fix: drop dotenv dependency, use Node 24 built-in --env-file

[marcoscaceres]

Summary

• Removed dotenv dependency (Node 24 has built-in --env-file support)
• Removed import "dotenv/config" from app.ts, scripts/update-data-sources.ts, and scripts/update-w3c-groups-list.ts
• Added --env-file=.env to start and update-data-sources npm scripts

Closes #396

[Copilot]

Pull request overview

This PR removes the dotenv dependency and switches local runtime configuration to Node.js’ built-in .env loading via node --env-file, aligning environment variable handling with the repo’s Node >=24 baseline.

Changes:

• Removed import "dotenv/config" from the app entrypoint and data update scripts.
• Dropped dotenv from dependencies and updated start / update-data-sources scripts to pass --env-file=.env.
• Updated pnpm-lock.yaml to reflect dependency changes (but currently appears inconsistent with package.json).

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
app.ts	Removes dotenv/config bootstrap from the server entrypoint.
scripts/update-data-sources.ts	Removes dotenv/config bootstrap from the data refresh script.
scripts/update-w3c-groups-list.ts	Removes dotenv/config bootstrap from the W3C group list updater.
package.json	Removes dotenv dependency and adds --env-file=.env to scripts.
pnpm-lock.yaml	Updates lockfile after dependency changes (currently missing expected entries).

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

Comments suppressed due to low confidence (1)

pnpm-lock.yaml:26

• The lockfile's root importer dependencies are missing express-rate-limit, but package.json still lists it and the code imports it (e.g., routes/respec/index.ts). This mismatch will break installs and CI when using a frozen lockfile; please regenerate pnpm-lock.yaml so it includes all declared dependencies (or remove the dependency from package.json if that was intended).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

Comments suppressed due to low confidence (1)

pnpm-lock.yaml:32

• The lockfile includes an express-rate-limit patch upgrade (8.4.0 → 8.4.1) in addition to removing dotenv. If this is unintentional churn, consider regenerating the lockfile in a way that only removes dotenv, or explicitly calling out the extra upgrade in the PR description so it’s reviewed on purpose.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[marcoscaceres]

@copilot Can you review this and fix any issues that come up?

[Copilot]

@copilot Can you review this and fix any issues that come up?

Fixed in 2e1c8c7:

• Changed --env-file=.env → --env-file-if-exists=.env in start and update-data-sources scripts so a missing .env (e.g. fresh checkout or CI) is non-fatal while still loading it when present.
• Updated start:server to pass --node-args="--env-file-if-exists=.env" so PM2-launched processes also pick up .env when available.

The pnpm-lock.yaml issues flagged in earlier rounds (missing express-rate-limit, missing overrides block) were already resolved in the previous commit.

[marcoscaceres]

@copilot Can you confirm that all your comments have been addressed? Please resolve them if you’re happy

[Copilot]

@copilot Can you confirm that all your comments have been addressed? Please resolve them if you’re happy

All review comments have been addressed across the three commits:

• pnpm-lock.yaml (b9cf218): overrides block restored, express-rate-limit re-added to importer, dotenv removed
• package.json / app.ts / scripts (b9cf218, 2e1c8c7): dotenv/config imports removed; all npm scripts use --env-file-if-exists=.env (non-fatal); start:server passes --node-args="--env-file-if-exists=.env" to PM2
• scripts/update-w3c-groups-list.ts (fd4efe7): header comment updated to document the required invocation for standalone execution

I don't have the ability to resolve review threads directly on GitHub — you'll need to click "Resolve conversation" on each thread. Everything looks good to merge from my side.

[marcoscaceres]

@copilot can you rebase?

[Copilot]

@copilot can you rebase?

The only change that had landed on main since this branch was created was the express-rate-limit 8.4.0 → 8.4.1 bump. That's now synced in c179d37 — the branch is fully up to date with main.

[sidvishnoi]

Maybe add the --node-args to ecosystem.config.cjs only?

[marcoscaceres]

@copilot can you do as @sidvishnoi suggests?

[Copilot]

Done in 6a46bbf. Moved node_args: "--env-file-if-exists=.env --enable-source-maps" into a new ecosystem.config.cjs (with env_production config), removed --node-args from the start:server script, and removed ecosystem.config.cjs from .gitignore so the config is versioned.