[helmipradita]

Fixes #67102

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• tests and/or benchmarks are included
• commit message follows commit guidelines

Description of change

Files beginning with a UTF-8 Byte Order Mark (\xEF\xBB\xBF) are common on Windows (such as those generated by PowerShell 5.1 Set-Content -Encoding utf8 or Notepad's "UTF-8 with BOM").

Previously, Dotenv::ParseContent in src/node_dotenv.cc removed \r characters but did not strip a leading UTF-8 BOM, resulting in the BOM remaining attached to the first key (e.g. \uFEFFA instead of A). Consequently, the first environment variable was inaccessible via its expected name under process.env.

This PR strips a leading UTF-8 BOM (\xEF\xBB\xBF) from content if present at index 0 and adds a test asserting that util.parseEnv correctly strips the leading BOM.

[nodejs-github-bot]

Review requested:

• @nodejs/config

[github-actions]

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

• the guide for first-time contributors
• the contribution and automation policies
• the pull request guide
• the AI use policy
• the Code of Conduct

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

Caution

AgentScan found account activity patterns that may be consistent with automation. This is a heuristic, not proof that this pull request was opened by an agent or violates policy. AI-assisted contributions are permitted, but automated tooling must not open pull requests without advance approval, and contributors must personally understand, test, verify, and take responsibility for every submitted change. See the AgentScan analysis, AI use policy, and automation policy for additional context.

[helmipradita]

Regarding the AgentScan flag: this PR is personally authored and manually prepared following issue #67102.

The commit message and metadata have also been updated to strictly comply with Node.js guidelines (valid subsystem, line length <= 72, and Signed-off-by trailer).

[MikeMcC399]

The recommendations in:

• Guides and FAQs for first-time contributors

advise you should tackle only one issue at a time and that you should not open any new PRs until your first PR has been approved.

You already have an unapproved PR #67111 open at this time.

Until the first PR has been approved and has landed in the main branch, GitHub classifies you as "first-time contributor". Each PR commit you push needs to be individually approved by team members to run in GitHub Actions CI. This causes delays for you as a contributor, and it adds to the work load for the team.

Waiting until the first PR has landed ensures that you as a contributor have experienced the complete process from PR submission to successful landing. After this has been completed, any new PRs or new commits to an existing PR are treated to rules for regular Contributors. GitHub Actions CI workflows are then run automatically without intervention by a team member.