[PR #525] [CLOSED] Bump dotenv from 16.4.7 to 17.2.0 #539

New issue

Closed

opened 2026-03-03 13:55:01 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 13:55:01 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/jehna/humanify/pull/525
Author: @dependabot[bot]
Created: 7/10/2025
Status: ❌ Closed

Base: main ← Head: dependabot/npm_and_yarn/dotenv-17.2.0

📝 Commits (1)

2dfa52e Bump dotenv from 16.4.7 to 17.2.0

📊 Changes

2 files changed (+5 additions, -5 deletions)

View changed files

📝 package-lock.json (+4 -4)
📝 package.json (+1 -1)

📄 Description

Bumps dotenv from 16.4.7 to 17.2.0.

Changelog

Sourced from dotenv's changelog.

17.2.0 (2025-07-09)

Added

Optionally specify DOTENV_CONFIG_QUIET=true in your environment or .env file to quiet the runtime log (#889)

Just like dotenv any DOTENV_CONFIG_ environment variables take precedence over any code set options like ({quiet: false})
# .env
DOTENV_CONFIG_QUIET=true
HELLO="World"
// index.js
require('dotenv').config()
console.log(`Hello ${process.env.HELLO}`)
$ node index.js
Hello World
or
$ DOTENV_CONFIG_QUIET=true node index.js
17.1.0 (2025-07-07)

Added

Add additional security and configuration tips to the runtime log (#884)

Dim the tips text from the main injection information text
const TIPS = [
  '🔐 encrypt with dotenvx: https://dotenvx.com',
  '🔐 prevent committing .env to code: https://dotenvx.com/precommit',
  '🔐 prevent building .env in docker: https://dotenvx.com/prebuild',
  '🛠️  run anywhere with `dotenvx run -- yourcommand`',
  '⚙️  specify custom .env file path with { path: \'/custom/path/.env\' }',
  '⚙️  enable debug logging with { debug: true }',
  '⚙️  override existing env vars with { override: true }',
  '⚙️  suppress all logs with { quiet: true }',
  '⚙️  write to custom object with { processEnv: myObject }',
  '⚙️  load multiple .env files with { path: [\'.env.local\', \'.env\'] }'
]
17.0.1 (2025-07-01)

... (truncated)

Commits

11acd9f 17.2.0
40e26e9 Merge pull request #889 from motdotla/env-quiet
e99c367 clean up
281354e changelog 🪵
d856497 smarter DOTENV_CONFIG_QUIET option that can read from source .env file
203c4e8 support passing DOTENV_CONFIG_QUIET=true (and other DOTENV_CONFIG options - s...
13bc310 17.1.0
0bc76fe add to test coverage
a43eecf changelog 🪵
956638e adjust test
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/jehna/humanify/pull/525 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 7/10/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `dependabot/npm_and_yarn/dotenv-17.2.0` --- ### 📝 Commits (1) - [`2dfa52e`](https://github.com/jehna/humanify/commit/2dfa52e31160cceb974fdf5089119f71472a7c44) Bump dotenv from 16.4.7 to 17.2.0 ### 📊 Changes **2 files changed** (+5 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `package-lock.json` (+4 -4) 📝 `package.json` (+1 -1) </details> ### 📄 Description Bumps [dotenv](https://github.com/motdotla/dotenv) from 16.4.7 to 17.2.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md">dotenv's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/motdotla/dotenv/compare/v17.1.0...v17.2.0">17.2.0</a> (2025-07-09)</h2> <h3>Added</h3> <ul> <li>Optionally specify <code>DOTENV_CONFIG_QUIET=true</code> in your environment or <code>.env</code> file to quiet the runtime log (<a href="https://redirect.github.com/motdotla/dotenv/pull/889">#889</a>)</li> <li>Just like dotenv any <code>DOTENV_CONFIG_</code> environment variables take precedence over any code set options like <code>({quiet: false})</code></li> </ul> <pre lang="ini"><code># .env DOTENV_CONFIG_QUIET=true HELLO="World" </code></pre> <pre lang="js"><code>// index.js require('dotenv').config() console.log(`Hello ${process.env.HELLO}`) </code></pre> <pre lang="sh"><code>$ node index.js Hello World <p>or</p> <p>$ DOTENV_CONFIG_QUIET=true node index.js </code></pre></p> <h2><a href="https://github.com/motdotla/dotenv/compare/v17.0.1...v17.1.0">17.1.0</a> (2025-07-07)</h2> <h3>Added</h3> <ul> <li>Add additional security and configuration tips to the runtime log (<a href="https://redirect.github.com/motdotla/dotenv/pull/884">#884</a>)</li> <li>Dim the tips text from the main injection information text</li> </ul> <pre lang="js"><code>const TIPS = [ '🔐 encrypt with dotenvx: https://dotenvx.com', '🔐 prevent committing .env to code: https://dotenvx.com/precommit', '🔐 prevent building .env in docker: https://dotenvx.com/prebuild', '🛠️ run anywhere with `dotenvx run -- yourcommand`', '⚙️ specify custom .env file path with { path: \'/custom/path/.env\' }', '⚙️ enable debug logging with { debug: true }', '⚙️ override existing env vars with { override: true }', '⚙️ suppress all logs with { quiet: true }', '⚙️ write to custom object with { processEnv: myObject }', '⚙️ load multiple .env files with { path: [\'.env.local\', \'.env\'] }' ] </code></pre> <h2><a href="https://github.com/motdotla/dotenv/compare/v17.0.0...v17.0.1">17.0.1</a> (2025-07-01)</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/motdotla/dotenv/commit/11acd9fc33ee81b2bfbf8ef5924c800a7454a8dd"><code>11acd9f</code></a> 17.2.0</li> <li><a href="https://github.com/motdotla/dotenv/commit/40e26e973e282e2355be84b64d1d7d41ac5737a9"><code>40e26e9</code></a> Merge pull request <a href="https://redirect.github.com/motdotla/dotenv/issues/889">#889</a> from motdotla/env-quiet</li> <li><a href="https://github.com/motdotla/dotenv/commit/e99c3677ca1dff3839466b4961681f5d0c0205b1"><code>e99c367</code></a> clean up</li> <li><a href="https://github.com/motdotla/dotenv/commit/281354e4655cd773acc57d269c447f4c29d28387"><code>281354e</code></a> changelog 🪵</li> <li><a href="https://github.com/motdotla/dotenv/commit/d856497297c504394bbb16e3d816627e8b27dcb6"><code>d856497</code></a> smarter DOTENV_CONFIG_QUIET option that can read from source .env file</li> <li><a href="https://github.com/motdotla/dotenv/commit/203c4e8882ad1b4a35b2a52e660126ce14c68692"><code>203c4e8</code></a> support passing DOTENV_CONFIG_QUIET=true (and other DOTENV_CONFIG options - s...</li> <li><a href="https://github.com/motdotla/dotenv/commit/13bc310c4854c336ce7a0949e5e622e57d9d4bdf"><code>13bc310</code></a> 17.1.0</li> <li><a href="https://github.com/motdotla/dotenv/commit/0bc76feb6f956072396e4d13437d837c2fc22e69"><code>0bc76fe</code></a> add to test coverage</li> <li><a href="https://github.com/motdotla/dotenv/commit/a43eecfd21763a5f7e17f6aa72a474885899e9d1"><code>a43eecf</code></a> changelog 🪵</li> <li><a href="https://github.com/motdotla/dotenv/commit/956638e75b042c98dcfa2a02816a5b60b2636f7f"><code>956638e</code></a> adjust test</li> <li>Additional commits viewable in <a href="https://github.com/motdotla/dotenv/compare/v16.4.7...v17.2.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dotenv&package-manager=npm_and_yarn&previous-version=16.4.7&new-version=17.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>