dotenv-webpack

library9.0.0jsnpmunverified

A secure webpack plugin that wraps dotenv and Webpack.DefinePlugin to expose only explicitly referenced process.env variables in your bundle. Current version 9.0.0 (2026-03-07) supports webpack 4/5 and Node >=18.18.0. Unlike raw dotenv, it safely reduces leakage of sensitive keys by only including variables actually used in code. Compatible with rspack since v8.1.0. Breaking change in v9: package exports directly from src/index.js, no dist/ wrappers. Release cadence is irregular, with major versions every 1-2 years.

devops

npm install dotenv-webpack

github ↗package ↗

INSTALL

IMPORT

SIG · DOTENV-WEBPACK

dotenv-webpack

devopsjavascriptv9.0.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Dotenv

✓ import Dotenv from 'dotenv-webpack';

✗ const Dotenv = require('dotenv-webpack');

Package is ESM-only since v9. CommonJS require will fail with newer Node versions.

Dotenv

✓ const Dotenv = require('dotenv-webpack');

✗ const { Dotenv } = require('dotenv-webpack');

In CJS compatible versions (v8 and below), default import is via require. Named import for Dotenv does not exist.

Dotenv

✓ import Dotenv from 'dotenv-webpack';

✗ import { Dotenv } from 'dotenv-webpack';

Only default export is provided. Named export is a common mistake.

Shows basic setup with ESM import, .env file, and secure variable usage.

// webpack.config.js import Dotenv from 'dotenv-webpack'; export default { plugins: [ new Dotenv() ] }; // .env DB_HOST=127.0.0.1 DB_PASS=foobar S3_API=mysecretkey // file.js console.log(process.env.DB_HOST); // '127.0.0.1' // DB_PASS and S3_API are NOT in bundle because not referenced

Debug

Known issues

breakingSince v9.0.0, package exports directly from src/index.js, removing dist/index.js wrappers. This may break builds relying on the dist path.

fix

Update import to default ESM import; if using older Node or custom resolver, ensure module resolution handles src/.

affects: >=9.0.0

breakingv8.0.0 changed the default behavior of `path`, `defaults` and `safe` options to all look at the `path` by default. Previously they had separate defaults.

fix

Review config: if you relied on separate defaults, explicitly set options to mimic old behavior.

affects: >=8.0.0 <9.0.0

gotchaDestructuring process.env variables (e.g., const { DB_HOST } = process.env) will not be replaced by the plugin due to webpack.DefinePlugin limitations.

fix

Always reference variables as process.env.VAR_NAME directly. Do not destructure.

affects: *

gotchaWhen `prefix` option is set, automatic stubbing of missing process.env references (replacing with 'MISSING_ENV_VAR') is disabled. If your code or dependencies use process.env without referencing a variable, it will break.

fix

If using `prefix`, ensure all process.env references are handled, or manually handle missing env vars.

affects: >=7.1.0

Errors

Common errors & fixes

TypeError: Cannot read properties of undefined (reading 'DefinePlugin')

Webpack not installed or incompatible version (need webpack 4 or 5).

fix

Run 'npm install webpack@5 --save-dev' or ensure webpack is in dependencies.

Error: Module parse failed: Unexpected token (1:2) You may need an appropriate loader to handle this file type.

Using CommonJS require with v9 ESM-only package in a non-ESM project.

fix

Switch to import syntax or downgrade to v8.1.1 if you cannot use ESM.

WARNING in (webpack)/node_modules/dotenv-webpack/src/index.js Module not found: Error: Can't resolve 'dotenv'

dotenv is not installed as a dependency (it should be installed automatically, but might be missing if using --no-optional).

fix

Run 'npm install dotenv' or remove --no-optional flag.

process is not defined

In browser environments (webpack 5+), process is not polyfilled. dotenv-webpack normally stubs missing process.env but may fail if `ignoreStub` is set or `prefix` is used.

fix

Either set `ignoreStub: false` (default) or add 'process/browser' polyfill in webpack config.

Upgrade

Version history

9.0.0latest on npm

Audit

Dependencies

webpackrequiredpeer dependency required for plugin functionality

dotenvrequiredcore dependency for .env file parsing

Agent activity

2 hits · last 30 days

node

Resources

githubhttps://github.com/mrsteele/dotenv-webpack ↗

packagehttps://www.npmjs.com/package/dotenv-webpack ↗