+[![codecov](https://codecov.io/gh/motdotla/dotenv-expand/graph/badge.svg?token=pawWEyaMfg)](https://codecov.io/gh/motdotla/dotenv-expand)
 
 * [🌱 Install](#-install)
 * [🏗️ Usage (.env)](#%EF%B8%8F-usage)
@@ -150,6 +156,10 @@ console.log(typeof config, config) // object { BASIC : 'basic' }
 
 ### Preload
 
+> Note: Consider using [`dotenvx`](https://github.com/dotenvx/dotenvx) instead of preloading. I am now doing (and recommending) so.
+>
+> It serves the same purpose (you do not need to require and load dotenv), adds better debugging, and works with ANY language, framework, or platform. – [motdotla](https://github.com/motdotla)
+
 You can use the `--require` (`-r`) [command line option](https://nodejs.org/api/cli.html#-r---require-module) to preload dotenv. By doing this, you do not need to require and load dotenv in your application code.
 
 ```bash
@@ -238,6 +248,31 @@ $ npx dotenv-vault build
 
 ## 🚀 Deploying
 
+Use [dotenvx](https://github.com/dotenvx/dotenvx) or [dotenv-vault](https://github.com/dotenv-org/dotenv-vault).
+
+### dotenvx
+
+Encrypt your secrets to a `.env.vault` file and load from it (recommended for production and ci).
+
+```bash
+$ echo "HELLO=World" > .env
+$ echo "HELLO=production" > .env.production
+$ echo "console.log('Hello ' + process.env.HELLO)" > index.js
+
+$ dotenvx encrypt
+[dotenvx][info] encrypted to .env.vault (.env,.env.production)
+[dotenvx][info] keys added to .env.keys (DOTENV_KEY_PRODUCTION,DOTENV_KEY_PRODUCTION)
+
+$ DOTENV_KEY='<dotenv_key_production>' dotenvx run -- node index.js
+[dotenvx][info] loading env (1) from encrypted .env.vault
+Hello production
+^ :-]
+```
+
+[learn more](https://github.com/dotenvx/dotenvx?tab=readme-ov-file#encryption)
+
+### dotenv-vault
+
 *Note: Requires dotenv >= 16.1.0*
 
 Encrypt your `.env.vault` file.
@@ -256,7 +291,7 @@ Set `DOTENV_KEY` on your server.
 
 ```bash
 # heroku example
-heroku config:set DOTENV_KEY=dotenv://:key_1234…@dotenv.org/vault/.env.vault?environment=production
+heroku config:set DOTENV_KEY=dotenv://:key_1234…@dotenvx.com/vault/.env.vault?environment=production
 ```
 
 That's it! On deploy, your `.env.vault` file will be decrypted and its secrets injected as environment variables – just in time.
@@ -326,9 +361,11 @@ Specify a custom path if your file containing environment variables is located e
 require('dotenv').config({ path: '/custom/path/to/.env' })
 ```
 
-By default, `config` will look for a file called .env in the current working directory. Pass in multiple files as an array, and they will be loaded in order. The first value set for a variable will win.
+By default, `config` will look for a file called .env in the current working directory.
 
-```js
+Pass in multiple files as an array, and they will be parsed in order and combined with `process.env` (or `option.processEnv`, if set). The first value set for a variable will win, unless the `options.override` flag is set, in which case the last value set will win.  If a value already exists in `process.env` and the `options.override` flag is NOT set, no changes will be made to that value. 
+
+```js  
 require('dotenv').config({ path: ['.env.local', '.env'] })
 ```
 
@@ -356,7 +393,7 @@ require('dotenv').config({ debug: process.env.DEBUG })
 
 Default: `false`
 
-Override any environment variables that have already been set on your machine with values from your .env file.
+Override any environment variables that have already been set on your machine with values from your .env file(s). If multiple files have been provided in `option.path` the override will also be used as each file is combined with the next. Without `override` being set, the first value wins. With `override` set the last value wins. 
 
 ```js
 require('dotenv').config({ override: true })
@@ -383,7 +420,7 @@ Default: `process.env.DOTENV_KEY`
 Pass the `DOTENV_KEY` directly to config options. Defaults to looking for `process.env.DOTENV_KEY` environment variable. Note this only applies to decrypting `.env.vault` files. If passed as null or undefined, or not passed at all, dotenv falls back to its traditional job of parsing a `.env` file.
 
 ```js
-require('dotenv').config({ DOTENV_KEY: 'dotenv://:key_1234…@dotenv.org/vault/.env.vault?environment=production' })
+require('dotenv').config({ DOTENV_KEY: 'dotenv://:key_1234…@dotenvx.com/vault/.env.vault?environment=production' })
 ```
 
 ### Parse
@@ -495,7 +532,7 @@ password than your development database.
 
 ### Should I have multiple `.env` files?
 
-No. We **strongly** recommend against having a "main" `.env` file and an "environment" `.env` file like `.env.test`. Your config should vary between deploys, and you should not be sharing values between environments.
+We recommend creating on `.env` file per environment. Use `.env` for local/development, `.env.production` for production and so on. This still follows the twelve factor principles as each is attributed individually to its own environment. Avoid custom set ups that work in inheritance somehow (`.env.production` inherits values form `.env` for example). It is better to duplicate values if necessary across each `.env.environment` file.
 
 > In a twelve-factor app, env vars are granular controls, each fully orthogonal to other env vars. They are never grouped together as “environments”, but instead are independently managed for each deploy. This is a model that scales up smoothly as the app naturally expands into more deploys over its lifetime.
 >
@@ -654,6 +691,28 @@ Use [dotenv-vault](https://github.com/dotenv-org/dotenv-vault)
 
 A `.env.vault` file is an encrypted version of your development (and ci, staging, production, etc) environment variables. It is paired with a `DOTENV_KEY` to deploy your secrets more securely than scattering them across multiple platforms and tools. Use [dotenv-vault](https://github.com/dotenv-org/dotenv-vault) to manage and generate them.
 
+### What if I accidentally commit my `.env` file to code?
+
+Remove it, [remove git history](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository) and then install the [git pre-commit hook](https://github.com/dotenvx/dotenvx#pre-commit) to prevent this from ever happening again. 
+
+```
+brew install dotenvx/brew/dotenvx
+dotenvx precommit --install
+```
+
+### How can I prevent committing my `.env` file to a Docker build?
+
+Use the [docker prebuild hook](https://dotenvx.com/docs/features/prebuild).
+
+```bash
+# Dockerfile
+...
+RUN curl -fsS https://dotenvx.sh/ | sh
+...
+RUN dotenvx prebuild
+CMD ["dotenvx", "run", "--", "node", "index.js"]
+```
+
 ## Contributing Guide
 
 See [CONTRIBUTING.md](CONTRIBUTING.md)

package/node_modules/dotenv/lib/main.d.ts

@@ -9,7 +9,7 @@ export interface DotenvParseOutput {
 /**
  * Parses a string or buffer in the .env file format into an object.
  *
- * See https://docs.dotenv.org
+ * See https://dotenvx.com/docs
  *
  * @param src - contents to be parsed. example: `'DB_HOST=localhost'`
  * @returns an object with keys and values based on `src`. example: `{ DB_HOST : 'localhost' }`
@@ -71,7 +71,7 @@ export interface DotenvConfigOptions {
    *
    * Pass the DOTENV_KEY directly to config options. Defaults to looking for process.env.DOTENV_KEY environment variable. Note this only applies to decrypting .env.vault files. If passed as null or undefined, or not passed at all, dotenv falls back to its traditional job of parsing a .env file.
    *
-   * example: `require('dotenv').config({ DOTENV_KEY: 'dotenv://:key_1234…@dotenv.org/vault/.env.vault?environment=production' })`
+   * example: `require('dotenv').config({ DOTENV_KEY: 'dotenv://:key_1234…@dotenvx.com/vault/.env.vault?environment=production' })`
    */
   DOTENV_KEY?: string;
 }
@@ -108,7 +108,7 @@ export interface DotenvPopulateInput {
 /**
  * Loads `.env` file contents into process.env by default. If `DOTENV_KEY` is present, it smartly attempts to load encrypted `.env.vault` file contents into process.env.
  *
- * See https://docs.dotenv.org
+ * See https://dotenvx.com/docs
  *
  * @param options - additional options. example: `{ path: './custom/path', encoding: 'latin1', debug: true, override: false }`
  * @returns an object with a `parsed` key if successful or `error` key if an error occurred. example: { parsed: { KEY: 'value' } }
@@ -119,7 +119,7 @@ export function config(options?: DotenvConfigOptions): DotenvConfigOutput;
 /**
  * Loads `.env` file contents into process.env.
  *
- * See https://docs.dotenv.org
+ * See https://dotenvx.com/docs
  *
  * @param options - additional options. example: `{ path: './custom/path', encoding: 'latin1', debug: true, override: false }`
  * @returns an object with a `parsed` key if successful or `error` key if an error occurred. example: { parsed: { KEY: 'value' } }
@@ -130,7 +130,7 @@ export function configDotenv(options?: DotenvConfigOptions): DotenvConfigOutput;
 /**
  * Loads `source` json contents into `target` like process.env.
  *
- * See https://docs.dotenv.org
+ * See https://dotenvx.com/docs
  *
  * @param processEnv - the target JSON object. in most cases use process.env but you can also pass your own JSON object
  * @param parsed - the source JSON object
@@ -143,7 +143,7 @@ export function populate(processEnv: DotenvPopulateInput, parsed: DotenvPopulate
 /**
  * Decrypt ciphertext
  *
- * See https://docs.dotenv.org
+ * See https://dotenvx.com/docs
  *
  * @param encrypted - the encrypted ciphertext string
  * @param keyStr - the decryption key string

package/node_modules/dotenv/lib/main.js

@@ -59,7 +59,7 @@ function _parseVault (options) {
   }
 
   // handle scenario for comma separated keys - for use with key rotation
-  // example: DOTENV_KEY="dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=prod,dotenv://:key_7890@dotenv.org/vault/.env.vault?environment=prod"
+  // example: DOTENV_KEY="dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=prod,dotenv://:key_7890@dotenvx.com/vault/.env.vault?environment=prod"
   const keys = _dotenvKey(options).split(',')
   const length = keys.length
 
@@ -123,7 +123,7 @@ function _instructions (result, dotenvKey) {
     uri = new URL(dotenvKey)
   } catch (error) {
     if (error.code === 'ERR_INVALID_URL') {
-      const err = new Error('INVALID_DOTENV_KEY: Wrong format. Must be in valid uri format like dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=development')
+      const err = new Error('INVALID_DOTENV_KEY: Wrong format. Must be in valid uri format like dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=development')
       err.code = 'INVALID_DOTENV_KEY'
       throw err
     }
@@ -203,41 +203,59 @@ function _configVault (options) {
 }
 
 function configDotenv (options) {
-  let dotenvPath = path.resolve(process.cwd(), '.env')
+  const dotenvPath = path.resolve(process.cwd(), '.env')
   let encoding = 'utf8'
   const debug = Boolean(options && options.debug)
 
-  if (options) {
-    if (options.path != null) {
-      dotenvPath = _resolveHome(options.path)
+  if (options && options.encoding) {
+    encoding = options.encoding
+  } else {
+    if (debug) {
+      _debug('No encoding is specified. UTF-8 is used by default')
     }
-    if (options.encoding != null) {
-      encoding = options.encoding
+  }
+
+  let optionPaths = [dotenvPath] // default, look for .env
+  if (options && options.path) {
+    if (!Array.isArray(options.path)) {
+      optionPaths = [_resolveHome(options.path)]
     } else {
-      if (debug) {
-        _debug('No encoding is specified. UTF-8 is used by default')
+      optionPaths = [] // reset default
+      for (const filepath of options.path) {
+        optionPaths.push(_resolveHome(filepath))
       }
     }
   }
 
-  try {
-    // Specifying an encoding returns a string instead of a buffer
-    const parsed = DotenvModule.parse(fs.readFileSync(dotenvPath, { encoding }))
+  // Build the parsed data in a temporary object (because we need to return it).  Once we have the final
+  // parsed data, we will combine it with process.env (or options.processEnv if provided).
+  let lastError
+  const parsedAll = {}
+  for (const path of optionPaths) {
+    try {
+      // Specifying an encoding returns a string instead of a buffer
+      const parsed = DotenvModule.parse(fs.readFileSync(path, { encoding }))
 
-    let processEnv = process.env
-    if (options && options.processEnv != null) {
-      processEnv = options.processEnv
+      DotenvModule.populate(parsedAll, parsed, options)
+    } catch (e) {
+      if (debug) {
+        _debug(`Failed to load ${path} ${e.message}`)
+      }
+      lastError = e
     }
+  }
 
-    DotenvModule.populate(processEnv, parsed, options)
+  let processEnv = process.env
+  if (options && options.processEnv != null) {
+    processEnv = options.processEnv
+  }
 
-    return { parsed }
-  } catch (e) {
-    if (debug) {
-      _debug(`Failed to load ${dotenvPath} ${e.message}`)
-    }
+  DotenvModule.populate(processEnv, parsedAll, options)
 
-    return { error: e }
+  if (lastError) {
+    return { parsed: parsedAll, error: lastError }
+  } else {
+    return { parsed: parsedAll }
   }
 }
 

package/node_modules/dotenv/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dotenv",
-  "version": "16.4.0",
+  "version": "16.4.5",
   "description": "Loads environment variables from .env file",
   "main": "lib/main.js",
   "types": "lib/main.d.ts",
@@ -24,6 +24,7 @@
     "lint-readme": "standard-markdown",
     "pretest": "npm run lint && npm run dts-check",
     "test": "tap tests/*.js --100 -Rspec",
+    "test:coverage": "tap --coverage-report=lcov",
     "prerelease": "npm test",
     "release": "standard-version"
   },
@@ -31,7 +32,7 @@
     "type": "git",
     "url": "git://github.com/motdotla/dotenv.git"
   },
-  "funding": "https://github.com/motdotla/dotenv?sponsor=1",
+  "funding": "https://dotenvx.com",
   "keywords": [
     "dotenv",
     "env",