chore(deps): replace dotenvx with dotenv and update overrides

[sriramveeraghanta]

Summary

• Replaced @dotenvx/dotenvx with dotenv (16.4.7) across the monorepo — only dotenv.config() was used, so the API is fully compatible
• Updated serialize-javascript override from 7.0.3 to 7.0.5
• Added path-to-regexp 0.1.13 to pnpm overrides

Changes

• pnpm-workspace.yaml: Updated catalog entry from @dotenvx/dotenvx to dotenv
• apps/live, web, space, admin: Updated package.json dependencies and source imports (env.ts, vite.config.ts)
• package.json: Added path-to-regexp override, bumped serialize-javascript override
• pnpm-lock.yaml: Regenerated (net -93 lines, fewer transitive deps)

Test plan

• Verify pnpm install completes without errors
• Verify pnpm build succeeds for all apps (live, web, space, admin)
• Verify env variables load correctly in dev mode for each app

Summary by CodeRabbit

• Chores
  • Replaced the environment configuration library across all apps for consistent env loading.
  • Updated workspace dependency catalog and package override versions to address tooling stability and security.
  • Aligned dev-dependencies in app manifests to ensure uniform behavior during local development and builds.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR replaces the @dotenvx/dotenvx package with the standard dotenv package across the monorepo. Changes update devDependencies in multiple app package.json files, switch imports in Vite and env loaders to dotenv, refresh the pnpm workspace catalog entry, and adjust root pnpm.overrides versions.

Changes

Cohort / File(s)	Summary
App package.json dependencies apps/admin/package.json, apps/live/package.json, apps/space/package.json, apps/web/package.json	Replaced @dotenvx/dotenvx with dotenv in devDependencies (catalog spec).
Vite configuration files apps/admin/vite.config.ts, apps/space/vite.config.ts, apps/web/vite.config.ts	Changed import source from @dotenvx/dotenvx to dotenv; dotenv.config(...) usage unchanged.
App env loader apps/live/src/env.ts	Swapped import to dotenv; Zod validation and process exit behavior preserved.
Workspace catalog pnpm-workspace.yaml	Removed @dotenvx/dotenvx@1.51.1 and added dotenv@16.4.7 to the catalog.
Root package overrides package.json	Bumped serialize-javascript override 7.0.3→7.0.5 and added path-to-regexp@0.1.13 override.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• chore: standard replacement from dotenv to dotenvx #8216: Directly related — edits the same files/imports to swap between dotenv and @dotenvx/dotenvx.

Suggested reviewers

• pushya22

Poem

🐰 I hopped through packages, soft and spry,
Swapped dotenvx for dotenv under the sky.
Configs now tidy, envs align,
A little change, and everything's fine. 🌱

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main changes: replacing dotenvx with dotenv and updating dependency overrides across the monorepo.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The PR description covers all required template sections with clear explanations of changes, test scenarios, and rationale.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/deps-replace-dotenvx-update-overrides

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Updates dependency management across the monorepo by replacing @dotenvx/dotenvx with dotenv, and adjusting pnpm overrides/lockfile to reduce transitive dependencies and bump patched versions.

Changes:

• Replace @dotenvx/dotenvx usage with dotenv (catalog + app-level dependency updates + import updates).
• Bump serialize-javascript override to 7.0.5.
• Add a path-to-regexp override and regenerate pnpm-lock.yaml.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pnpm-workspace.yaml	Updates the workspace catalog to use dotenv@16.4.7 instead of @dotenvx/dotenvx.
package.json	Updates pnpm.overrides (serialize-javascript bump; adds path-to-regexp override).
pnpm-lock.yaml	Reflects catalog/override changes and dependency graph updates after lock regeneration.
apps/web/vite.config.ts	Switches dotenv import to dotenv.
apps/web/package.json	Replaces @dotenvx/dotenvx devDependency with dotenv.
apps/space/vite.config.ts	Switches dotenv import to dotenv.
apps/space/package.json	Replaces @dotenvx/dotenvx devDependency with dotenv.
apps/admin/vite.config.ts	Switches dotenv import to dotenv.
apps/admin/package.json	Replaces @dotenvx/dotenvx devDependency with dotenv.
apps/live/src/env.ts	Switches dotenv import to dotenv while keeping dotenv.config() usage.
apps/live/package.json	Replaces @dotenvx/dotenvx dependency with dotenv.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[Copilot]

The pnpm.overrides entry forces all path-to-regexp versions to 0.1.13, which is a major-version downgrade for dependencies that previously resolved to path-to-regexp@3.x (see pnpm-lock: serve-handler@6.1.6 now pulls 0.1.13). This can break packages expecting the v3 API. Prefer a targeted override (e.g., only overriding path-to-regexp@0.1.12 -> 0.1.13) so v3+ consumers keep their compatible major version.

Suggested change

	"path-to-regexp": "0.1.13"
	"path-to-regexp@0.1.12": "0.1.13"

[Copilot]

serve-handler@6.1.6 is now resolved with path-to-regexp@0.1.13 due to the new global override. Earlier it resolved path-to-regexp@3.3.0; forcing a 0.1.x major here is very likely incompatible with serve-handler and can break serve at runtime. The override should be narrowed so only the vulnerable 0.1.x line is bumped, without affecting 3.x consumers.

Suggested change

	path-to-regexp: 0.1.13
	path-to-regexp: 3.3.0