Advanced Node and Express - Set up Passport - Missing dotenv install instructions

Describe your problem and how to reproduce it: I am running Node.js on my own server.

Working through the Advanced Node and Express - Set up Passport challenge. The instructions tell you to “Be sure to add ‘SESSION_SECRET’ to your .env file and give it a random value”, which I did.

I was getting an error “express-session deprecated req.secret; provide secret option”, which debugged to the SESSION_SECRET variable being blank or undefined.

Further searches revealed that in order for .env to work, the dotenv library needs to be installed and configured. My understanding is that the old glitch environment would automatically import .env files, possibly Repl.it as well?

I found that in a later challenge there is this verbiage: https://www.freecodecamp.org/learn/quality-assurance/advanced-node-and-express/implementation-of-social-authentication-ii

Do not forget to require and configure dotenv to use your environment variables.

This challenge also needs to be updated to include the same verbiage.

Add a Link to the page with the problem: https://www.freecodecamp.org/learn/quality-assurance/advanced-node-and-express/set-up-passport

Tell us about your browser and operating system:

• Browser Name: node.js
• Browser Version: v12.18,3
• Operating System: Ubuntu 18.04.5 LTS

If possible, add a screenshot here (you can drag and drop, png, jpg, gif, etc. in this box):

[RandellDawson]

@SaintPeter The repo has been updated now that the PR referenced by @Sky020 has been merged. It slipped through the cracks when production was deployed earlier today. Sorry for any confusion this may have caused. Let us know if everything seems to be present now, so we can close this issue. We will wait for your feedback.

Thank you.

[ShaunSHamilton]

but that the corresponding changes had not yet been made to the boilerplate code?

Yes. Well, the changes are made, but have not been merged. This is done, because once a PR is merged here (on the main repo), it is usually only pushed to production in a few days, but, with the boilerplate repos, a merge targets the branch used by campers. So, it is immidiate.

The means we wait for a main repo change to reach production, before merging the boilerplate, to, ironically, avoid this situation - confusion of mismatched boilerplate/lesson.