[dependabot]

Bumps @dotenvx/dotenvx from 2.21.0 to 2.28.0.

Release notes

Sourced from @​dotenvx/dotenvx's releases.

v2.28.0

see CHANGELOG

v2.27.0

see CHANGELOG

v2.26.1

see CHANGELOG

v2.26.0

see CHANGELOG

v2.25.0

see CHANGELOG

v2.24.1

see CHANGELOG

v2.24.0

see CHANGELOG

v2.23.0

see CHANGELOG

v2.22.0

see CHANGELOG

Changelog

Sourced from @​dotenvx/dotenvx's changelog.

2.28.0 (2026-09-16)

Added

• Choose where you custody your keys (#972)

Your private key
├── ⛉ Local Custody
│   ├── OS (macOS Keychain / Windows Credential Manager / Linux Secret Service)
│   ├── 1Password
│   ├── Bitwarden
│   └── File (.env.keys)
└── ⛊ Managed Custody
    └── ⛨ Armor

2.27.0 (2026-09-16)

Removed

• BREAKING: Removed run --validate flag and validate command against .env.example file. To be replaced soon with a modern validation scheme.

2.26.1 (2026-09-15)

Changed

• Add dotenvx 1password up|down|push|pull and dotenvx bitwarden up|down|push|pull (#969)

2.26.0 (2026-09-15)

Added

• Add support for storing private key to bitwarden or 1password (#968)

2.25.0 (2026-09-14)

Changed

• Store private key to os secret store rather than .env.keys by default (#967)

2.24.1 (2026-09-11)

Changed

• Upgraded to latest @​dotenvx/primitives

2.24.0 (2026-09-10)

Changed

... (truncated)

Commits

• 7cf6ddb 2.28.0
• b7af246 changelog
• 4610e6d Merge pull request #972 from dotenvx/encryption-choice
• 41505be encryption choice
• e22ff70 select key storage on encrypt
• abd060f 2.27.0
• e33f1ce Merge pull request #971 from dotenvx/gw
• 1723252 latest
• bf331f0 changelog
• c9909c5 clean up error
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[davidwkeith]

Reviewed against CONTRIBUTING.md. This is a clean, low-risk bump — verified locally rather than just reading the diff:

Verified

• pnpm build (full monorepo, so @dwk/server's workspace deps resolve) — passes.
• pnpm test --project @dwk/server env (the suite exercising src/env.ts, the only place this repo touches the @dotenvx/dotenvx API) — 10/10 pass.
• pnpm --filter @dwk/server bundle — the Docker-bundling step CONTRIBUTING.md calls out as not covered by the standard lint/typecheck/build/test gate — succeeds.
• No changeset needed: @dwk/server is "private": true/never published, so this is correctly omitted per the "user-visible change to a publishable package" rule.
• The 2.27.0 changelog entry is a real breaking change (run --validate / validate command removed), but this repo doesn't call either — grepped packages/server for --validate/dotenvx validate, no hits.
• 2.25–2.28 added new key-custody backends (OS keychain, 1Password, Bitwarden, Armor). env.ts's load() already passes noNative, noArmor, no1Password, noBitwarden, so none of that surface is reachable here — confirmed the typecheck still accepts those option names against the new version.

Minor, non-blocking

• The new custody features pull in several new transitive deps (global-agent, node-forge, roarr, boolean, …) even though they're disabled at runtime — [email protected] is flagged deprecated by npm itself in pnpm-lock.yaml ("Package no longer supported"). Not actionable here (it's upstream's transitive dep, not a direct one), just worth knowing it's now in the tree for @dwk/server's bundle.
• PR title (chore(deps): bump …) and body are Dependabot's untouched defaults — scope is deps rather than server, and the body isn't from .github/PULL_REQUEST_TEMPLATE.md (no Summary/Packages affected/Checklist). CONTRIBUTING.md §6–7 technically calls for both, but .github/dependabot.yml has no commit-message customization and nothing auto-applies the template to bot PRs, so this looks like standing practice for every dependency PR in this repo rather than something specific to fix here.

No functional issues found — looks good to merge once CI is green.

---

Generated by Claude Code

[dependabot]

Superseded by #528.