chore(deps): update dependency dotenv-expand to v11 (#15875)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: bluwy <bjornlu.dev@gmail.com>

package.json

@@ -125,7 +125,6 @@
     },
     "patchedDependencies": {
       "chokidar@3.6.0": "patches/chokidar@3.6.0.patch",
-      "dotenv-expand@10.0.0": "patches/dotenv-expand@10.0.0.patch",
       "sirv@2.0.4": "patches/sirv@2.0.4.patch"
     },
     "peerDependencyRules": {

packages/vite/package.json

@@ -117,7 +117,7 @@
     "debug": "^4.3.4",
     "dep-types": "link:./src/types",
     "dotenv": "^16.4.2",
-    "dotenv-expand": "^10.0.0",
+    "dotenv-expand": "^11.0.3",
     "es-module-lexer": "^1.4.1",
     "escape-html": "^1.0.3",
     "estree-walker": "^3.0.3",

packages/vite/src/node/env.ts

@@ -1,7 +1,7 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { parse } from 'dotenv'
-import { expand } from 'dotenv-expand'
+import { type DotenvPopulateInput, expand } from 'dotenv-expand'
 import { arraify, normalizePath, tryStatSync } from './utils'
 import type { UserConfig } from './config'
 
@@ -49,9 +49,10 @@ export function loadEnv(
     process.env.BROWSER_ARGS = parsed.BROWSER_ARGS
   }
 
-  // let environment variables use each other
-  // `expand` patched in patches/dotenv-expand@9.0.0.patch
-  expand({ parsed })
+  // let environment variables use each other. make a copy of `process.env` so that `dotenv-expand`
+  // doesn't re-assign the expanded values to the global `process.env`.
+  const processEnv = { ...process.env } as DotenvPopulateInput
+  expand({ parsed, processEnv })
 
   // only keys that start with prefix are exposed to client
   for (const [key, value] of Object.entries(parsed)) {