chore(deps): update dependency dotenv-expand to v11 (#15875)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: bluwy <bjornlu.dev@gmail.com>

package.json

@@ -125,7 +125,6 @@
     },
     "patchedDependencies": {
       "chokidar@3.6.0": "patches/chokidar@3.6.0.patch",
-      "dotenv-expand@10.0.0": "patches/dotenv-expand@10.0.0.patch",
       "sirv@2.0.4": "patches/sirv@2.0.4.patch"
     },
     "peerDependencyRules": {

packages/vite/package.json

@@ -117,7 +117,7 @@
     "debug": "^4.3.4",
     "dep-types": "link:./src/types",
     "dotenv": "^16.4.2",
-    "dotenv-expand": "^10.0.0",
+    "dotenv-expand": "^11.0.3",
     "es-module-lexer": "^1.4.1",
     "escape-html": "^1.0.3",
     "estree-walker": "^3.0.3",

packages/vite/src/node/env.ts

@@ -1,7 +1,7 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { parse } from 'dotenv'
-import { expand } from 'dotenv-expand'
+import { type DotenvPopulateInput, expand } from 'dotenv-expand'
 import { arraify, normalizePath, tryStatSync } from './utils'
 import type { UserConfig } from './config'
 
@@ -49,9 +49,10 @@ export function loadEnv(
     process.env.BROWSER_ARGS = parsed.BROWSER_ARGS
   }
 
-  // let environment variables use each other
-  // `expand` patched in patches/dotenv-expand@9.0.0.patch
-  expand({ parsed })
+  // let environment variables use each other. make a copy of `process.env` so that `dotenv-expand`
+  // doesn't re-assign the expanded values to the global `process.env`.
+  const processEnv = { ...process.env } as DotenvPopulateInput
+  expand({ parsed, processEnv })
 
   // only keys that start with prefix are exposed to client
   for (const [key, value] of Object.entries(parsed)) {

patches/dotenv-expand@10.0.0.patch

@@ -1,18 +0,0 @@
-diff --git a/lib/main.js b/lib/main.js
-index 79d973c22f06403bfee45ff122bd384841c30da8..9392de262140f8f336146bef2419794532e4170f 100644
---- a/lib/main.js
-+++ b/lib/main.js
-@@ -69,9 +69,10 @@ function expand (config) {
-     )
-   }
- 
--  for (const processKey in config.parsed) {
--    environment[processKey] = config.parsed[processKey]
--  }
-+  // PATCH: don't write to process.env
-+  // for (const processKey in config.parsed) {
-+  //   environment[processKey] = config.parsed[processKey]
-+  // }
- 
-   return config
- }

pnpm-lock.yaml

@@ -13,9 +13,6 @@ patchedDependencies:
   chokidar@3.6.0:
     hash: bckcfsslxcffppz65mxcq6naau
     path: patches/chokidar@3.6.0.patch
-  dotenv-expand@10.0.0:
-    hash: weuqf2vlv5b5g6cikeo4slurbm
-    path: patches/dotenv-expand@10.0.0.patch
   sirv@2.0.4:
     hash: amdes53ifqfntejkflpaq5ifce
     path: patches/sirv@2.0.4.patch
@@ -319,8 +316,8 @@ importers:
         specifier: ^16.4.2
         version: 16.4.2
       dotenv-expand:
-        specifier: ^10.0.0
-        version: 10.0.0(patch_hash=weuqf2vlv5b5g6cikeo4slurbm)
+        specifier: ^11.0.3
+        version: 11.0.3
       es-module-lexer:
         specifier: ^1.4.1
         version: 1.4.1
@@ -5592,11 +5589,12 @@ packages:
       is-obj: 2.0.0
     dev: true
 
-  /dotenv-expand@10.0.0(patch_hash=weuqf2vlv5b5g6cikeo4slurbm):
-    resolution: {integrity: sha512-GopVGCpVS1UKH75VKHGuQFqS1Gusej0z4FyQkPdwjil2gNIv+LNsqBlboOzpJFZKVT95GkCyWJbBSdFEFUWI2A==}
+  /dotenv-expand@11.0.3:
+    resolution: {integrity: sha512-qkK+MLTvZ86oq4sjMqGpUN/38SQ/J37mny88CsEUFFjb2MBVz06a809ri0QeVDXpxkvZkXzqjGUb0M1R6n3OGw==}
     engines: {node: '>=12'}
+    dependencies:
+      dotenv: 16.4.2
     dev: true
-    patched: true
 
   /dotenv@16.4.2:
     resolution: {integrity: sha512-rZSSFxke7d9nYQ5NeMIwp5PP+f8wXgKNljpOb7KtH6SKW1cEqcXAz9VSJYVLKe7Jhup/gUYOkaeSVyK8GJ+nBg==}