--- title: "dotenv Breaking Changes on npm | Since.dev" description: "What each dotenv release removed, renamed or changed: 10 breaking changes in 2 versions on npm, each with its source." canonical_url: https://since.dev/packages/npm/dotenv last_updated: 2026-09-17 --- # dotenv breaking changes Every breaking API change we have recorded in dotenv on npm: 10 breaking changes in 2 versions. Below are its newest 2 versions, removals and renames first, each with its source. Newest change September 17, 2026 ## 18.0.0 9 breaking changes, first published September 17, 2026. - **Removed** Support for .env.vault files is removed. Projects relying on .env.vault must switch to another way of loading their environment. [github.com](https://github.com/motdotla/dotenv/blob/v18.0.0/CHANGELOG.md) - **Removed** Preloading dotenv is removed. Use the CLI command instead to run your program with environment variables loaded. [github.com](https://github.com/motdotla/dotenv/blob/v18.0.0/CHANGELOG.md) - **Removed** The tips printed by dotenv are removed. Code that depends on that output will no longer see it. [github.com](https://github.com/motdotla/dotenv/blob/v18.0.0/CHANGELOG.md) - **Removed** `decrypt` decrypt was removed in dotenv 18.0.0 [npmjs.com](https://www.npmjs.com/package/dotenv/v/18.0.0) - **Removed** `DotenvConfigOptions.DOTENV_KEY` DotenvConfigOptions.DOTENV_KEY was removed in dotenv 18.0.0 [npmjs.com](https://www.npmjs.com/package/dotenv/v/18.0.0) - **Behavior changed** The injected-env message is printed to stderr rather than stdout. Code or scripts that read stdout for this message must read stderr instead. [github.com](https://github.com/motdotla/dotenv/blob/v18.0.0/CHANGELOG.md) - **Signature changed** `DotenvError` Was type DotenvError = Error & {code: | 'MISSING_DATA' | 'INVALID_DOTENV_KEY' | 'NOT_FOUND_DOTENV_ENVIRONMENT' | 'DECRYPTION_FAILED' | 'OBJECT_REQUIRED';}; now type DotenvError = Error & {code: 'OBJECT_REQUIRED' | (string & {});}. [npmjs.com](https://www.npmjs.com/package/dotenv/v/18.0.0) - **Signature changed** `DotenvError.code` Was code: | 'MISSING_DATA' | 'INVALID_DOTENV_KEY' | 'NOT_FOUND_DOTENV_ENVIRONMENT' | 'DECRYPTION_FAILED' | 'OBJECT_REQUIRED'; now code: 'OBJECT_REQUIRED' | (string & {}). [npmjs.com](https://www.npmjs.com/package/dotenv/v/18.0.0) - **Signature changed** `parse` Was function parse(src: string | Buffer): T; now function parse(src: string | Buffer, options?: DotenvParseOptions): T. [npmjs.com](https://www.npmjs.com/package/dotenv/v/18.0.0) ## 17.0.0 1 breaking change, first published June 27, 2025. - **Default changed** `quiet` The default for quiet changed to false, so the file and keys count log message now appears unless you set quiet to true. [github.com](https://github.com/motdotla/dotenv/blob/v17.0.0/CHANGELOG.md) ## Check your code These are the changes. To see which of them reach your code, [scan a public repository](https://since.dev/scan.md), or have your coding agent call `check_code` with your manifest or lockfile over [MCP](https://since.dev/docs.md#mcp). [The API](https://since.dev/docs.md#api) reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys. ## Put your code on continuous management. Scan a public repository now, or give your agent one line. ### See how out of date your code is. [Scan a repository](https://since.dev/scan.md). Any public GitHub repository. No sign-in. ### Tell your agent what changed since it was trained. `claude mcp add --transport http since https://api.since.dev/mcp` --- Every page on this site as Markdown: https://since.dev/sitemap.md. For agents: https://since.dev/llms.txt.