Possible regression: `USERNAME` in .env file does not update process.env on Windows

[Pomax]

I found https://github.com/motdotla/dotenv/issues/505 which was supposedly addressed by https://github.com/motdotla/dotenv/issues/517 as of v14.1.0, but I just noticed that with v16.0.3 having an .env file that contains USERNAME=something does not set the process.env.USERNAME value and instead reports Windows' own environment variable. As .env files exist to explicitly set values regardless of whether they exist or not, and if they exist, regardless of what their original value is, this is highly surprising and a possible regression =)

[mxschmitt]

"USERNAME" is already defined and was NOT overwritten when enabling the debug logs for me. Downstream issue from the Playwright project: https://github.com/microsoft/playwright/issues/29030

[motdotla]

use override force it.

require('dotenv').config({ override: true })

https://github.com/motdotla/dotenv#override

[Pomax]

That should be the other way around, with dotenv overriding everything unless the user wants to preserve magic environment variables. The expectation is that .env files override any and all preexisting variables.

[motdotla]

I can understand the feeling. We went back and forth on that (many times) but for years now dotenv does NOT override if already set on your machine. Unless you pass the override option.

[Pomax]

In that case can I at least request a new default behaviour feature where dotenv will log an stdout warning about the fact that the way it just got told to load in has an .env vs OS conflict, and to add override:true is that magic is not wanted? (not necessarily listing the var names that conflict, that's a bonus, but just getting that signal at all would be super useful)

[motdotla]

@Pomax it does that here: https://github.com/motdotla/dotenv/blob/master/lib/main.js#L287

If you are looking for even more detailed logging, check out dotenvx. It doesn't have the same constraint as dotenv (no dependencies) and as a result it is able to do much more detailed logging, among many other things. I personally am moving a lot of my .env and .env.vault usage to it.

[Pomax]

That looks like it's related to decryption? I didn't see dotenv warn me about this at all when I had a normal USERNAME=... in a plain .env file, and having it yell at me about that with an instruction on how to make it either stop warning or force the override would have prevented me from filing an issue =)

dotenvx looks interesting, but you may want to change the quickstart to show how to install it for everyone rather than just Mac users (the actual cross-platform instruction is way down the additional ways page). And showing that it can be used in code in the readme would be quite valuable too. My initial reaction was "oh it's a cli tool? Guess that's a no go then". It wasn't until I scrolled down the ways-to-install page all the way down to NPM use that it was clear it would still work as replacement for dotenv in code.

[motdotla]

how's this, better?

(adjusting the /docs site to have this order as well)

[Pomax]

Ooh, that's pretty great! Though it would be good to mention the global install for all three OSses (linux, mac, and windows) rather than only giving the MacOS option.