fix(env): prevent env expand on process.env (#11213)

package.json

@@ -127,6 +127,9 @@
           "acorn": "*"
         }
       }
+    },
+    "patchedDependencies": {
+      "dotenv-expand@9.0.0": "patches/dotenv-expand@9.0.0.patch"
     }
   }
 }

packages/vite/src/node/env.ts

@@ -35,19 +35,9 @@ export function loadEnv(
     }),
   )
 
-  const expandOptions = {
-    parsed: {
-      ...(process.env as any),
-      ...parsed,
-    },
-    // prevent process.env mutation
-    ignoreProcessEnv: true,
-  }
-
-  let expandParsed: NonNullable<ReturnType<typeof expand>['parsed']>
   try {
     // let environment variables use each other
-    expandParsed = expand(expandOptions).parsed!
+    expand({ parsed })
   } catch (e) {
     // custom error handling until https://github.com/motdotla/dotenv-expand/issues/65 is fixed upstream
     // check for message "TypeError: Cannot read properties of undefined (reading 'split')"
@@ -59,10 +49,6 @@ export function loadEnv(
     throw e
   }
 
-  Object.keys(parsed).forEach((key) => {
-    parsed[key] = expandParsed[key]
-  })
-
   // only keys that start with prefix are exposed to client
   for (const [key, value] of Object.entries(parsed)) {
     if (prefixes.some((prefix) => key.startsWith(prefix))) {

patches/dotenv-expand@9.0.0.patch

@@ -0,0 +1,18 @@
+diff --git a/lib/main.js b/lib/main.js
+index c873cc77229d4cd0cf9de98ae0970b25d89f312f..ddf570558e985760efde52af37a41b56282d30a6 100644
+--- a/lib/main.js
++++ b/lib/main.js
+@@ -50,9 +50,10 @@ function expand (config) {
+     config.parsed[configKey] = _interpolate(value, environment, config)
+   }
+
+-  for (const processKey in config.parsed) {
+-    environment[processKey] = config.parsed[processKey]
+-  }
++  // PATCH: don't write to process.env
++  // for (const processKey in config.parsed) {
++  //   environment[processKey] = config.parsed[processKey]
++  // }
+
+   return config
+ }