fix(env): resolve dotenv ${VAR} against the file's own values before ambient env

Cargo.toml

@@ -13,6 +13,7 @@ members = [
   "crates/mise-sigstore",
   "crates/mise-settings",
   "crates/mise-util",
+  "crates/mise-dotenv",
 ]
 
 [package]
@@ -129,7 +130,7 @@ contracts = "0.6"
 dashmap = "6"
 demand = "2"
 diffy = "0.5"
-dotenvy = "0.15"
+mise-dotenv = { path = "crates/mise-dotenv", version = "0.1" }
 duct = "1"
 dunce = "1"
 expr-lang = "2"

crates/mise-dotenv/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "mise-dotenv"
+version = "0.1.0"
+edition = "2024"
+license = "MIT"
+description = "dotenv parser with explicit control over variable substitution, vendored from dotenv-ng-core"
+repository = "https://github.com/jdx/mise"
+
+[dev-dependencies]
+proptest = { version = "1", default-features = false, features = ["std"] }
+temp-env = "0.3"
+
+[lib]
+doctest = false

crates/mise-dotenv/LICENSE

@@ -0,0 +1,22 @@
+# The MIT License (MIT)
+
+Copyright (c) 2014 Santiago Lapresta and contributors
+Copyright (c) 2026 Domen Kožar
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

crates/mise-dotenv/README.md

@@ -0,0 +1,8 @@
+# mise-dotenv
+
+A dotenv parser used by mise for `.env` files. Vendored and trimmed from
+[`dotenv-ng-core`](https://github.com/cachix/dotenv-ng) 1.0.0 (itself a fork of
+[`dotenvy`](https://github.com/allan2/dotenvy)), MIT licensed; see `LICENSE`.
+
+Unlike upstream's loader, `mise_dotenv::parse` never reads the process environment, so a file's own
+assignments are not shadowed by ambient variables. Process-environment mutation was removed.

crates/mise-dotenv/src/err.rs

@@ -0,0 +1,171 @@
+use std::{error, ffi::OsString, fmt, io, path::PathBuf};
+
+use crate::ParseError;
+use crate::iter::ParseBufError;
+
+#[derive(Debug)]
+#[non_exhaustive]
+pub enum Error {
+    /// The input did not conform to the supported dotenv syntax.
+    Parse(Box<ParseError>, Option<PathBuf>),
+    /// An IO error may be encountered when reading from a file or reader.
+    Io(io::Error, Option<PathBuf>),
+    /// The variable was not found in the environment. The `String` is the name of the variable.
+    NotPresent(String),
+    /// The variable was not valid unicode. The `String` is the name of the variable.
+    NotUnicode(OsString, String),
+    /// An environment variable name was not valid Unicode.
+    NotUnicodeName(OsString),
+    /// When a load function is called with no path or reader.
+    ///
+    /// This can occur when `EnvLoader::with_paths` or `EnvLoader::with_readers` receives an empty
+    /// iterator.
+    NoInput,
+}
+
+impl Error {
+    #[must_use]
+    pub fn not_found(&self) -> bool {
+        if let Self::Io(e, _) = self {
+            e.kind() == io::ErrorKind::NotFound
+        } else {
+            false
+        }
+    }
+}
+
+impl error::Error for Error {
+    fn source(&self) -> Option<&(dyn error::Error + 'static)> {
+        match self {
+            Self::Io(e, _) => Some(e),
+            Self::Parse(error, _) => Some(error),
+            Self::NotPresent(_)
+            | Self::NotUnicode(_, _)
+            | Self::NotUnicodeName(_)
+            | Self::NoInput => None,
+        }
+    }
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        match self {
+            Self::Io(e, path) => {
+                if let Some(path) = path {
+                    write!(f, "error reading '{}': {e}", path.to_string_lossy())
+                } else {
+                    e.fmt(f)
+                }
+            }
+            Self::Parse(error, Some(path)) => {
+                write!(f, "error parsing '{}':\n{error}", path.to_string_lossy())
+            }
+            Self::Parse(error, None) => error.fmt(f),
+            Self::NotPresent(s) => write!(f, "{s} is not set"),
+            Self::NotUnicode(os_str, s) => {
+                write!(f, "{s} is not valid Unicode: {os_str:?}")
+            }
+            Self::NotUnicodeName(os_str) => {
+                write!(
+                    f,
+                    "environment variable name is not valid Unicode: {os_str:?}"
+                )
+            }
+            Self::NoInput => write!(f, "no input provided"),
+        }
+    }
+}
+
+impl From<(io::Error, PathBuf)> for Error {
+    fn from((e, path): (io::Error, PathBuf)) -> Self {
+        Self::Io(e, Some(path))
+    }
+}
+
+impl From<io::Error> for Error {
+    fn from(error: io::Error) -> Self {
+        Self::Io(error, None)
+    }
+}
+
+impl From<(ParseBufError, Option<PathBuf>)> for Error {
+    fn from((e, path): (ParseBufError, Option<PathBuf>)) -> Self {
+        match e {
+            ParseBufError::Parse(error) => Self::Parse(Box::new(error), path),
+            ParseBufError::Io(e) => Self::Io(e, path),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::Error;
+    use crate::{EnvLoader, EnvSequence, iter::ParseBufError};
+    use std::{
+        error::Error as StdError,
+        ffi::OsString,
+        io::{self, Cursor},
+        path::PathBuf,
+    };
+
+    fn parse_error() -> Box<crate::ParseError> {
+        let error = EnvLoader::with_reader(Cursor::new("BROKEN value"))
+            .sequence(EnvSequence::InputOnly)
+            .load()
+            .unwrap_err();
+        let Error::Parse(error, _) = error else {
+            panic!("expected a parse error");
+        };
+        error
+    }
+
+    #[test]
+    fn reports_underlying_error_sources() {
+        let io_error = Error::from(io::Error::other("reader failed"));
+        assert_eq!(io_error.source().unwrap().to_string(), "reader failed");
+
+        let parse_error = Error::Parse(parse_error(), None);
+        assert!(parse_error.source().is_some());
+
+        assert!(Error::NotPresent("MISSING".to_owned()).source().is_none());
+    }
+
+    #[test]
+    fn displays_every_context_free_error_variant() {
+        assert_eq!(
+            Error::from(io::Error::other("reader failed")).to_string(),
+            "reader failed"
+        );
+        assert!(
+            Error::Parse(parse_error(), None)
+                .to_string()
+                .starts_with("dotenv syntax error at line 1, column 8")
+        );
+        assert_eq!(
+            Error::NotPresent("MISSING".to_owned()).to_string(),
+            "MISSING is not set"
+        );
+        assert_eq!(
+            Error::NotUnicode(OsString::from("raw-value"), "VALUE".to_owned()).to_string(),
+            "VALUE is not valid Unicode: \"raw-value\""
+        );
+        assert_eq!(
+            Error::NotUnicodeName(OsString::from("raw-name")).to_string(),
+            "environment variable name is not valid Unicode: \"raw-name\""
+        );
+        assert_eq!(Error::NoInput.to_string(), "no input provided");
+        assert!(!Error::NoInput.not_found());
+    }
+
+    #[test]
+    fn converts_reader_errors_with_optional_path_context() {
+        let error = Error::from((
+            ParseBufError::Io(io::Error::other("reader failed")),
+            Some(PathBuf::from("config/.env")),
+        ));
+        assert_eq!(
+            error.to_string(),
+            "error reading 'config/.env': reader failed"
+        );
+    }
+}