[PR #516] [CLOSED] Bump dotenv from 16.4.7 to 17.0.1 #529

New issue

Closed

opened 2026-03-03 13:54:58 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 13:54:58 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/jehna/humanify/pull/516
Author: @dependabot[bot]
Created: 7/2/2025
Status: ❌ Closed

Base: main ← Head: dependabot/npm_and_yarn/dotenv-17.0.1

📝 Commits (1)

8b63245 Bump dotenv from 16.4.7 to 17.0.1

📊 Changes

2 files changed (+5 additions, -6 deletions)

View changed files

📝 package-lock.json (+4 -5)
📝 package.json (+1 -1)

📄 Description

Bumps dotenv from 16.4.7 to 17.0.1.

Changelog

Sourced from dotenv's changelog.

17.0.1 (2025-07-01)

Changed

Patched injected log to count only populated/set keys to process.env (#879)

17.0.0 (2025-06-27)

Changed

Default quiet to false - informational (file and keys count) runtime log message shows by default (#875)

16.6.1 (2025-06-27)

Changed

Default quiet to true – hiding the runtime log message (#874)

NOTICE: 17.0.0 will be released with quiet defaulting to false. Use config({ quiet: true }) to suppress.

And check out the new dotenvx. As coding workflows evolve and agents increasingly handle secrets, encrypted .env files offer a much safer way to deploy both agents and code together with secure secrets. Simply switch require('dotenv').config() for require('@dotenvx/dotenvx').config().

16.6.0 (2025-06-26)

Added

Default log helpful message [dotenv@16.6.0] injecting env (1) from .env (#870)

Use { quiet: true } to suppress

Aligns dotenv more closely with dotenvx.

16.5.0 (2025-04-07)

Added

🎉 Added new sponsor Graphite - the AI developer productivity platform helping teams on GitHub ship higher quality software, faster.

[!TIP] Become a sponsor

The dotenvx README is viewed thousands of times DAILY on GitHub and NPM. Sponsoring dotenv is a great way to get in front of developers and give back to the developer community at the same time.

Changed

Remove _log method. Use _debug #862

Commits

535465c 17.0.1
0570831 changelog 🪵
2f323b9 Merge pull request #879 from motdotla/smarter-keys-logged
2561ad1 correctly track which keys were written to process.env
3010120 remove sponsors
f28bfd5 17.0.0
3348b36 changelog 🪵
a814691 Merge pull request #875 from motdotla/quiet-true
e8978b0 mention dotenvx in runtime message to point people to safer .env files
661b247 update README with quiet option
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/jehna/humanify/pull/516 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 7/2/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `dependabot/npm_and_yarn/dotenv-17.0.1` --- ### 📝 Commits (1) - [`8b63245`](https://github.com/jehna/humanify/commit/8b63245d3962eb5e51cbb6e7343372000edec66c) Bump dotenv from 16.4.7 to 17.0.1 ### 📊 Changes **2 files changed** (+5 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `package-lock.json` (+4 -5) 📝 `package.json` (+1 -1) </details> ### 📄 Description Bumps [dotenv](https://github.com/motdotla/dotenv) from 16.4.7 to 17.0.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md">dotenv's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/motdotla/dotenv/compare/v17.0.0...v17.0.1">17.0.1</a> (2025-07-01)</h2> <h3>Changed</h3> <ul> <li>Patched injected log to count only populated/set keys to process.env (<a href="https://redirect.github.com/motdotla/dotenv/pull/879">#879</a>)</li> </ul> <h2><a href="https://github.com/motdotla/dotenv/compare/v16.6.1...v17.0.0">17.0.0</a> (2025-06-27)</h2> <h3>Changed</h3> <ul> <li>Default <code>quiet</code> to false - informational (file and keys count) runtime log message shows by default (<a href="https://redirect.github.com/motdotla/dotenv/pull/874">#875</a>)</li> </ul> <h2><a href="https://github.com/motdotla/dotenv/compare/v16.6.0...v16.6.1">16.6.1</a> (2025-06-27)</h2> <h3>Changed</h3> <ul> <li>Default <code>quiet</code> to true – hiding the runtime log message (<a href="https://redirect.github.com/motdotla/dotenv/pull/874">#874</a>)</li> <li>NOTICE: 17.0.0 will be released with quiet defaulting to false. Use <code>config({ quiet: true })</code> to suppress.</li> <li>And check out the new <a href="https://github.com/dotenvx/dotenvx">dotenvx</a>. As coding workflows evolve and agents increasingly handle secrets, encrypted .env files offer a much safer way to deploy both agents and code together with secure secrets. Simply switch <code>require('dotenv').config()</code> for <code>require('@dotenvx/dotenvx').config()</code>.</li> </ul> <h2><a href="https://github.com/motdotla/dotenv/compare/v16.5.0...v16.6.0">16.6.0</a> (2025-06-26)</h2> <h3>Added</h3> <ul> <li>Default log helpful message <code>[dotenv@16.6.0] injecting env (1) from .env</code> (<a href="https://redirect.github.com/motdotla/dotenv/pull/870">#870</a>)</li> <li>Use <code>{ quiet: true }</code> to suppress</li> <li>Aligns dotenv more closely with <a href="https://github.com/dotenvx/dotenvx">dotenvx</a>.</li> </ul> <h2><a href="https://github.com/motdotla/dotenv/compare/v16.4.7...v16.5.0">16.5.0</a> (2025-04-07)</h2> <h3>Added</h3> <ul> <li>🎉 Added new sponsor <a href="https://graphite.dev/?utm_source=github&utm_medium=repo&utm_campaign=dotenv">Graphite</a> - <em>the AI developer productivity platform helping teams on GitHub ship higher quality software, faster</em>.</li> </ul> <blockquote> <p>[!TIP] <strong><a href="https://github.com/sponsors/motdotla">Become a sponsor</a></strong></p> <p>The dotenvx README is viewed thousands of times DAILY on GitHub and NPM. Sponsoring dotenv is a great way to get in front of developers and give back to the developer community at the same time.</p> </blockquote> <h3>Changed</h3> <ul> <li>Remove <code>_log</code> method. Use <code>_debug</code> <a href="https://redirect.github.com/motdotla/dotenv/pull/862">#862</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/motdotla/dotenv/commit/535465c6f9f2c3554adb6e1b66ee9633c8ddf15b"><code>535465c</code></a> 17.0.1</li> <li><a href="https://github.com/motdotla/dotenv/commit/0570831c581fed66b12774ca7a35d36d43ddb7e3"><code>0570831</code></a> changelog 🪵</li> <li><a href="https://github.com/motdotla/dotenv/commit/2f323b91d89bfaea24ba32696cd8417a71fbf51c"><code>2f323b9</code></a> Merge pull request <a href="https://redirect.github.com/motdotla/dotenv/issues/879">#879</a> from motdotla/smarter-keys-logged</li> <li><a href="https://github.com/motdotla/dotenv/commit/2561ad1a5d27196ab7fa83381f13f1ede9c17306"><code>2561ad1</code></a> correctly track which keys were written to process.env</li> <li><a href="https://github.com/motdotla/dotenv/commit/301012015541bcb810e64794ea0223387d19794f"><code>3010120</code></a> remove sponsors</li> <li><a href="https://github.com/motdotla/dotenv/commit/f28bfd55817054af9fd5097b19eb4faa2189cb6b"><code>f28bfd5</code></a> 17.0.0</li> <li><a href="https://github.com/motdotla/dotenv/commit/3348b36933022b19f25070acdc126153cd64bae8"><code>3348b36</code></a> changelog 🪵</li> <li><a href="https://github.com/motdotla/dotenv/commit/a814691e6e4a7cfe84be731b3e6ad2fa19f24085"><code>a814691</code></a> Merge pull request <a href="https://redirect.github.com/motdotla/dotenv/issues/875">#875</a> from motdotla/quiet-true</li> <li><a href="https://github.com/motdotla/dotenv/commit/e8978b09236ee5aabbc29bfb251c47b904bfc2c1"><code>e8978b0</code></a> mention dotenvx in runtime message to point people to safer .env files</li> <li><a href="https://github.com/motdotla/dotenv/commit/661b247fb94e9027a05ae814eab4409c2e758e8a"><code>661b247</code></a> update README with <code>quiet</code> option</li> <li>Additional commits viewable in <a href="https://github.com/motdotla/dotenv/compare/v16.4.7...v17.0.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dotenv&package-manager=npm_and_yarn&previous-version=16.4.7&new-version=17.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>