v4.0.2

Release Notes v4.0.2

This release introduces serverOnly() for safe isomorphic access to server secrets and modernizes dependency management with pnpm catalog.

🌟 Highlights

✨ New serverOnly() Function for Isomorphic Server Secrets

Access server-only environment variables without throwing in browser contexts. Unlike env(), the new serverOnly() function gracefully returns a fallback value when called from client code, enabling cleaner isomorphic patterns.

import { serverOnly } from 'next-dynenv'

// Returns actual value on server, fallback on client
const dbUrl = serverOnly('DATABASE_URL', 'postgresql://localhost:5432/dev')
const apiSecret = serverOnly('API_SECRET_KEY') // undefined on client

This is particularly useful for shared configuration modules with lazy evaluation patterns using Zod schemas.

📦 Centralized Dependency Versions with pnpm Catalog

Dependency versions are now centralized in pnpm-workspace.yaml using the catalog: protocol. This ensures consistent versions across the workspace and simplifies version bumps.

✨ Features

• serverOnly() function — New export in src/script/env.ts that reads non-public environment variables without throwing in browser contexts. Returns the fallback value when window exists, reads process.env on the server.

• pnpm catalog support — All dependencies in package.json and test-app/package.json now use catalog: references pointing to versions defined in pnpm-workspace.yaml.

• next moved to devDependencies — The next package is only needed for development and testing, not as a runtime dependency of the published package.

🔧 Improvements

• pnpm version via packageManager field — Upgraded to pnpm 10.26.0 and removed explicit PNPM_VERSION env variables from CI workflows. The pnpm/action-setup@v4 action automatically detects the version from the packageManager field in package.json.

• Security override cleanup — Removed the js-yaml security override from pnpm config as the vulnerability in transitive dependencies has been resolved upstream.

• Security overrides for transitive deps — Added pnpm overrides for glob (>=10.5.0) and brace-expansion (>=2.0.2) to address security vulnerabilities.