# CLI Changelog

Changes specific to the CLI (`envilder` npm package).
For SDK-specific changes, see `sdk-dotnet.md`, `sdk-python.md`, or `sdk-nodejs.md`.

---

## [0.18.0] - 2026-10-28

### Changed

* **Azure Key Vault URLs are no longer checked by host**: The CLI rejected a
  `vaultUrl` that did not use `https://` or whose host did not end in an
  Azure Key Vault domain, and read `ENVILDER_ALLOWED_VAULT_HOSTS` to widen
  that list. The check and the variable are gone: the URL goes to the Azure
  Key Vault client as written, with the client's default challenge resource
  verification, as in the Node.js, Python and .NET SDKs. A malformed or
  `http://` URL now fails with the Azure client's own error

### Security

* **Accepted risk: credentials follow the vault URL in the map file**:
  `DefaultAzureCredential` requests a Key Vault token for whatever host
  `vaultUrl` names, so a map file that points at another host sends that
  token there. The map file is versioned with the code it configures, and
  whoever can change it can already change the application, so a host
  allowlist adds configuration without a matching security gain. Review
  changes to `$config.vaultUrl` and `--vault-url` like any other code change

---

## [0.17.1] - 2026-10-27

### Fixed

* **Accept `/` in map-file keys again**: Since 0.14.0 a hierarchical name
  such as `Database/Password` was rejected, which broke map files that had
  worked until then and that the SDKs still accept. `/` is valid again in
  every command and in the published JSON Schema. `envilder exec` passes the
  name as-is to the child process. A `.env` file gets the line as-is and the
  run prints a warning with the names (never the values): `python-dotenv`
  loads that line, but `dotenv` for Node.js, Docker Compose and a POSIX shell
  do not, so the warning points to `envilder exec` or a `__` name. Existing
  `/` lines are updated in place instead of duplicated. `=`, line breaks,
  `U+2028`/`U+2029`, `__proto__` and the other rejected names stay rejected
  ([#511](https://github.com/macalbert/envilder/issues/511))

---

## [0.17.0] - 2026-10-27

### Security

* **Reject `__proto__` in map files in the published build**: The check
  added in 0.14.0 ran against the TypeScript source, but the compiled
  output lowers the object-rest copy in map-file parsing to a helper that
  assigns each key, so an own `__proto__` key was dropped before the name
  check. A map file with that key was accepted, the mapping was silently
  ignored and the run exited 0. Map-file keys are now read straight from the
  parsed object, so the key is rejected with the documented message
  ([#511](https://github.com/macalbert/envilder/issues/511))

### Changed

* **BREAKING: Azure Key Vault references only translate `/`**: The CLI
  rewrote every Azure reference (underscores to hyphens, lowercased, repeated
  hyphens collapsed, `secret-` prepended to a leading digit), so a valid name
  such as `Database--Password` or `1password-token` addressed a different
  secret than the one in the vault and than the SDKs read. Now the only
  translation is `/` to `-`, ignoring leading slashes
  (`/myapp/db/password` → `myapp-db-password`), shared with the Node.js,
  Python and .NET SDKs. Anything else reaches Key Vault as written, and a
  name it rejects fails with Key Vault's own error. The collision check
  compares names case-insensitively, as Key Vault does

### Migration

Secrets pushed with an earlier CLI under a reference that holds `_`, `--`,
a leading digit or a leading or trailing `-` were stored under the rewritten
name. Point the map file at the name the vault holds (for example
`myapp-db-password` instead of `/myapp/db_password`), or rename the secret in
the vault.

---

## [0.16.0] - 2026-10-25

### Added

* **Single-secret push records the mapping in the map file**:
  `envilder --key=API_KEY --value=... --secret-path=...` now also creates or
  updates `envilder.json` (or the file given with `--map`) with
  `"API_KEY": "<secret-path>"`, so the next `envilder` or `envilder exec` works
  without writing the map file by hand. Every run logs whether the file was
  created, updated or already up to date. A new file gets `$config` for Azure,
  and `$schema` only when its name is not `envilder.json` or `envilder.*.json`
  (SchemaStore already covers those); an existing file keeps its key order, indentation, line
  endings and `$config`. If the variable is already mapped to a different path,
  the command fails before pushing. If the map file targets another provider or
  vault, the secret is still pushed and a warning explains that the mapping was
  not added. If writing the map file or the push fails, the map file is
  restored. The secret value and the AWS profile are never written
* **`--no-map-update`**: push a single secret without reading, creating or
  updating any map file

### Changed

* A single-secret push now writes `envilder.json` in the current directory by
  default. Use `--no-map-update` to keep the previous behavior. An explicit
  `--map` that does not exist is created instead of being rejected

---

## [0.15.1] - 2026-10-22

### Security

* Update development and build dependencies to resolve open advisories:
  `undici` 8.10.2 → 8.12.3 (via `testcontainers`), `brace-expansion`,
  `@grpc/grpc-js` and `@vitest/mocker`. The published `envilder` package and
  its runtime dependencies are unchanged
  ([#609](https://github.com/macalbert/envilder/pull/609))

### Dependencies

* Bump `testcontainers` and `@testcontainers/localstack` from 12.2.0 to 12.2.1
* Bump `vitest` and `@vitest/coverage-v8` from 4.1.11 to 4.1.12

---

## [0.15.0] - 2026-10-16

### Added

* **`envilder exec`: run a command with resolved secrets, without a `.env`
  file**: `envilder exec [options] [--] <command> [args...]` resolves every
  secret in the map file and starts the command with those values in its
  environment. Nothing is written to disk. The command starts at the first
  argument that is not an Envilder option (`--` is optional), arguments are
  passed verbatim without a shell, and Windows `npm`/`npx` shims are supported.
  Resolution is fail-closed: the command never starts when a secret is missing,
  empty or unreadable. Mapped values override inherited variables, naming the
  overridden variables on stderr. All Envilder output goes to stderr as a
  single summary line that names the program but never its arguments, so
  stdout carries only the command's output. Inside GitHub Actions every value
  is registered for masking, and every registration is written to stderr
  before the command starts. Exit codes follow GNU `env`: the command's own
  code, `128+n` for signals, `125` for Envilder errors, `126` and `127` when
  the command cannot be executed or found. `SIGTERM` and `SIGHUP` are
  forwarded and the command is awaited without a timeout, even if a signal
  cannot be delivered. An expired AWS SSO session is recovered interactively
  before the command starts. Exec mode is not a sandbox: see
  [docs/exec-command.md](../exec-command.md)
  ([#550](https://github.com/macalbert/envilder/issues/550))

### Security

* **Parse errors no longer echo option values or arguments**: parse errors
  are rebuilt from safe forms, so option values and extra arguments are never
  printed. An unknown long option is named only when it is a near-typo of a
  real option, together with the suggestion (`--valeu=<value>` is shown as
  `unknown option '--valeu' (Did you mean --value?)`); any other unknown long
  option gets a generic message, so a mistyped secret is never echoed. An
  unknown short option is named by its single character, "too many
  arguments" shows only the counts, and any other parse error is replaced
  with a generic message. Exit codes are unchanged
  ([#554](https://github.com/macalbert/envilder/issues/554))

* **Path and name options never swallow the next option**: `--map`,
  `--envfile`, `--profile`, `--provider`, `--vault-url`, `--key`,
  `--secret-path` and `--ssm-path` (and their `exec` counterparts) reject a
  value that starts with `-` as a missing argument, before any map file is
  read, instead of taking the following option as their value. `--value` is
  exempt, so a secret may still start with `-`
  ([#554](https://github.com/macalbert/envilder/issues/554))

---

## [0.14.0] - 2026-09-26

### Added

* **Zero-config defaults for `--map` and `--envfile`**: Running `envilder` with
  no flags now resolves `envilder.json` from the current directory and writes
  to `.env`. Both flags still override the defaults, and an empty `--map` value
  is rejected rather than silently treated as absent
  ([#314](https://github.com/macalbert/envilder/pull/314))

### Changed

* **Push-single resolves `$config` from the default map file**: A
  single-variable push (`--key` + `--value` + `--secret-path`) now reads the
  `$config` section (`provider`, `vaultUrl`, `profile`) of `envilder.json` when
  one is present, so it targets the same provider as the rest of the project
  instead of silently defaulting to AWS SSM. A missing `envilder.json` is not
  an error for push-single, `--push` is no longer required, and CLI flags still
  override `$config`. The resolved provider is logged before the push
  ([#314](https://github.com/macalbert/envilder/pull/314))

* **Reject empty single-secret options**: `--key`, `--value` and
  `--secret-path` must now be non-empty whenever any of them is supplied.
  Previously an explicitly empty value such as `--key ''` passed the
  partial-option guard and fell through to a full `.env` push or pull
  ([#314](https://github.com/macalbert/envilder/pull/314))

### Fixed

* **Preserve secret values when writing `.env` files**: Values with hashes,
  leading or trailing whitespace, quotes, backslashes or line breaks now
  round-trip exactly, and updating a multi-line value no longer leaves the
  rest of the old secret in the file. Unchanged assignments are kept byte for
  byte, and a write that would not read back correctly aborts, naming only
  the affected keys ([#515](https://github.com/macalbert/envilder/pull/515))

### Security

* **Reject map-file mapping keys a `.env` file cannot represent**: Variable
  names must now match `^[A-Za-z0-9_.-]+$`, checked when parsing a map file
  and again before writing an environment file. This is exactly the key
  grammar `.env` parsers recognize, so an accepted name reads back as itself.
  Previously a name containing `=`, a carriage return, a newline or the
  `U+2028`/`U+2029` line separators could smuggle an extra `key=value`
  assignment into the generated file, and a name containing a space, `#`, a
  tab or a non-Latin letter was written and then silently lost while the run
  reported success. Dotted and hyphenated names remain valid
  ([#511](https://github.com/macalbert/envilder/issues/511))

* **Reject the mapping key `__proto__`**: No `.env` parser can read this name
  back, so the CLI previously resolved the secret and wrote a line that
  silently never loaded. It is now rejected at map-file ingestion with an
  explicit message ([#511](https://github.com/macalbert/envilder/issues/511))

### Documentation

* **Point README links at specific docs pages with UTM tags**: The header link
  and "Full Documentation" link in the README now carry UTM tags and the
  latter lands on `envilder.com/docs/getting-started/`, so visits from GitHub
  and npm to envilder.com can be measured

---

## [0.13.2] - 2026-08-14

### Changed

* **Preserve CLI behavior while adding GitHub Actions masking**: The CLI now
  uses a no-op masker in the shared pull pipeline, so runner masking remains
  limited to GitHub Actions and does not alter CLI output or generated
  environment files
  ([#477](https://github.com/macalbert/envilder/pull/477))

---

## [0.13.0] - 2026-07-11

### Added

* **Colorized `AWS identity` banner**: The
  `☁ AWS identity · account=… · region=… · profile=…` line is now colorized.
  `account` and `region` render in red when they resolve to `unknown`,
  signalling that authentication failed
  ([#382](https://github.com/macalbert/envilder/issues/382))

* **Dedicated `SsoSessionExpiredError` for expired SSO sessions**:
  Failures to resolve or load an AWS SSO session now surface as a
  dedicated `SsoSessionExpiredError` (a sibling of
  `ExpiredCredentialsError`) carrying the AWS profile from
  `$config.profile`. The message is calm and actionable, telling you to
  run `aws sso login --profile <name>`. A plain expired session token
  still surfaces as `ExpiredCredentialsError`
  ([#374](https://github.com/macalbert/envilder/issues/374))

* **Calm, actionable error blocks via `CliErrorPresenter`**: Credential
  errors now render through a single `CliErrorPresenter` that prints a
  calm, colorized, actionable error block instead of a raw stack trace
  ([#374](https://github.com/macalbert/envilder/issues/374))

* **TTY-gated `aws sso login` redirect with auto-retry**: On an
  `SsoSessionExpiredError` in an interactive terminal, the CLI offers to
  run `aws sso login` for you (spawned safely with array arguments,
  never through a shell) and retries the pull once after a successful
  login. Non-interactive runs (CI, pipes) never prompt and just present
  the actionable message
  ([#375](https://github.com/macalbert/envilder/issues/375))

### Changed

* **Print the `AWS identity` banner before resolving secrets**: The
  banner is now printed before secrets are resolved, so it always
  appears first. Previously it could surface mid-output because secrets
  resolve in parallel
  ([#382](https://github.com/macalbert/envilder/issues/382))

### Fixed

* **Clear error for expired or invalid AWS credentials**: Expired or
  invalid AWS credentials (e.g. an expired session token) now produce a
  clear, actionable `ExpiredCredentialsError` telling you to refresh
  credentials (e.g. run `aws sso login`), instead of being masked as a
  misleading `ParameterNotFound`. The pull command now fails fast in
  this case

---

## [0.12.1] - 2026-06-26

### Fixed

* **Honor `$config.profile` for the AWS region, not just credentials**:
  When a map file set an AWS profile via `$config.profile`, Envilder applied
  it to credentials only; the AWS SDK fell back to the default profile's
  region and silently read or wrote SSM parameters in the wrong
  account-region. Envilder now sets `AWS_PROFILE` so the AWS SDK resolves
  both the profile's region and its (SSO-capable) credentials natively.
  Region resolution order is `AWS_REGION` > `AWS_DEFAULT_REGION` >
  profile region > `us-east-1` fallback
  ([#382](https://github.com/macalbert/envilder/issues/382))

### Added

* **Log the effective AWS identity before resolving secrets**:
  Before the first read or write, Envilder logs
  `☁ AWS identity · account=… · region=… · profile=…` so a misrouted account
  or region is immediately visible. The account is read from the active
  credentials, falling back to an STS `GetCallerIdentity` call when not
  present, then `unknown`
  ([#382](https://github.com/macalbert/envilder/issues/382))

---

## [0.12.0] - 2026-06-26

### Changed

* **Preserve existing `.env` formatting on pull**: When the target `.env`
  file already exists, Envilder now updates values in place instead of
  rewriting the file from scratch. Full-line comments, blank lines, key
  ordering, `export` prefixes, and surrounding spacing are preserved; only
  the values of mapped keys are replaced, and new keys are appended at the
  end. (Inline comments after a value, e.g. `KEY=val # note`, are not
  preserved.)

---

## [0.11.1] - 2026-06-25

### Fixed

* **AWS SSO / assumed-role profiles now resolve correctly**: Selecting an
  SSO, IAM Identity Center, or assumed-role profile (via `--profile` or
  `$config.profile`) now resolves credentials through the full AWS provider
  chain instead of silently falling back to the default credentials.
  Previously these profiles were ignored, reading and writing secrets against
  the wrong AWS account
  ([#364](https://github.com/macalbert/envilder/issues/364))

---

## [0.11.0] - 2026-05-31

### Changed

* **BREAKING: Require Node.js >= 22.12**: pnpm 11, testcontainers v12,
  commander 15, and commitlint 21 require Node.js 22.12+. The `engines`
  field now enforces `>=22.12.0`
  ([#291](https://github.com/macalbert/envilder/pull/291))

### Dependencies

* Update all devDependencies to latest (TypeScript 6.0.3, Biome 2.4.16,
  testcontainers 12.0.1, pnpm 11.5.0)
* Remove `rimraf`: replaced with zero-dependency `fs.rmSync` in clean scripts
  ([#291](https://github.com/macalbert/envilder/pull/291))

---

## [0.10.0] - 2026-05-03

### Added

* **Map-file JSON Schema**: A formal JSON Schema specification for map files,
  published at `https://envilder.com/schema/map-file.v1.json`. Add
  `"$schema": "https://envilder.com/schema/map-file.v1.json"` to any map file
  for IDE autocomplete, inline documentation, and validation
  ([#217](https://github.com/macalbert/envilder/pull/217))
* **Schema contract tests**: 39 tests validating the JSON Schema across all
  providers (AWS, Azure, GCP, HashiCorp Vault, file)

### Fixed

* **Reserved key filtering**: All `$`-prefixed keys (e.g. `$schema`) are now
  excluded from variable mappings. Previously only `$config` was filtered,
  causing `$schema` to leak into environment variables
  ([#218](https://github.com/macalbert/envilder/pull/218))

---

## [0.9.4] - 2026-05-03

### Fixed

* Mask secret path in bulk push log output (#185)

---

## [0.9.3] - 2026-04-17

### Added

* **Runtime SDKs now available**: Load secrets directly into your application
  at startup, no `.env` file needed:

  **.NET** ([NuGet](https://www.nuget.org/packages/Envilder)):

  ```csharp
  builder.Configuration.AddEnvilder("envilder.json");
  ```

  **Python** ([PyPI](https://pypi.org/project/envilder)):

  ```python
  from envilder import Envilder
  Envilder.load('envilder.json')
  ```

  **CLI** (as always):

  ```bash
  npx envilder --map=envilder.json --envfile=.env
  ```

  **GitHub Action:**

  ```yaml
  - uses: macalbert/envilder/github-action@v0
    with:
      map-file: envilder.json
      env-file: .env
  ```

### Changed

* **README rewritten**: Streamlined messaging, accurate comparison
  tables, simplified quick start (2 steps), and reduced noise

### Fixed

* **ci(publish-npm):** Narrowed `paths` filter from `src/**` to
  `src/envilder/**` so SDK/website/IaC changes no longer trigger the
  npm publish workflow
* **ci(publish-npm):** Replaced `npm view` with `curl` against the npm
  registry API to avoid `.npmrc` auth failures during version detection
* **ci(publish-website):** Added `docs/CHANGELOG.md` and
  `docs/changelogs/**` to path filters so changelog updates trigger
  website deployment

### Dependencies

* Bump `typescript` from 6.0.2 to 6.0.3

---

## [0.9.2] - 2026-04-02

### Added

* **LocalStack sponsor section**: Added sponsor section to website homepage and README with LocalStack logos
  (dark, light, color variants) and a new `Sponsors.astro` component
  ([#136](https://github.com/macalbert/envilder/pull/136))
* **Website test suite**: Added `tests/website/` with Vitest coverage for i18n utilities and Markdown helpers
* **`BackToTop` component**: New scroll-to-top button component for the documentation website

### Changed

* **Project layout restructured for SDK platform readiness** ([#134](https://github.com/macalbert/envilder/pull/134)):
  * Core domain layer moved from `src/envilder/` to `src/envilder/core/`
  * Website moved from `src/apps/website/` to `src/website/`
  * All imports, `tsconfig.json`, `package.json`, and workspace config updated accordingly
* **Website UX improvements**: `DocsContent`, `HowItWorks`, `ThemeSwitcher`, `TerminalMockup`, and
  `BaseLayout` components updated; global CSS expanded; i18n keys added for new content

### Fixed

* **README:** Replace `#gh-light-mode-only` / `#gh-dark-mode-only` image fragments with a `<picture>`
  element using `prefers-color-scheme` media queries
* **ci:** Update version check in publish workflow to use published version from npm

### Dependencies

* Bump `@aws-sdk/client-ssm` from 3.1019.0 to 3.1021.0 ([#140](https://github.com/macalbert/envilder/pull/140))
* Bump `@aws-sdk/credential-providers` from 3.1019.0 to 3.1021.0 ([#142](https://github.com/macalbert/envilder/pull/142))
* Bump `secretlint` from 11.4.0 to 11.4.1 ([#141](https://github.com/macalbert/envilder/pull/141))
* Bump `@secretlint/secretlint-rule-preset-recommend` from 11.4.0 to 11.4.1 ([#144](https://github.com/macalbert/envilder/pull/144))
* Bump `astro` from 6.1.1 to 6.1.2 ([#143](https://github.com/macalbert/envilder/pull/143))
* Bump `actions/configure-pages` from 5 to 6 ([#139](https://github.com/macalbert/envilder/pull/139))
* Bump `actions/deploy-pages` from 4 to 5 ([#138](https://github.com/macalbert/envilder/pull/138))
* Bump `pnpm/action-setup` from 4 to 5 ([#137](https://github.com/macalbert/envilder/pull/137))

---

## [0.9.1] - 2026-03-30

### Added

* **Documentation website**: Full Astro-based docs site deployed at [envilder.com](https://envilder.com),
  with multi-language support (EN, ES, CA), dark/retro and light themes, and a dedicated changelog page

### Changed

* Updated Envilder logo in README

### Fixed

* **deps:** Move `@types/node` from `dependencies` to `devDependencies` to prevent it from being bundled as a runtime dependency
  ([#135](https://github.com/macalbert/envilder/pull/135))
* **e2e:** Use unique SSM paths per CLI test run to prevent race conditions between parallel test executions

### Dependencies

* Bump `brace-expansion` from 5.0.4 to 5.0.5 (security patch)
* Bump `@azure/core-rest-pipeline` and `@azure/identity` group updates

---

## [0.8.0] - 2026-03-26

### Added

* **`$config` section in map files**: Map files now support an optional `$config` key to declare provider
  and connection details inline (e.g., `"provider": "azure"`, `"vaultUrl": "https://..."`,
  `"profile": "dev-account"`)
* New CLI flag `--vault-url <url>`: Azure Key Vault URL, overrides `$config.vaultUrl` in the map file
* Precedence chain: CLI flags > `$config` in map file > defaults
* Backward compatible: existing map files without `$config` continue to work (defaults to AWS provider)
* **Azure Key Vault support**: Use `--provider=azure` to pull/push secrets from Azure Key Vault ([#90](https://github.com/macalbert/envilder/pull/90))
* New infrastructure adapter: `AzureKeyVaultSecretProvider` implementing `ISecretProvider`
* New CLI option `--provider <name>` to select cloud provider (`aws` or `azure`, default: `aws`)
* Azure authentication via `DefaultAzureCredential` (supports Azure CLI, managed identity, etc.)
* Automatic secret name normalization for Key Vault naming constraints (alphanumeric and hyphens,
  1–127 characters)

### Security

* **Vault URL validation**: Azure Key Vault URLs must use HTTPS and match an Azure domain allowlist
  (with dot-boundary checks), preventing SSRF through spoofed hostnames

### Changed

* **CLI flag `--ssm-path` renamed to `--secret-path`**: The old flag is still accepted as a deprecated
  alias and prints a warning. It will be removed in a future release.
* `configureInfrastructureServices()` now receives a single `MapFileConfig` object instead of separate parameters
* CLI reads `$config` from the map file and merges with CLI flags
* Extracted shared `ContainerConfiguration` module for DI setup reused by CLI and GitHub Action
* Updated CLI description to include Azure Key Vault examples

### Dependencies

* Added `@azure/keyvault-secrets`
* Added `@azure/identity`
* Added `@azure/core-rest-pipeline`

---

## [0.7.12] - 2026-03-22

### Fixed

* **ssm:** Upgrade AWS SDK to resolve fast-xml-parser CVEs ([#128](https://github.com/macalbert/envilder/pull/128))

### Changed

* **ci:** Upgrade `dorny/test-reporter` to v3 for Node.js 24 support ([#127](https://github.com/macalbert/envilder/pull/127))
* **dx:** Add AI workflow agents, prompts, and lefthook pre-commit hook ([#125](https://github.com/macalbert/envilder/pull/125))

### Dependencies

* Bump `undici` from 7.22.0 to 7.24.1 ([#126](https://github.com/macalbert/envilder/pull/126))

---

## [0.7.11] - 2026-03-08

### Security

* Bump AWS SDK packages to resolve `fast-xml-parser` vulnerability ([#124](https://github.com/macalbert/envilder/pull/124))

---

## [0.7.10] - 2026-03-02

### Changed

* **ci:** Update CI configuration for improved build reliability
* Bump AWS SDK SSM to 3.1000.0 and align CI/publish workflows ([#123](https://github.com/macalbert/envilder/pull/123))

### Dependencies

* Bump `@aws-sdk/credential-providers` from 3.995.0 to 3.1000.0 ([#122](https://github.com/macalbert/envilder/pull/122))
* Bump `@types/node` from 25.3.0 to 25.3.3 ([#121](https://github.com/macalbert/envilder/pull/121))
* Bump `minimatch` ([#119](https://github.com/macalbert/envilder/pull/119))

---

## [0.7.9] - 2026-02-22

### Fixed

* **security:** Patch transitive dependency vulnerabilities ([#118](https://github.com/macalbert/envilder/pull/118))
* **ci:** Simplify npm publish command in workflow

---

## [0.7.8] - 2026-02-05

### Fixed

* **deps:** Upgrade AWS SDK to resolve `fast-xml-parser` DoS vulnerability ([#116](https://github.com/macalbert/envilder/pull/116))

### Dependencies

* Bump `@isaacs/brace-expansion` ([#115](https://github.com/macalbert/envilder/pull/115))
* Bump `@secretlint/secretlint-rule-preset-recommend` ([#114](https://github.com/macalbert/envilder/pull/114))
* Bump `commander` from 14.0.2 to 14.0.3 ([#113](https://github.com/macalbert/envilder/pull/113))
* Bump `@aws-sdk/client-ssm` from 3.958.0 to 3.980.0 ([#112](https://github.com/macalbert/envilder/pull/112))
* Bump `secretlint` from 11.2.5 to 11.3.1 ([#110](https://github.com/macalbert/envilder/pull/110))
* Bump `@commitlint/cli` from 20.3.0 to 20.4.0 ([#111](https://github.com/macalbert/envilder/pull/111))

---

## [0.7.7] - 2026-01-27

### Added

* **push:** AWS throttling retry logic and duplicate SSM path validation ([#109](https://github.com/macalbert/envilder/pull/109))

### Fixed

* **ci:** Streamline `npm publish` workflow to prevent failures ([#106](https://github.com/macalbert/envilder/pull/106))

### Dependencies

* Bump `lodash` ([#108](https://github.com/macalbert/envilder/pull/108))
* Bump `diff` ([#107](https://github.com/macalbert/envilder/pull/107))

---

## [0.7.6] - 2026-01-16

### Fixed

* **ci:** Align npm publish script with CI workflow expectations to prevent failures
* Removed redundant validation steps (lint, build, test) from publish script

### Changed

* Simplified npm publish script from full validation pipeline to `npm pack --dry-run && npm publish`
* Updated README badge links
* Converted README badges from HTML to standard Markdown format

### Removed

* **ci:** Deleted deprecated `publish-action.yml` workflow

---

## [0.7.5] - 2026-01-15

### Documentation

* Remove changelog generation instructions from documentation ([#104](https://github.com/macalbert/envilder/pull/104))

### Dependencies

* Bump undici to address security vulnerability ([#105](https://github.com/macalbert/envilder/pull/105))

---

## [0.7.4] - 2026-01-02

### Dependencies

* Bump @commitlint/cli from 20.1.0 to 20.2.0 ([#103](https://github.com/macalbert/envilder/pull/103))
* Bump testcontainers from 11.9.0 to 11.11.0 ([#102](https://github.com/macalbert/envilder/pull/102))
* Bump @types/node from 24.10.1 to 25.0.3 ([#101](https://github.com/macalbert/envilder/pull/101))
* Bump @testcontainers/localstack from 11.9.0 to 11.11.0 ([#100](https://github.com/macalbert/envilder/pull/100))
* Bump @commitlint/config-conventional ([#99](https://github.com/macalbert/envilder/pull/99))

---

## [0.7.3] - 2025-11-29

### Changed

* **ci:** Update Node.js version to 24 in workflow
* Update publish command to use pnpm
* Add repository field to package.json
* Standardize quotes in publish-npm.yml

### Dependencies

* Bump actions/checkout from 5 to 6 ([#98](https://github.com/macalbert/envilder/pull/98))
* Bump glob from 11.1.0 to 13.0.0 ([#97](https://github.com/macalbert/envilder/pull/97))
* Bump pnpm/action-setup from 2 to 4 ([#92](https://github.com/macalbert/envilder/pull/92))
* Bump @commitlint/cli from 19.8.1 to 20.1.0 ([#94](https://github.com/macalbert/envilder/pull/94))
* Bump glob in the npm_and_yarn group ([#96](https://github.com/macalbert/envilder/pull/96))

---

## [0.7.1] - 2025-11-16

### Documentation

* Update README and ROADMAP for GitHub Action integration ([#95](https://github.com/macalbert/envilder/pull/95))

### Changed

* **ci:** Update workflow to use pnpm for dependency management

### Tests

* Increase timeout for E2E tests to 60 seconds

---

## [0.7.0] - 2025-11-16

### Added

* **packaging:** Add project build and uninstall functionality

### Fixed

* **cli:** Correct build command from `ppnpm` to `pnpm`

### Changed

* Move GitHub Action to `github-action/` subfolder

### Breaking Changes

* Action path changed from `macalbert/envilder@v1` to `macalbert/envilder/github-action@v1`

---

## [0.6.6] - 2025-11-02

### Changed

* Updated AWS credentials configuration in workflows
* Bumped vite, @types/node, @biomejs/biome, GitHub/codeql-action, actions/setup-node, vitest

---

## [0.6.5] - 2025-10-15

### Added

* Enabled npm trusted publishing with OIDC authentication

### Dependencies

* Bumped tmp, @types/node, @testcontainers/localstack, testcontainers, @aws-sdk/credential-providers
* Bumped secretlint, @biomejs/biome, @secretlint/secretlint-rule-preset-recommend
* Bumped vite, commander, inversify
* Updated actions/checkout, actions/setup-node, actions/upload-pages-artifact, aws-actions/configure-aws-credentials

---

## [0.6.4] - 2025-08-02

### Dependencies

* Bumped typescript from 5.8.3 to 5.9.2
* Bumped secretlint, @types/glob, @secretlint/secretlint-rule-preset-recommend, @biomejs/biome

---

## [0.6.3] - 2025-07-20

### Changed

* Bump version to 0.6.3 in package.json

---

## [0.6.2] - 2025-07-20

### Changed

* **di:** Implement .NET-Style DIP Startup Pattern for dependency injection ([#59](https://github.com/macalbert/envilder/pull/59))

---

## [0.6.1] - 2025-07-13

### Added

* **Push Mode** functionality to upload environment variables to AWS SSM Parameter Store
* File-based approach for pushing multiple variables from `.env` files
* Single-variable approach for direct command line uploads
* Support for working with different AWS profiles when pushing secrets

### Security

* Implemented secure parameter handling to protect sensitive values

### Changed

* Designed clean, modular command structure for Push Mode operations
* Added new domain models and handlers to support Push feature
* Maintained separation of concerns between infrastructure and application layers

---

## [0.6.0] - 2025-07-13

### Added

* **push:** Introduced Push Mode: sync local `.env` variables to AWS SSM Parameter Store ([#57](https://github.com/macalbert/envilder/pull/57))

---

## [0.5.6] - 2025-07-06

### Added

* Introduced new logger interface for seamless integration of custom logging implementations

### Changed

* Updated several packages for improved security and performance

---

## [0.5.5] - 2025-06-29

### Changed

* Moved `EnvilderBuilder` from `domain` to `application/builders` directory
* Updated import paths across codebase for better organization

### Fixed

* Fixed glob pattern and path handling in test cleanup functions
* Corrected file path resolution in end-to-end tests

---

## [0.5.4] - 2025-06-10

### Added

* Added unit tests for error handling with missing CLI arguments
* Enhanced unit test reporting with JUnit format for better CI integration

### Changed

* Refactored `EnvFileManager` and related interfaces to use async/await
* Improved error handling and modularized secret processing
* Extracted `PackageJsonFinder` class
* Updated dependencies for better reliability

---

## [0.5.3] - 2025-06-07

### Added

* Modular CLI for environment variable synchronization with pluggable secret providers
* Builder pattern for flexible CLI configuration and usage
* Extensive unit, integration, and end-to-end tests
* AWS integration testing using LocalStack with TestContainers

### Changed

* **BREAKING**: Full TypeScript migration from JavaScript
* Introduced modular, layered architecture with clear separation
* Migrated CI/CD workflows from Yarn to npm

---

## [0.5.2] - 2025-05-18

### Added

* Comprehensive E2E validation test in CI/CD pipeline
* Ensures package integrity and command-line operability before release

---

## [0.5.1] - 2025-05-16

### Fixed

* CLI command not recognized after global install (`npm install -g envilder`)
* Fixed missing compiled `lib/` files in published package

---

## [0.3.0] - 2025-05-09

### Added

* **`--profile` option**: Choose which AWS CLI profile to use for credentials,
  so you can work with different AWS accounts or configurations
  ([#31](https://github.com/macalbert/envilder/pull/31))

### Dependencies

* Bumped commander from 12.1.0 to 13.1.0, @aws-sdk/client-ssm, @types/node,
  vite and @secretlint/secretlint-rule-preset-recommend

---

## [0.2.3] - 2025-04-13

### Dependencies

* Bumped @aws-sdk/client-ssm from 3.670.0 to 3.716.0
* Bumped nanoid (security patch), @types/node, @biomejs/biome, secretlint and
  @secretlint/secretlint-rule-preset-recommend

---

## [0.2.1] - 2024-10-16

### Added

* **Preserve existing `.env` variables**: When the target `.env` already
  exists, its variables are kept and only the mapped ones are added or updated
  ([#5](https://github.com/macalbert/envilder/pull/5))
* Secret values are masked in console output
* Code coverage reporting published to GitHub Pages
  ([#2](https://github.com/macalbert/envilder/pull/2))
* CodeQL code scanning ([#4](https://github.com/macalbert/envilder/pull/4))

---

## [0.1.4] - 2024-10-01

### Added

* **Initial release**: Generate `.env` files from AWS SSM Parameter Store
  using a JSON map of environment variable names to SSM parameter paths
* Supports both encrypted (`SecureString`) and plain SSM parameters