chore: disable vitest interopDefault, remove dotenvx

.config/vitest.config.base.mts

@@ -68,6 +68,9 @@ export default defineConfig({
         useAtomics: true,
       },
     },
+    deps: {
+      interopDefault: false,
+    },
     testTimeout: 30_000,
     hookTimeout: 30_000,
     coverage: {

.config/vitest.config.isolated.mts

@@ -36,6 +36,9 @@ export default defineConfig({
         minForks: isCoverageEnabled ? 1 : 2,
       },
     },
+    deps: {
+      interopDefault: false,
+    },
     testTimeout: 30_000,
     hookTimeout: 10_000,
     coverage: {

.env.precommit

@@ -1,5 +1,5 @@
 # Socket CLI Pre-commit Test Environment
-# This file is loaded by dotenvx during pre-commit hooks.
+# This file is loaded during pre-commit hooks.
 
 # Disable API token requirement for unit tests.
 SOCKET_CLI_NO_API_TOKEN=1

.github/workflows/ci.yml

@@ -109,7 +109,7 @@ jobs:
           export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
           CODE
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         with:
           checkout: 'false'
 
@@ -168,7 +168,7 @@ jobs:
           export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
           CODE
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         with:
           checkout: 'false'
 
@@ -234,7 +234,7 @@ jobs:
           export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
           CODE
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         with:
           checkout: 'false'
           node-version: ${{ matrix.node-version }}
@@ -310,7 +310,7 @@ jobs:
           export default { text, view, renderToString, renderToStringWithWidth, printComponent, eprintComponent, getTerminalSize, TuiRenderer, init }
           CODE
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         with:
           checkout: 'false'
           node-version: ${{ matrix.node-version }}

.github/workflows/provenance.yml

@@ -51,7 +51,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         with:
           checkout: 'false'
 
@@ -91,7 +91,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         with:
           checkout: 'false'
           registry-url: 'https://registry.npmjs.org'
@@ -141,7 +141,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         with:
           checkout: 'false'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/weekly-update.yml

@@ -29,7 +29,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         with:
           checkout: 'false'
 
@@ -61,7 +61,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         with:
           checkout: 'false'
 
@@ -76,7 +76,7 @@ jobs:
           git checkout -b "$BRANCH_NAME"
           echo "branch=$BRANCH_NAME" >> $GITHUB_OUTPUT
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         with:
           gpg-private-key: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
 
@@ -303,7 +303,7 @@ jobs:
             test.log
           retention-days: 7
 
-      - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@b86b2cb3fefa4ffa6c1a702476f9785f6c3bb887 # main
+      - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
         if: always()
 
   notify:

.husky/pre-commit

@@ -15,15 +15,7 @@ else
 fi
 
 if [ -z "${DISABLE_PRECOMMIT_TEST}" ]; then
-  if ! command -v dotenvx >/dev/null 2>&1; then
-    printf "Error: dotenvx not found in PATH\n" >&2
-    printf "Install with: pnpm i\n" >&2
-    exit 1
-  fi
-  # Note: .env.precommit is optional and not tracked in git (contains local test config).
-  # If missing, dotenvx will continue without it. Create .env.precommit with test
-  # environment variables to optimize pre-commit test performance.
-  dotenvx -q run -f .env.precommit -- pnpm test --staged
+  SOCKET_CLI_NO_API_TOKEN=1 pnpm test --staged
 else
   printf "Skipping testing due to DISABLE_PRECOMMIT_TEST env var\n"
 fi

package.json

@@ -52,7 +52,6 @@
     "pretest": "pnpm run build:cli"
   },
   "devDependencies": {
-    "@typescript/native-preview": "7.0.0-dev.20260415.1",
     "@anthropic-ai/claude-code": "catalog:",
     "@babel/core": "catalog:",
     "@babel/parser": "catalog:",
@@ -63,7 +62,6 @@
     "@babel/preset-typescript": "catalog:",
     "@babel/runtime": "catalog:",
     "@babel/traverse": "catalog:",
-    "@dotenvx/dotenvx": "catalog:",
     "@npmcli/arborist": "catalog:",
     "@npmcli/config": "catalog:",
     "@octokit/graphql": "catalog:",
@@ -96,6 +94,7 @@
     "@types/semver": "catalog:",
     "@types/which": "catalog:",
     "@types/yargs-parser": "catalog:",
+    "@typescript/native-preview": "7.0.0-dev.20260415.1",
     "@vitest/coverage-v8": "catalog:",
     "@yao-pkg/pkg": "catalog:",
     "browserslist": "catalog:",

packages/cli/package.json

@@ -40,20 +40,20 @@
     "clean:node-smol": "del-cli 'build/node-smol'",
     "clean:node_modules": "del-cli '**/node_modules'",
     "fix": "oxfmt --write . && oxlint --fix -c ../../.oxlintrc.json",
-    "lint-staged": "dotenvx -q run -f .env.local -- lint-staged",
-    "precommit": "dotenvx -q run -f .env.local -- lint-staged",
+    "lint-staged": "lint-staged",
+    "precommit": "lint-staged",
     "prepare": "husky",
-    "bs": "dotenvx -q run -f .env.local -- pnpm run build && pnpm exec socket --",
-    "s": "dotenvx -q run -f .env.local -- pnpm exec socket --",
+    "bs": "pnpm run build && pnpm exec socket --",
+    "s": "pnpm exec socket --",
     "dev": "node --experimental-strip-types src/cli-dispatch.mts",
     "dev:npm": "cross-env SOCKET_CLI_MODE=npm node --experimental-strip-types src/cli-dispatch.mts",
     "dev:npx": "cross-env SOCKET_CLI_MODE=npx node --experimental-strip-types src/cli-dispatch.mts",
-    "e2e-tests": "dotenvx -q run -f .env.test -- vitest run --config vitest.e2e.config.mts",
+    "e2e-tests": "vitest run --config vitest.e2e.config.mts",
     "e2e:js": "node scripts/e2e.mts --js",
     "e2e:sea": "node scripts/e2e.mts --sea",
     "e2e:all": "node scripts/e2e.mts --all",
     "test": "run-s check test:*",
-    "test:prepare": "dotenvx -q run -f .env.test -- pnpm build && del-cli 'test/**/node_modules'",
+    "test:prepare": "pnpm build && del-cli 'test/**/node_modules'",
     "test:unit": "node --import=./scripts/load.mts scripts/test-wrapper.mts",
     "test:unit:update": "node --import=./scripts/load.mts scripts/test-wrapper.mts --update",
     "test:unit:coverage": "node --import=./scripts/load.mts scripts/test-wrapper.mts --coverage",

packages/cli/scripts/e2e.mts

@@ -14,6 +14,7 @@ import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import { spawn } from '@socketsecurity/lib/spawn'
 
 import { EnvironmentVariables } from './environment-variables.mts'
+import { loadEnvFile } from './utils/load-env.mts'
 
 const logger = getDefaultLogger()
 
@@ -122,30 +123,25 @@ async function runVitest(binaryType) {
   // This is required for tests to load external tool versions (coana, cdxgen, synp, etc).
   const externalToolVersions = EnvironmentVariables.getTestVariables()
 
-  // Use dotenvx to load test environment.
-  const dotenvxCmd = WIN32 ? 'dotenvx.cmd' : 'dotenvx'
-  const dotenvxPath = path.join(NODE_MODULES_BIN_PATH, dotenvxCmd)
+  // Load .env.e2e configuration (falls back gracefully if missing).
+  const e2eEnv = loadEnvFile(path.join(ROOT_DIR, '.env.e2e'))
 
   // Resolve vitest path.
   const vitestCmd = WIN32 ? 'vitest.cmd' : 'vitest'
   const vitestPath = path.join(NODE_MODULES_BIN_PATH, vitestCmd)
 
   const result = await spawn(
-    dotenvxPath,
+    vitestPath,
     [
-      '-q',
-      'run',
-      '-f',
-      '.env.e2e',
-      '--',
-      vitestPath,
       'run',
       'test/e2e/binary-test-suite.e2e.test.mts',
       '--config',
       'vitest.e2e.config.mts',
     ],
     {
+      cwd: ROOT_DIR,
       env: {
+        ...e2eEnv,
         ...process.env,
         // Automatically enable tests when explicitly running e2e.mts.
         RUN_E2E_TESTS: '1',

packages/cli/scripts/integration.mts

@@ -14,6 +14,7 @@ import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import { spawn } from '@socketsecurity/lib/spawn'
 
 import { EnvironmentVariables } from './environment-variables.mts'
+import { loadEnvFile } from './utils/load-env.mts'
 
 const logger = getDefaultLogger()
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
@@ -80,9 +81,8 @@ async function runVitest(binaryType) {
     return
   }
 
-  // Use dotenvx to load test environment.
-  const dotenvxCmd = WIN32 ? 'dotenvx.cmd' : 'dotenvx'
-  const dotenvxPath = path.join(NODE_MODULES_BIN_PATH, dotenvxCmd)
+  // Load .env.test configuration.
+  const testEnv = loadEnvFile(path.join(ROOT_DIR, '.env.test'))
 
   // Resolve vitest path.
   const vitestCmd = WIN32 ? 'vitest.cmd' : 'vitest'
@@ -92,14 +92,8 @@ async function runVitest(binaryType) {
   const externalToolVersions = EnvironmentVariables.getTestVariables()
 
   const result = await spawn(
-    dotenvxPath,
+    vitestPath,
     [
-      '-q',
-      'run',
-      '-f',
-      '.env.test',
-      '--',
-      vitestPath,
       'run',
       'test/integration/binary/',
       '--config',
@@ -108,6 +102,7 @@ async function runVitest(binaryType) {
     {
       cwd: ROOT_DIR,
       env: {
+        ...testEnv,
         ...process.env,
         // Automatically enable tests when explicitly running integration.mts.
         RUN_INTEGRATION_TESTS: '1',

packages/cli/scripts/test-wrapper.mts

@@ -5,7 +5,7 @@
  * - Memory optimization for RegExp-heavy tests
  * - Cross-platform compatibility (Windows/Unix)
  * - Build validation before running tests
- * - Environment variable loading from .env.test
+ * - Environment variable loading from .env.test (via loadEnvFile)
  * - Inlined variable injection from bundle-tools.json
  */
 
@@ -20,6 +20,7 @@ import { getDefaultLogger } from '@socketsecurity/lib/logger'
 import { spawn } from '@socketsecurity/lib/spawn'
 
 import { EnvironmentVariables } from './environment-variables.mts'
+import { loadEnvFile } from './utils/load-env.mts'
 
 const logger = getDefaultLogger()
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
@@ -110,9 +111,8 @@ async function main() {
       ...externalToolVersions,
     }
 
-    // Use dotenvx to load .env.test configuration.
-    const dotenvxCmd = WIN32 ? 'dotenvx.cmd' : 'dotenvx'
-    const dotenvxPath = path.join(rootNodeModulesBinPath, dotenvxCmd)
+    // Load .env.test configuration.
+    const testEnv = loadEnvFile(path.join(rootPath, '.env.test'))
 
     // Handle Windows vs Unix for vitest executable.
     const vitestCmd = WIN32 ? 'vitest.cmd' : 'vitest'
@@ -133,28 +133,22 @@ async function main() {
       }
     }
 
-    // Wrap vitest with dotenvx to load .env.test.
-    // Command: dotenvx -q run -f .env.test -- vitest run [args].
-    const dotenvxArgs = [
-      '-q',
-      'run',
-      '-f',
-      '.env.test',
-      '--',
-      vitestPath,
-      'run',
-      ...expandedArgs,
-    ]
-
     // On Windows, .cmd files need shell: true.
     const spawnOptions = {
       cwd: rootPath,
-      env: spawnEnv,
+      env: {
+        ...testEnv,
+        ...spawnEnv,
+      },
       stdio: 'inherit',
       ...(WIN32 ? { shell: true } : {}),
     }
 
-    const result = await spawn(dotenvxPath, dotenvxArgs, spawnOptions)
+    const result = await spawn(
+      vitestPath,
+      ['run', ...expandedArgs],
+      spawnOptions,
+    )
     process.exitCode = result?.code || 0
   } catch (e) {
     logger.error('Failed to spawn test process:', e)