From 8e9a6ba437dd254469938ddf96411ef498267a51 Mon Sep 17 00:00:00 2001
From: Tomasz Czubocha <tomasz.czubocha@gmail.com>
Date: Thu, 15 Jan 2026 11:21:09 +0000
Subject: [PATCH] chore(deps): upgrade dotenv to v17.2.3 and remove unused
 `loadDotEnvFile` utility (#13259)

---
 package-lock.json                         |  8 ++--
 packages/sf-core/package.json             |  2 +-
 packages/sf-core/src/lib/resolvers/env.js |  4 +-
 packages/sf-core/src/utils/fs/index.js    | 47 -----------------------
 packages/sf-core/src/utils/index.js       |  2 -
 5 files changed, 7 insertions(+), 56 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index e92e77609..72d914068 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8450,9 +8450,9 @@
       }
     },
     "node_modules/dotenv": {
-      "version": "16.6.1",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
-      "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==",
+      "version": "17.2.3",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.2.3.tgz",
+      "integrity": "sha512-JVUnt+DUIzu87TABbhPmNfVdBDt18BLOWjMUFJMSi/Qqg7NTYtabbvSNJGOJ7afbRuv9D/lngizHtP7QyLQ+9w==",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=12"
@@ -16760,7 +16760,7 @@
         "@smithy/util-retry": "^4.2.6",
         "adm-zip": "^0.5.16",
         "child-process-ext": "^3.0.2",
-        "dotenv": "^16.6.1",
+        "dotenv": "^17.2.3",
         "fs-extra": "^11.3.3",
         "graceful-fs": "^4.2.11",
         "https-proxy-agent": "^7.0.6",
diff --git a/packages/sf-core/package.json b/packages/sf-core/package.json
index 694ca3c60..093271075 100644
--- a/packages/sf-core/package.json
+++ b/packages/sf-core/package.json
@@ -73,7 +73,7 @@
     "@smithy/util-retry": "^4.2.6",
     "adm-zip": "^0.5.16",
     "child-process-ext": "^3.0.2",
-    "dotenv": "^16.6.1",
+    "dotenv": "^17.2.3",
     "fs-extra": "^11.3.3",
     "graceful-fs": "^4.2.11",
     "https-proxy-agent": "^7.0.6",
diff --git a/packages/sf-core/src/lib/resolvers/env.js b/packages/sf-core/src/lib/resolvers/env.js
index ee7bc604a..27ab2b1f4 100644
--- a/packages/sf-core/src/lib/resolvers/env.js
+++ b/packages/sf-core/src/lib/resolvers/env.js
@@ -26,7 +26,7 @@ export const loadEnvFiles = ({ stage, configFileDirPath }) => {
   // Load .env file
   const defaultEnvPath = path.resolve(configFileDirPath, '.env')
   if (existsSync(defaultEnvPath)) {
-    dotenv.config({ path: defaultEnvPath })
+    dotenv.config({ path: defaultEnvPath, quiet: true })
   }
 }
 
@@ -41,6 +41,6 @@ export const loadStageEnvFiles = ({ stage, configFileDirPath }) => {
   // Load .env.[stageName] file
   const stageEnvPath = path.resolve(configFileDirPath, `.env.${stage}`)
   if (existsSync(stageEnvPath)) {
-    dotenv.config({ path: stageEnvPath })
+    dotenv.config({ path: stageEnvPath, quiet: true })
   }
 }
diff --git a/packages/sf-core/src/utils/fs/index.js b/packages/sf-core/src/utils/fs/index.js
index 68d142d72..d7982cafc 100644
--- a/packages/sf-core/src/utils/fs/index.js
+++ b/packages/sf-core/src/utils/fs/index.js
@@ -14,7 +14,6 @@ import yaml from 'js-yaml'
 import { createRequire } from 'node:module'
 import _ from 'lodash'
 import AdmZip from 'adm-zip'
-import dotenv from 'dotenv'
 
 const require = createRequire(import.meta.url)
 
@@ -197,51 +196,6 @@ const parseDeclarativeConfig = (filePath, contents) => {
   return contents.trim()
 }
 
-/**
- * Read a dotenv file and return the parsed content.
- * NOTE: This does not automatically set environment variables.
- * If params are provided, search in a custom path.
- * Otherwise, search in the current working directory.
- * Can accept .env.dev, .env.prod, .env, etc.
- * A staged .env file takes priority over a default .env file.
- * @returns Object with environment variables
- */
-const loadDotEnvFile = async ({ customPath = null, stageName = null }) => {
-  // Set path to current working directory if not provided
-  const envPath = customPath || process.cwd()
-
-  // If the path specifies a directory, search for a .env and staged .env file in it
-  if (await dirExists(envPath)) {
-    const defaultEnvPath = path.resolve(envPath, '.env')
-    const stageFilePath = stageName
-      ? path.resolve(envPath, `.env.${stageName}`)
-      : null
-
-    let envDefault = {}
-    if (await fileExists(defaultEnvPath)) {
-      const data = dotenv.config({
-        path: defaultEnvPath,
-      }).parsed
-      envDefault = data || {}
-    }
-
-    let envStage = {}
-    if (stageFilePath && (await fileExists(stageFilePath))) {
-      const data = dotenv.config({
-        path: stageFilePath,
-      }).parsed
-      envStage = data || {}
-    }
-    // Merge default and staged environment variables, with staged taking priority
-    return { ...envDefault, ...envStage }
-  }
-
-  // If the path specifies a file, use it
-  if (await fileExists(envPath)) {
-    return dotenv.config({ path: envPath }).parsed
-  }
-}
-
 /**
  * CloudFormation intrinsic functions need to be parsed as YAML.
  */
@@ -971,7 +925,6 @@ export {
   copyDirContents,
   removeFileOrDirectory,
   parseDeclarativeConfig,
-  loadDotEnvFile,
   renameTemplateInAllFiles,
   renameDirectory,
   getConfigFilePath,
diff --git a/packages/sf-core/src/utils/index.js b/packages/sf-core/src/utils/index.js
index 3e0f1ccff..ae7f53302 100644
--- a/packages/sf-core/src/utils/index.js
+++ b/packages/sf-core/src/utils/index.js
@@ -16,7 +16,6 @@ import {
   copyDirContents,
   removeFileOrDirectory,
   parseDeclarativeConfig,
-  loadDotEnvFile,
   renameTemplateInAllFiles,
   renameDirectory,
   getConfigFilePath,
@@ -52,7 +51,6 @@ export {
   removeFileOrDirectory,
   scrambleSensitiveValue,
   parseDeclarativeConfig,
-  loadDotEnvFile,
   renameTemplateInAllFiles,
   renameDirectory,
   getConfigFilePath,