Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for backticks #615

Merged
merged 2 commits into from Feb 2, 2022
Merged

Add support for backticks #615

merged 2 commits into from Feb 2, 2022

Conversation

motdotla
Copy link
Owner

@motdotla motdotla commented Feb 2, 2022

No description provided.

@motdotla motdotla merged commit bd26c38 into master Feb 2, 2022
@motdotla motdotla deleted the backtick-support branch February 2, 2022 21:20
@s100
Copy link

s100 commented Feb 3, 2022

Was it necessary to bump the major version number for this? Normally, adding a new feature isn't a breaking change.

@T0biii
Copy link

T0biii commented Feb 3, 2022

@s100 i think it is a breaking change see also: "If you had values containing the backtick character, please quote those values with either single or double quotes."
https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md

@motdotla
Copy link
Owner Author

motdotla commented Feb 3, 2022

@s100 it is a good point you raise. The difficulty with the nature of this repo (and we err on the side of safety) is that a regex change on the parser can break edge cases for users of the older version.

For example, in this case there could be users out there with a value like this:

KEY=ab`cd

@mo
Copy link

mo commented Feb 6, 2022

@motdotla what are the security implications of backtick support?

@motdotla
Copy link
Owner Author

motdotla commented Feb 6, 2022

@mo great question, Mo. Also great short handle!

There is no execution of variables (as there is in node template variables), so there are no additional security implications here.

The backticks simply act as a parsing wrapper - like single or double quotes.

Vylpes pushed a commit to Vylpes/Droplet that referenced this pull request Sep 14, 2023
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [dotenv](https://github.com/motdotla/dotenv) | dependencies | major | [`^10.0.0` -> `^16.0.0`](https://renovatebot.com/diffs/npm/dotenv/10.0.0/16.0.3) |

---

### Release Notes

<details>
<summary>motdotla/dotenv</summary>

### [`v16.0.3`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1603-httpsgithubcommotdotladotenvcomparev1602v1603-2022-09-29)

[Compare Source](motdotla/dotenv@v16.0.2...v16.0.3)

##### Changed

-   Added library version to debug logs ([#&#8203;682](motdotla/dotenv#682))

### [`v16.0.2`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1602-httpsgithubcommotdotladotenvcomparev1601v1602-2022-08-30)

[Compare Source](motdotla/dotenv@v16.0.1...v16.0.2)

##### Added

-   Export `env-options.js` and `cli-options.js` in package.json for use with downstream [dotenv-expand](https://github.com/motdotla/dotenv-expand) module

### [`v16.0.1`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1601-httpsgithubcommotdotladotenvcomparev1600v1601-2022-05-10)

[Compare Source](motdotla/dotenv@v16.0.0...v16.0.1)

##### Changed

-   Minor README clarifications
-   Development ONLY: updated devDependencies as recommended for development only security risks ([#&#8203;658](motdotla/dotenv#658))

### [`v16.0.0`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1600-httpsgithubcommotdotladotenvcomparev1501v1600-2022-02-02)

[Compare Source](motdotla/dotenv@v15.0.1...v16.0.0)

##### Added

-   *Breaking:* Backtick support 🎉 ([#&#8203;615](motdotla/dotenv#615))

If you had values containing the backtick character, please quote those values with either single or double quotes.

### [`v15.0.1`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1501-httpsgithubcommotdotladotenvcomparev1500v1501-2022-02-02)

[Compare Source](motdotla/dotenv@v15.0.0...v15.0.1)

##### Changed

-   Properly parse empty single or double quoted values 🐞 ([#&#8203;614](motdotla/dotenv#614))

### [`v15.0.0`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1500-httpsgithubcommotdotladotenvcomparev1432v1500-2022-01-31)

[Compare Source](motdotla/dotenv@v14.3.2...v15.0.0)

`v15.0.0` is a major new release with some important breaking changes.

##### Added

-   *Breaking:* Multiline parsing support (just works. no need for the flag.)

##### Changed

-   *Breaking:* `#` marks the beginning of a comment (UNLESS the value is wrapped in quotes. Please update your `.env` files to wrap in quotes any values containing `#`. For example: `SECRET_HASH="something-with-a-#-hash"`).

..Understandably, (as some teams have noted) this is tedious to do across the entire team. To make it less tedious, we recommend using [dotenv cli](https://github.com/dotenv-org/cli) going forward. It's an optional plugin that will keep your `.env` files in sync between machines, environments, or team members.

##### Removed

-   *Breaking:* Remove multiline option (just works out of the box now. no need for the flag.)

### [`v14.3.2`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1432-httpsgithubcommotdotladotenvcomparev1431v1432-2022-01-25)

[Compare Source](motdotla/dotenv@v14.3.1...v14.3.2)

##### Changed

-   Preserve backwards compatibility on values containing `#` 🐞 ([#&#8203;603](motdotla/dotenv#603))

### [`v14.3.1`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1431-httpsgithubcommotdotladotenvcomparev1430v1431-2022-01-25)

[Compare Source](motdotla/dotenv@v14.3.0...v14.3.1)

##### Changed

-   Preserve backwards compatibility on exports by re-introducing the prior in-place exports 🐞 ([#&#8203;606](motdotla/dotenv#606))

### [`v14.3.0`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1430-httpsgithubcommotdotladotenvcomparev1420v1430-2022-01-24)

[Compare Source](motdotla/dotenv@v14.2.0...v14.3.0)

##### Added

-   Add `multiline` option 🎉 ([#&#8203;486](motdotla/dotenv#486))

### [`v14.2.0`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1420-httpsgithubcommotdotladotenvcomparev1411v1420-2022-01-17)

[Compare Source](motdotla/dotenv@v14.1.1...v14.2.0)

##### Added

-   Add `dotenv_config_override` cli option
-   Add `DOTENV_CONFIG_OVERRIDE` command line env option

### [`v14.1.1`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1411-httpsgithubcommotdotladotenvcomparev1410v1411-2022-01-17)

[Compare Source](motdotla/dotenv@v14.1.0...v14.1.1)

##### Added

-   Add React gotcha to FAQ on README

### [`v14.1.0`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1410-httpsgithubcommotdotladotenvcomparev1401v1410-2022-01-17)

[Compare Source](motdotla/dotenv@v14.0.1...v14.1.0)

##### Added

-   Add `override` option 🎉 ([#&#8203;595](motdotla/dotenv#595))

### [`v14.0.1`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1401-httpsgithubcommotdotladotenvcomparev1400v1401-2022-01-16)

[Compare Source](motdotla/dotenv@v14.0.0...v14.0.1)

##### Added

-   Log error on failure to load `.env` file ([#&#8203;594](motdotla/dotenv#594))

### [`v14.0.0`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1400-httpsgithubcommotdotladotenvcomparev1301v1400-2022-01-16)

[Compare Source](motdotla/dotenv@v13.0.1...v14.0.0)

##### Added

-   *Breaking:* Support inline comments for the parser 🎉 ([#&#8203;568](motdotla/dotenv#568))

### [`v13.0.1`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1301-httpsgithubcommotdotladotenvcomparev1300v1301-2022-01-16)

[Compare Source](motdotla/dotenv@v13.0.0...v13.0.1)

##### Changed

-   Hide comments and newlines from debug output ([#&#8203;404](motdotla/dotenv#404))

### [`v13.0.0`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1300-httpsgithubcommotdotladotenvcomparev1204v1300-2022-01-16)

[Compare Source](motdotla/dotenv@v12.0.4...v13.0.0)

##### Added

-   *Breaking:* Add type file for `config.js` ([#&#8203;539](motdotla/dotenv#539))

### [`v12.0.4`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1204-httpsgithubcommotdotladotenvcomparev1203v1204-2022-01-16)

[Compare Source](motdotla/dotenv@v12.0.3...v12.0.4)

##### Changed

-   README updates
-   Minor order adjustment to package json format

### [`v12.0.3`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1203-httpsgithubcommotdotladotenvcomparev1202v1203-2022-01-15)

[Compare Source](motdotla/dotenv@v12.0.2...v12.0.3)

##### Changed

-   Simplified jsdoc for consistency across editors

### [`v12.0.2`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1202-httpsgithubcommotdotladotenvcomparev1201v1202-2022-01-15)

[Compare Source](motdotla/dotenv@v12.0.1...v12.0.2)

##### Changed

-   Improve embedded jsdoc type documentation

### [`v12.0.1`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1201-httpsgithubcommotdotladotenvcomparev1200v1201-2022-01-15)

[Compare Source](motdotla/dotenv@v12.0.0...v12.0.1)

##### Changed

-   README updates and clarifications

### [`v12.0.0`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1200-httpsgithubcommotdotladotenvcomparev1100v1200-2022-01-15)

[Compare Source](motdotla/dotenv@v11.0.0...v12.0.0)

##### Removed

-   *Breaking:* drop support for Flow static type checker ([#&#8203;584](motdotla/dotenv#584))

##### Changed

-   Move types/index.d.ts to lib/main.d.ts ([#&#8203;585](motdotla/dotenv#585))
-   Typescript cleanup ([#&#8203;587](motdotla/dotenv#587))
-   Explicit typescript inclusion in package.json ([#&#8203;566](motdotla/dotenv#566))

### [`v11.0.0`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#&#8203;1100-httpsgithubcommotdotladotenvcomparev1000v1100-2022-01-11)

[Compare Source](motdotla/dotenv@v10.0.0...v11.0.0)

##### Changed

-   *Breaking:* drop support for Node v10 ([#&#8203;558](motdotla/dotenv#558))
-   Patch debug option ([#&#8203;550](motdotla/dotenv#550))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC43NC4yIiwidXBkYXRlZEluVmVyIjoiMzQuNzQuMiJ9-->

Co-authored-by: Renovate Bot <renovate@vylpes.com>
Reviewed-on: https://gitea.vylpes.xyz/RabbitLabs/Droplet/pulls/105
Reviewed-by: Vylpes <ethan@vylpes.com>
Co-authored-by: RenovateBot <renovate@vylpes.com>
Co-committed-by: RenovateBot <renovate@vylpes.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants