● Covered by 1 source · 1 reportLow impact1 neutral
SecretSpec forks dotenvy into dotenv-ng 1.0 for improved .env file parsing in Rust
Key points
- SecretSpec released dotenv-ng 1.0, a fork of dotenvy.
- The fork addresses a bug where dotenvy altered secret values during parsing.
- dotenv-ng 1.0 includes a source-aware parser and explicit substitution control.
- It also supports broader key grammar and validated environment mutation.
Introduction of dotenv-ng 1.0
SecretSpec has announced the release of `dotenv-ng` 1.0, a new Rust implementation for loading and rendering `.env` files. This project originated as a fork of the existing `dotenvy` crate, aiming to resolve specific parsing inaccuracies that affected secret handling.
Addressing Parsing Inaccuracies
The primary motivation for the fork was a critical issue (SecretSpec issue #73) where `dotenvy` incorrectly interpreted dollar-prefixed fragments within secret values as variable substitutions, leading to altered data. This problem resulted in authentication failures that were difficult to diagnose, as the file was read incorrectly without generating a parse error.
An upstream request to make substitution configurable in `dotenvy` had been open since 2024, with a pull request submitted in 2026 that targeted an unreleased API. SecretSpec determined that a migration tool could not require users to manually escape parser syntax within their secrets.
Maintenance and Development Context
The original Rust `dotenv` crate ceased releases in 2020 and was subsequently marked unmaintained by RustSec, which then recommended `dotenvy` as an alternative. Despite `dotenvy` being described as a "well-maintained fork," its latest published version, 0.15.7, was released in March 2023, creating a significant release gap by the time SecretSpec encountered its parsing bug. This situation highlighted a recurring maintenance challenge in the `dotenv` ecosystem.
Key Features of dotenv-ng 1.0
`dotenv-ng` 1.0 builds upon `dotenvy` 0.15.7 but introduces several breaking compatibility changes for correctness. New features include a source-aware parser with structured errors, literal dollar signs by default (with optional explicit substitution), and a broader key grammar supporting dashes, leading digits, leading dots, and Unicode. It also features a renderer that preserves value integrity, validation before process-environment mutation, and an explicit `unsafe` boundary around mutation operations. Property tests ensure robustness across various Unicode and syntax inputs.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
SecretSpec has forked the `dotenvy` Rust crate, releasing `dotenv-ng` 1.0 to address issues with `.env` file parsing, particularly regarding secret values and variable substitution. This new implementation aims to provide a more robust and correct way to load `.env` files, which is critical for applications that rely on them for configuration.