wrangler dotenv --secrets-file expands variable references
Introduced 2026-10-26 · score 0.95
HOW TO USE IT
When uploading secrets with Wrangler, use `--secrets-file <file>` with `deploy` or `versions upload` to provide a JSON or dotenv file. The docs do not show this flag for `preview` or document dotenv variable expansion, so those details are not included as verified usage.
npx wrangler deploy --secrets-file <dotenv-or-json-file>npx wrangler versions upload --secrets-file <dotenv-or-json-file>WHY THIS HELPS
When deploying, uploading a version, or previewing with a dotenv secrets file, preserve and manage variable references and their process environment values.
BEFORE THIS CHANGE
Provide dotenv input through `--secrets-file` with values parsed literally, without expanding `$VAR` or `${VAR}` references.
REQUIREMENTS AND LIMITATIONS
- Version: 4.153.0
- --secrets-file <file>: Optional path to a JSON or `.env` file containing secrets to upload; existing secrets omitted from the file are preserved. The flag takes a file path when used.
- Unset references become an empty string; for example, `PASSWORD=pa$word` becomes `pa` when `word` is unset.
- Process environment values override matching file keys, including explicitly empty values.
- Dotenv secrets files can read and upload any process environment value, so their contents should not be modifiable by untrusted contributors in CI.
- JSON secrets input and bulk-secret commands, including piped stdin, retain literal parsing.
FIRST-PARTY EVIDENCE
- https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.153.0
- https://developers.cloudflare.com/workers/configuration/secrets/
- https://developers.cloudflare.com/workers/wrangler/commands/workers/
Check the installed version and the source before using it. Entry JSON