TECH Signal 604 2 feeds carried it
dotenv-ng 1.0 forks from dotenvy, defaults to literal dollar signs over variable substitution
↗
SecretSpec released dotenv-ng 1.0, a fork of dotenvy that fixes a parser bug where dollar-prefixed values like bcrypt hashes were silently altered as variable substitutions.
dotenvy's parser silently corrupts values containing dollar signs by treating them as variable substitutions, and the project hasn't released in over three years. dotenv-ng makes substitution opt-in, adds structured errors, and validates before mutating the process environment, giving teams a maintained alternative that reads .env files correctly.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
dotenvy's parser silently changes values with dollar signs by treating them as variable substitutions, causing authentication failures rather than parse errors.
dotenv-ng 1.0 defaults to literal dollar signs, requires explicit opt-in for substitution, and adds validation before process-environment mutation.
The package is available on crates.io and can be aliased to the familiar dotenv dependency name.
THE CLUSTER