Repository navigation
Keep fast-parser unquoting consistent at Unicode line boundaries - #1073
Merged
Merged
Conversation
AI-assisted implementation and verification using OpenAI Codex.
Owner
|
nice catch! |
renovate Bot
added a commit
to andrei-picus-tink/auto-renovate
that referenced
this pull request
Oct 17, 2026
| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | npm | dotenv | 18.0.7 | 18.0.8 | ## [v18.0.8](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1808-2026-10-14) ##### Changed - Fast parser should strip appended extra quotes ([#1073](motdotla/dotenv#1073)) - Type detail improvement ([#1074](motdotla/dotenv#1074))
1 task
OIRNOIR
pushed a commit
to OIRNOIR/YouTube-Helper-Server
that referenced
this pull request
Oct 22, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [dotenv](https://github.com/motdotla/dotenv) | imports | patch | [`18.0.7` -> `18.0.8`](https://renovatebot.com/diffs/npm/dotenv/18.0.7/18.0.8) | --- ### Release Notes <details> <summary>motdotla/dotenv (dotenv)</summary> ### [`v18.0.8`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1808-2026-10-14) [Compare Source](motdotla/dotenv@v18.0.7...v18.0.8) ##### Changed - Fast parser should strip appended extra quotes ([#​1073](motdotla/dotenv#1073)) - Type detail improvement ([#​1074](motdotla/dotenv#1074)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjguMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE2OC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://git.oirnoir.dev/OIRNOIR/YouTube-Helper-Server/pulls/57
renovate Bot
added a commit
to andrei-picus-tink/auto-renovate
that referenced
this pull request
Oct 22, 2026
| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | npm | dotenv | 18.0.7 | 18.0.8 | ## [v18.0.8](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1808-2026-10-14) ##### Changed - Fast parser should strip appended extra quotes ([#1073](motdotla/dotenv#1073)) - Type detail improvement ([#1074](motdotla/dotenv#1074))
markharding
pushed a commit
to futo-org/Harbor
that referenced
this pull request
Oct 23, 2026
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [dotenv](https://github.com/motdotla/dotenv) | [`^17.4.2` → `^18.0.0`](https://renovatebot.com/diffs/npm/dotenv/17.4.2/18.0.8) |  |  | --- >⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/99) for more information. --- ### Release Notes <details> <summary>motdotla/dotenv (dotenv)</summary> ### [`v18.0.8`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1808-2026-10-14) [Compare Source](motdotla/dotenv@v18.0.7...v18.0.8) ##### Changed - Fast parser should strip appended extra quotes ([#​1073](motdotla/dotenv#1073)) - Type detail improvement ([#​1074](motdotla/dotenv#1074)) ### [`v18.0.7`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1807-2026-10-09) [Compare Source](motdotla/dotenv@v18.0.6...v18.0.7) ##### Changed - Treat undefined settings like `quiet: true` as null rather than falsey ([#​1070](motdotla/dotenv#1070)) - CLI should honor `DOTENV_QUIET` setting in `.env` file ([#​1071](motdotla/dotenv#1071)) ### [`v18.0.6`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1806-2026-10-06) [Compare Source](motdotla/dotenv@v18.0.5...v18.0.6) ##### Changed - Use smarter `parseBoolean` not Boolean() to fix override ([#​1069](motdotla/dotenv#1069)) ### [`v18.0.5`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1805-2026-09-30) [Compare Source](motdotla/dotenv@v18.0.4...v18.0.5) ##### Changed - Fix missing typescript module declaration ([#​1068](motdotla/dotenv#1068)) - Improve performance for large .env files ([#​1066](motdotla/dotenv#1066)) ### [`v18.0.4`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1804-2026-09-25) [Compare Source](motdotla/dotenv@v18.0.3...v18.0.4) ##### Changed - `import dotenv/config` should default quiet: true ([#​1063](motdotla/dotenv#1063)) ### [`v18.0.3`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1803-2026-09-22) [Compare Source](motdotla/dotenv@v18.0.2...v18.0.3) ##### Changed - Patch `DOTENV_QUIET` setting when inside .env file ([#​1059](motdotla/dotenv#1059)) ### [`v18.0.2`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1802-2026-09-21) [Compare Source](motdotla/dotenv@v18.0.1...v18.0.2) ##### Changed - Patch additional edge cases for the fast parser ([#​1056](motdotla/dotenv#1056)) ### [`v18.0.1`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1801-2026-09-18) [Compare Source](motdotla/dotenv@v18.0.0...v18.0.1) ##### Changed - Handle file urls in config logging ([#​1054](motdotla/dotenv#1054)) ### [`v18.0.0`](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1800-2026-09-17) [Compare Source](motdotla/dotenv@v17.4.2...v18.0.0) ##### Added - NEW: Dotenv now has a CLI. ([#​1022](motdotla/dotenv#1022)) ```sh $ dotenv run -- node index.js ◇ injected env (2) from .env Hello Dotenv ``` - NEW: Dotenv now has a fast parser thanks to [@​homanp](https://github.com/homanp) of [superagent.sh](https://superagent.sh). Pass `config({ fast: true })`, flag `--fast`, or set `DOTENV_FAST=true` to opt-in to \~2x faster character-scanner parser. ([#​1010](motdotla/dotenv#1010)) ```sh $ dotenv run --fast -- node index.js ◇ injected env (2) from .env Hello Dotenv ``` [faster than Node native parseEnv!](https://dotenvx.com/blog/2026/09/28/dotenv-fast.html) ##### Changed - Injecting message sent to stderr rather than stdout and tips removed ([#​1037](motdotla/dotenv#1037)) ##### Removed - Remove tips ([#​1031](motdotla/dotenv#1031)) - Remove skill files ([#​1032](motdotla/dotenv#1032)) - Remove Spanish README ([#​1034](motdotla/dotenv#1034)) - Remove .env.vault support ([#​1033](motdotla/dotenv#1033)) - Remove preloading. Instead use cli `dotenv run -- your-command` ([#​1035](motdotla/dotenv#1035)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 9am on tuesday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzMuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE3NS4xIiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcCIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZSJdfQ==--> Reviewed-on: https://code.futo.org/harbor/harbor/pulls/1849
renovate Bot
added a commit
to andrei-picus-tink/auto-renovate
that referenced
this pull request
Oct 24, 2026
| datasource | package | from | to | | ---------- | ------- | ------ | ------ | | npm | dotenv | 18.0.7 | 18.0.9 | ## [v18.0.9](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1809-2026-10-14) ##### Changed - Permit DOTENV_PATH being empty string with the CLI ([#1076](motdotla/dotenv#1076)) ## [v18.0.8](https://github.com/motdotla/dotenv/blob/HEAD/CHANGELOG.md#1808-2026-10-14) ##### Changed - Fast parser should strip appended extra quotes ([#1073](motdotla/dotenv#1073)) - Type detail improvement ([#1074](motdotla/dotenv#1074))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
parse()andparse(..., { fast: true })disagree on an unquoted value containing a Unicode line separator followed by a quoted segment. For example, withA=prefix\u2028""(an actual U+2028 character), the classic parser returnsprefixfollowed by the separator, while fast mode retains the quotes. The classic unquoting expression uses multiline anchors, which also apply at U+2028 and U+2029 inside an otherwise unquoted value.Apply those existing unquoting rules in the fast parser's Unicode-separator fallback. Retain the direct handling for ordinary values. Add string/Buffer cases for both separators and all three quote styles, with surrounding assignments and quoted/unterminated controls.
Validation: the new parity assertion fails on unchanged master; an independent 60-case matrix has 36 mismatches before and none after.
npm testpasses 1315 assertions with one existing skip, including build, Standard lint and declaration checks. The performance gate passes at 1.94x for Buffers and 1.92x for strings (minimum 1.5x).git diff --checkpasses. Tested on Node 22.23.1/Linux; Windows and other CI Node versions were not exercised. This clean-master branch excludes PR #1072.AI disclosure: OpenAI Codex assisted with investigation, implementation, regression tests, and this description.