dotenv breaking changes

18.0.0

9 breaking changes, first published September 17, 2026.

• Removed
  Support for .env.vault files is removed. Projects relying on .env.vault must switch to another way of loading their environment. github.com
• Removed
  Preloading dotenv is removed. Use the CLI command instead to run your program with environment variables loaded. github.com
• Removed
  The tips printed by dotenv are removed. Code that depends on that output will no longer see it. github.com
• Removed decrypt
  decrypt was removed in dotenv 18.0.0 npmjs.com
• Removed DotenvConfigOptions.DOTENV_KEY
  DotenvConfigOptions.DOTENV_KEY was removed in dotenv 18.0.0 npmjs.com
• Behavior changed
  The injected-env message is printed to stderr rather than stdout. Code or scripts that read stdout for this message must read stderr instead. github.com
• Signature changed DotenvError
  Was type DotenvError = Error & {code: | 'MISSING_DATA' | 'INVALID_DOTENV_KEY' | 'NOT_FOUND_DOTENV_ENVIRONMENT' | 'DECRYPTION_FAILED' | 'OBJECT_REQUIRED';}; now type DotenvError = Error & {code: 'OBJECT_REQUIRED' | (string & {});}. npmjs.com
• Signature changed DotenvError.code
  Was code: | 'MISSING_DATA' | 'INVALID_DOTENV_KEY' | 'NOT_FOUND_DOTENV_ENVIRONMENT' | 'DECRYPTION_FAILED' | 'OBJECT_REQUIRED'; now code: 'OBJECT_REQUIRED' | (string & {}). npmjs.com
• Signature changed parse
  Was function parse<T extends DotenvParseOutput = DotenvParseOutput>(src: string | Buffer): T; now function parse<T extends DotenvParseOutput = DotenvParseOutput>(src: string | Buffer, options?: DotenvParseOptions): T. npmjs.com

17.0.0

1 breaking change, first published June 27, 2025.

• Default changed quiet
  The default for quiet changed to false, so the file and keys count log message now appears unless you set quiet to true. github.com

Check your code

These are the changes. To see which of them reach your code, scan a public repository, or have your coding agent call check_code with your manifest or lockfile over MCP. The API reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys.