Remove dotenv from cli-kit; use native util.parseEnv

package.json

@@ -52,7 +52,7 @@
     "@octokit/rest": "22.0.0",
     "@shopify/eslint-plugin-cli": "file:packages/eslint-plugin-cli",
     "@shopify/generate-docs": "1.2.0",
-    "@types/node": "18.19.70",
+    "@types/node": "22.19.17",
     "@typescript-eslint/parser": "8.56.1",
     "@vitest/coverage-istanbul": "^3.1.4",
     "bugsnag-build-reporter": "^2.0.0",

packages/cli-kit/package.json

@@ -123,7 +123,6 @@
     "color-json": "3.0.5",
     "conf": "11.0.2",
     "deepmerge": "4.3.1",
-    "dotenv": "16.4.7",
     "env-paths": "3.0.0",
     "execa": "7.2.0",
     "fast-glob": "3.3.3",

packages/cli-kit/src/public/node/dot-env.ts

@@ -1,7 +1,7 @@
 import {outputDebug, outputContent, outputToken} from './output.js'
 import {AbortError} from './error.js'
 import {fileExists, readFile, writeFile} from './fs.js'
-import {parse} from 'dotenv'
+import {parseEnv} from 'node:util'
 
 /**
  * This interface represents a .env file.
@@ -30,7 +30,8 @@ export async function readAndParseDotEnv(path: string): Promise<DotEnvFile> {
   const content = await readFile(path)
   return {
     path,
-    variables: parse(content),
+    // parseEnv types values as `string | undefined`, but it never yields undefined values at runtime.
+    variables: parseEnv(content) as Record<string, string>,
   }
 }
 

packages/e2e/package.json

@@ -32,7 +32,7 @@
     "@iarna/toml": "2.2.5",
     "@playwright/test": "^1.50.0",
     "@shopify/toml-patch": "0.3.0",
-    "@types/node": "18.19.70",
+    "@types/node": "22.19.17",
     "dotenv": "16.4.7",
     "execa": "^7.2.0",
     "node-pty": "^1.0.0",

packages/eslint-plugin-cli/rules/no-inline-graphql.js

@@ -2,6 +2,7 @@
 const path = require('path')
 const fs = require('fs')
 const crypto = require('crypto')
+const {execFileSync} = require('child_process')
 const debugEnabled = process.env.DEBUG && process.env.DEBUG.includes('eslint-plugin-cli')
 
 /**
@@ -31,9 +32,28 @@ function hashFileSync(filePath, algorithm = 'sha256') {
   return hash.digest('hex')
 }
 
+// The `knownFailures` keys are repo-root-relative, so we need the repo root to
+// build the lookup key. Ask git rather than deriving it from this rule's
+// __dirname: the package manager can place the plugin at different depths in
+// node_modules (e.g. pnpm `file:` injection vs `link:` symlink, depending on
+// peer resolution), so a fixed `..` offset from a shifting __dirname silently
+// breaks the lookup and flags every grandfathered file. This rule only runs in
+// dev/CI, where git is always available; memoized since the root is constant
+// for a lint run.
+let repoRoot
+function findRepoRoot(filePath) {
+  if (repoRoot === undefined) {
+    repoRoot = execFileSync('git', ['rev-parse', '--show-toplevel'], {
+      cwd: path.dirname(filePath),
+      encoding: 'utf8',
+    }).trim()
+  }
+  return repoRoot
+}
+
 function checkKnownFailuresIfShouldFail(context) {
   const filePath = context.filename || context.getFilename()
-  const relativePath = path.relative(path.resolve(__dirname, '../../../../../../..'), filePath)
+  const relativePath = path.relative(findRepoRoot(filePath), filePath).split(path.sep).join('/')
   const fileHash = hashFileSync(filePath)
   const shouldFail = !knownFailures[relativePath] || knownFailures[relativePath] !== fileHash
 

packages/theme/src/cli/utilities/errors.test.ts

@@ -77,7 +77,7 @@ describe('errors', () => {
 
     beforeEach(() => {
       // Use a more reliable mock that throws an error
-      vi.spyOn(process, 'exit').mockImplementation((code?: number): never => {
+      vi.spyOn(process, 'exit').mockImplementation((code?: string | number | null): never => {
         throw new Error(`Process exit with code ${code}`)
       })
     })

packages/theme/src/cli/utilities/theme-environment/theme-polling.test.ts

@@ -125,7 +125,7 @@ describe('pollRemoteJsonChanges', async () => {
     vi.mocked(fetchChecksums).mockResolvedValue(updatedRemoteChecksums)
 
     // Mock process.exit with a function that throws instead of actually exiting
-    vi.spyOn(process, 'exit').mockImplementation((code?: number): never => {
+    vi.spyOn(process, 'exit').mockImplementation((code?: string | number | null): never => {
       throw new Error(`Process exit with code ${code}`)
     })