[dependabot]

Bumps @dotenvx/dotenvx from 2.21.0 to 2.30.0.

Release notes

Sourced from @​dotenvx/dotenvx's releases.

v2.30.0

see CHANGELOG

v2.29.0

see CHANGELOG

v2.28.2

see CHANGELOG

v2.28.1

see CHANGELOG

v2.28.0

see CHANGELOG

v2.27.0

see CHANGELOG

v2.26.1

see CHANGELOG

v2.26.0

see CHANGELOG

v2.25.0

see CHANGELOG

v2.24.1

see CHANGELOG

v2.24.0

see CHANGELOG

v2.23.0

see CHANGELOG

v2.22.0

see CHANGELOG

Changelog

Sourced from @​dotenvx/dotenvx's changelog.

2.30.0 (2026-09-22)

Added

• Add support for secrets references as safe from dotenvx protect (#985)
• Add cli audit logging for Armor customers (#983)

2.29.0 (2026-09-21)

Added

• Add dotenvx protect to prevent plaintext .env files from being committed to code on a machine (#980)

Changed

• Deprecate dotenvx gitignore. Use dotenvx protect.
• Deprecate dotenvx precommit. Use dotenvx protect.
• Deprecate dotenvx prebuild. Use dotenvx protect --docker.

2.28.2 (2026-09-19)

Changed

• Only owner can write to and read from .env.keys file (#979)

2.28.1 (2026-09-19)

Changed

• Send pk via stdin to keychain. was argv. thank you @​kta1kri for the security report. (#978)
• Move some commands under a hidden menu (#973)

2.28.0 (2026-09-16)

Added

• Choose where you custody your keys (#972)

Your private key
├── ⛉ Local Custody
│   ├── OS (macOS Keychain / Windows Credential Manager / Linux Secret Service)
│   ├── 1Password
│   ├── Bitwarden
│   └── File (.env.keys)
└── ⛊ Managed Custody
    └── ⛨ Armor

2.27.0 (2026-09-16)

... (truncated)

Commits

• 6055cb5 2.30.0
• c191ada changelog
• 055506b Merge pull request #985 from dotenvx/update-sealed
• 8b418a0 support secrets references as safe to commit
• 7ba3b36 Merge pull request #983 from dotenvx/events
• 99cc435 test updates
• 5845a4a preserve large piped output
• da827f0 handle embedded cli
• 74e269e limit worker environment
• 5d20647 rewrite actions to return
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[davidwkeith]

Reviewed this Dependabot bump (@dotenvx/dotenvx 2.21.0 → 2.30.0 in packages/server, a private/unpublished package). A few notes against CONTRIBUTING.md:

Conventional Commits / squash-merge title (CONTRIBUTING.md §6)
The PR title chore(deps): bump @dotenvx/dotenvx from 2.21.0 to 2.30.0 uses deps as the scope. This repo's convention is scope = package name minus the @dwk/ prefix (fix(solid-pod): …), and since this repo squash-merges, the PR title is what lands permanently in git log. Only @dwk/server is touched here, so per the letter of the rule this should be retitled to something like chore(server): bump @dotenvx/dotenvx from 2.21.0 to 2.30.0 before merging. Since Dependabot generates this text automatically, consider adding a commit-message block to .github/dependabot.yml to template the scope, or just edit the title manually pre-merge.

PR body / template (CONTRIBUTING.md §7)
The body is Dependabot's default changelog dump rather than .github/PULL_REQUEST_TEMPLATE.md's Summary / Packages affected / Checklist sections. Not something Dependabot fills in on its own — flagging per the letter of the contributing guide, but this is presumably an accepted exception for bot PRs rather than something to fix here.

Changeset (CONTRIBUTING.md §5) — correctly omitted. @dwk/server is "private": true and never published, so no changeset is needed for this bump.

Dependency footprint worth a second look
@dotenvx/dotenvx 2.28.0–2.30.0 added the "Armor" managed-key-custody / dotenvx protect / CLI audit-logging features, and the lockfile diff shows several new transitive deps as a result: global-agent, node-forge, roarr, matcher, serialize-error, etc. [email protected] (pulled in via global-agent → roarr) is flagged deprecated by npm ("Package no longer supported").

• packages/server/src/env.ts only calls dotenvx's programmatic config()/parse(), not the CLI subcommands, so these new code paths are likely dead weight rather than something that executes — but worth confirming none of the new audit-logging/telemetry behavior fires during config()/parse(), given this project's self-hosted-only, no-phone-home design stance.
• global-agent globally patches the process's HTTP(S) agent based on env vars (GLOBAL_AGENT_HTTP_PROXY, etc.) when invoked — worth a quick check that nothing in dotenvx's config() path triggers that at import/call time in a way that could affect other outbound requests in the same process.

Test coupling to dotenvx internals
packages/server/src/env.test.ts resolves @dotenvx/dotenvx's CLI entry directly via require.resolve("@dotenvx/dotenvx/package.json") + src/cli/dotenvx.js. The 2.28.1 changelog notes "move some commands under a hidden menu," so it'd be good to confirm the build-test CI job (still running as of this review) actually passes — that path is exactly what would break silently if dotenvx restructured its CLI layout.

Nothing here blocks a patch/minor dependency bump outright, but the title should be fixed to match the repo's commit convention before this squash-merges, and it'd be worth a human sanity-check on the audit-logging/telemetry behavior given the project's self-hosting stance.

---

Generated by Claude Code

[dependabot]

Superseded by #532.