[#45879] - [6.0] Update NPM dependency "dotenv" from 16.6.1 to 17.2.1.
- Pending
- Medium
- Build: 6.0-dev
- # 45879
- Diff
- richard67:6.0-dev-npm-major-update-dotenv
User tests: Successful: Unsuccessful:
Pull Request for Issue # .
Summary of Changes
This pull request (PR) moves the NPM dependency dotenv from the non-development dependencies to the development dependencies and updates it from version 16.6.1 to version 17.2.1.
Their change log doesn't show any b/c breaks except of the change of the quiet configuration parameter's default value from true to false.
This can be mitigated by using config({ quiet: true }), see here: https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md#1661-2025-06-27
The core uses dotenv in the build/build-modules-js/javascript/build-com_media-js.mjs script. The code is changed there as described above.
Besides that, dotenv is not used anywhere else in the core, and it is not shipped with installation or update packages.
Therefore it can be moved to the development dependencies. It was a mistake that it was in the non-development dependencies.
Testing Instructions
Pre-conditions: It needs a development environment, i.e. a git clone, composer and npm.
- On a clean, current 6.0-dev branch without this PR applied, run
composer installif you haven't done this before. - Run
npm ci. - Save files
media/com_media/js/media-manager.jsandmedia/com_media/js/media-manager.min.jsat a safe place outside of the media folder for later comparison, e.g. in foldertmp/media-js-without-pr-no-dev. - Run
npm run build:com_media:dev. - Save files
media/com_media/js/media-manager.jsandmedia/com_media/js/media-manager.min.jsat a safe place outside of the media folder for later comparison, e.g. in foldertmp/media-js-without-pr-dev. - Apply the changes from this PR.
- Repeat steps 2 to 5, but use different folder names to save the js files, e.g.
tmp/media-js-with-pr-no-devin step 3 andtmp/media-js-with-pr-devin step 5. - Compare the content of the saved unminified js files and the size of the saved minified js files.
Actual result BEFORE applying this Pull Request
The media manager js files can be built for production environment (= default) or for development environment.
The files for development environment contain additional debug functionality, and the .min.js file is not minified in development environment.
Expected result AFTER applying this Pull Request
Same as without the PR.
The unminified and minified js files created with this PR applied are the same as without this PR.
Link to documentations
Please select:
-
Documentation link for docs.joomla.org:
-
No documentation changes for docs.joomla.org needed
-
Pull Request link for manual.joomla.org: To be done.
-
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | JavaScript Repository NPM Change |
| Labels |
Added:
NPM Resource Changed
PR-6.0-dev
|
||
| Title |
|
||||||
I can’t right now (in the middle of the sea) but worth mentioning that the package might not be required anymore https://nodejs.org/en/learn/command-line/how-to-read-environment-variables-from-nodejs
I can’t right now (in the middle of the sea) but worth mentioning that the package might not be required anymore https://nodejs.org/en/learn/command-line/how-to-read-environment-variables-from-nodejs
@dgrammatiko Not sure if we can do that in J6 or if it would be something for 7 as the dependency is not a dev dependency only, and so it might theoretically be used by extension devs. I have no idea if our b/c policy covers that. To play safe we could use this PR here for the upcoming beta 1 and see what else can be done with another PR.
It’s a dev dependency!
It’s a dev dependency!
@dgrammatiko Not according to our package.json:
It’s wrong that it’s in the dependencies, we don’t ship any of it’s code…
| Status | Pending | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2025-08-11 19:24:01 |
| Closed_By | ⇒ | richard67 | |
| Labels |
Added:
Documentation Required
|
||
I see. Will close this one and maybe find the time to make a PR to move or remove it if nobody is faster.
no need to close it you can just move the line to the dev section
no need to close it you can just move the line to the dev section
@brianteeman Well, I might reopen it. I just don't have the time now to make that change and test it myself if it works, so I thought I close so people not waste time with testing. Changing to draft would have been an alternative.
Re-opening but will change to draft.
| Status | Closed | ⇒ | New |
| Closed_Date | 2025-08-11 19:24:01 | ⇒ | |
| Closed_By | richard67 | ⇒ |
| Status | New | ⇒ | Pending |
| Title |
|
||||||
| Labels |
Removed:
Documentation Required
|
||
| Title |
|
||||||
Ok, I've made the change, PR description is updated, testing instructions don't change. Ready for testing.
I have tested this item ✅ successfully on b745962
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/45879.
@dgrammatiko I would be happy if you could find the time to test this PR.