dotenv-webpack

A secure webpack plugin that wraps dotenv and Webpack.DefinePlugin to expose only explicitly referenced process.env variables in your bundle. Current version 9.0.0 (2026-03-07) supports webpack 4/5 and Node >=18.18.0. Unlike raw dotenv, it safely reduces leakage of sensitive keys by only including variables actually used in code. Compatible with rspack since v8.1.0. Breaking change in v9: package exports directly from src/index.js, no dist/ wrappers. Release cadence is irregular, with major versions every 1-2 years.