🔒dotenv-ng 1.0 Released With Major Security Fixes
dotenv-ng's new version breaks compatibility for security reasons
TL;DR
dotenv-ng 1.0 is out with major changes to improve security, including breaking compatibility where necessary. The update fixes a secret parsing issue and introduces stricter validation rules.
dotenv-ng version 1.0 has been released, breaking compatibility with previous versions for the sake of correctness and security. This new release addresses a critical issue where dotenvy's parser changed secrets while reading them, leading to immediate failure due to SecretSpec issue #73. If you're using dotenv files with bcrypt fragments or any other complex syntax, this update is crucial as it ensures that literal dollar signs are treated literally rather than as variable substitutions. The new version starts from dotenvy 0.15.7 but deliberately breaks compatibility where correctness requires it, adding a source-aware parser and structured errors for better validation before process-environment mutation.
Key Points
dotenv-ng version 1.0 released on March 22, 2023, addressing critical parsing issues.
The new parser treats literal dollar signs as literals and supports broader key grammar including dashes and Unicode.
Validation occurs before process-environment mutation with an explicit unsafe boundary surrounding mutations.
Property tests exercise arbitrary Unicode and syntax-heavy values ensuring 100% line coverage in the parser/renderer.
Applications can keep using 'dotenv' crate name with a dependency alias: [dependencies]dotenv = { package = "dotenv-ng", version = "1" }.
Why It Matters
If you're managing complex dotenv files or handling secrets, dotenv-ng's new version is critical. The update fixes a dangerous secret parsing issue and introduces stricter validation rules that prevent unintended variable substitutions. This change impacts anyone using Rust applications with environment variables, ensuring safer deployment practices.
Frequently Asked Questions
Why does this matter?
If you're managing complex dotenv files or handling secrets, dotenv-ng's new version is critical. The update fixes a dangerous secret parsing issue and introduces stricter validation rules that prevent unintended variable substitutions. This change impacts anyone using Rust applications with environment variables, ensuring safer deployment practices.
What happened?
dotenv-ng 1.0 is out with major changes to improve security, including breaking compatibility where necessary. The update fixes a secret parsing issue and introduces stricter validation rules.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,131 builders reading daily.