[dependabot]

Bumps @dotenvx/dotenvx from 2.21.0 to 2.38.0.

Release notes

Sourced from @​dotenvx/dotenvx's releases.

v2.38.0

see CHANGELOG

v2.37.0

see CHANGELOG

v2.36.0

see CHANGELOG

v2.35.0

see CHANGELOG

v2.34.2

see CHANGELOG

v2.34.1

see CHANGELOG

v2.34.0

see CHANGELOG

v2.33.0

see CHANGELOG

v2.32.4

see CHANGELOG

v2.32.3

see CHANGELOG

v2.32.2

see CHANGELOG

v2.32.1

see CHANGELOG

v2.32.0

see CHANGELOG

v2.31.1

see CHANGELOG

v2.31.0

see CHANGELOG

v2.30.0

see CHANGELOG

v2.29.0

see CHANGELOG

... (truncated)

Changelog

Sourced from @​dotenvx/dotenvx's changelog.

2.38.0 (2026-10-16)

Added

• Add getSync convenience (#1029)

Changed

• Default to file key storage in non-interactive mode (#1028)

2.37.0 (2026-10-15)

Added

• New: Dotenvx Armor Enclaved Keys - software enclaved on the remote provider like Vercel, GitHub Actions, and more. (#1026)

⛨ Choose key type …
  ⛨ Armored
❯ ◊ Enclaved

2.36.0 (2026-10-14)

Added

• Add dotenvx armor invite command (#1025)

2.35.0 (2026-10-13)

Added

• Add encrypt --with to bring public key. Useful for Dotenvx Armor's new remote enclaved private keys. Encrypt locally but decrypt only on the remote software enclave. Private keys never leave. (#1022)

Changed

• Use atomic file writes in protect (#1019)

2.34.2 (2026-10-09)

Changed

• Patch: fix atomic edge case of writing .env and .env.keys file (#1014)

2.34.1 (2026-10-08)

Changed

• Patch: don't write public key on ctrl+c or prompt failure (#1009)

... (truncated)

Commits

• 5132af9 2.38.0
• f735c14 changelog
• a7bccf8 Merge pull request #1029 from dotenvx/getSync
• ef576ee add getSync
• c8a034b changelog
• f0f50ce Merge pull request #1028 from dotenvx/default-keys
• 9df7972 fix: default to file key storage in non-interactive mode
• 20b0d1e 2.37.0
• 15f6140 Changelog
• f1da5ea Merge pull request #1026 from dotenvx/enclaved-key
• Additional commits viewable in compare view

[davidwkeith]

Automated review of the dotenvx 2.21.0 → 2.32.3 bump

The diff itself is correct. It touches only packages/server/package.json (pinned to the exact version, as CLAUDE.md requires) and pnpm-lock.yaml. I'd hold the merge until the items below are checked.

Should be verified before merge

1. Breaking changes between 2.21 and 2.32. The 2.32.0 release notes mark Envfile → Envspec, and removal of dotenvx init (now dotenvx spec), as BREAKING. 2.32.3 also renames the file to Dotenvspec and changes CLI startup.
2. @dwk/server relies on dotenvx internals. docs/superpowers/specs/2026-07-27-server-dotenv-support-design.md §3 depends on dotenvx's keynames.js filename-derivation behaviour for <domain>.env private-key names. It also depends on config({ path: [...], quiet: true }) path precedence. Please confirm the server's dotenv tests, including the real-CLI encrypted-value test, still pass. Wait for build-test to finish green rather than assuming. If key-name derivation changed, the doc's workflow needs updating too.
   2b. Docs still pin the old version. docs/superpowers/plans/2026-07-27-server-dotenv-support.md mentions 2.19.0. It is a historical plan, so this is probably fine to leave.

Supply-chain and footprint notes

• @dotenvx/primitives jumps 2.2.0 → 3.0.3, a major bump, as a transitive dependency.
• New transitive dependencies for a private, Docker-only package:
  • [email protected].
  • global-agent → roarr/boolean. The lockfile flags [email protected] as deprecated ("Package no longer supported").
  • [email protected].
• The lockfile also bumps unrelated packages: postcss, nanoid, picomatch, source-map-js and @napi-rs/wasm-runtime. These are likely resolver churn, but they widen the blast radius for what is nominally a one-package change. Please confirm the root build and tests are unaffected.
• Because @dwk/server ships as a Docker image, check the image job. Also confirm the bundle step (dist-bundle) still handles node-forge/global-agent.

CONTRIBUTING.md and CLAUDE.md conformance

• Title: chore(deps): … is valid Conventional Commits. CLAUDE.md asks the scope to be the package name without the @dwk/ prefix, so chore(server): bump @dotenvx/dotenvx to 2.32.3 would match the convention more closely. deps is Dependabot's default and probably acceptable, but consider renaming at squash time.
• Body: it doesn't follow .github/PULL_REQUEST_TEMPLATE.md (Summary / Packages affected / Checklist). That is expected for a Dependabot PR. Please fill in those sections before the squash-merge if you want the repo convention honoured.
• Changeset: none is included. @dwk/server is "private": true and never published, so none should be needed. Confirm pnpm changeset status is happy.
• Local CI gate: lint → format:check → typecheck → build → test must all pass. Only build-test and the image job are still running. Don't merge on a lockfile-only change before they finish.
• Review threads: none exist yet. Resolve any that appear before merging.

Recommendation: hold until build-test and image are green, with explicit confirmation that the server's dotenv encryption and key-name tests pass on 2.32.3.

---

Generated by Claude Code