chore(deps): update dependency dotenv to v18

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
dotenv	17.2.4 → 18.0.7

---

Release Notes

motdotla/dotenv (dotenv)

v18.0.7

Compare Source

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#​1070)
• CLI should honor DOTENV_QUIET setting in .env file (#​1071)

v18.0.6

Compare Source

Changed

• Use smarter parseBoolean not Boolean() to fix override (#​1069)

v18.0.5

Compare Source

Changed

• Fix missing typescript module declaration (#​1068)
• Improve performance for large .env files (#​1066)

v18.0.4

Compare Source

Changed

• import dotenv/config should default quiet: true (#​1063)

v18.0.3

Compare Source

Changed

• Patch DOTENV_QUIET setting when inside .env file (#​1059)

v18.0.2

Compare Source

Changed

• Patch additional edge cases for the fast parser (#​1056)

v18.0.1

Compare Source

Changed

• Handle file urls in config logging (#​1054)

v18.0.0

Compare Source

Added

• NEW: Dotenv now has a CLI. (#​1022)

$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#​1010)

$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

faster than Node native parseEnv!

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#​1037)

Removed

• Remove tips (#​1031)
• Remove skill files (#​1032)
• Remove Spanish README (#​1034)
• Remove .env.vault support (#​1033)
• Remove preloading. Instead use cli dotenv run -- your-command (#​1035)

v17.4.2

Compare Source

Changed

• Improved skill files - tightened up details (#​1009)

v17.4.1

Compare Source

Changed

• Change text injecting to injected (#​1005)

v17.4.0

Compare Source

Added

• Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

• Tighten up logs: ◇ injecting env (14) from .env (#​1003)

v17.3.1

Compare Source

Changed

• Fix as2 example command in README and update spanish README

v17.3.0

Compare Source

Added

• Add a new README section on dotenv’s approach to the agentic future.

Changed

• Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

---

Configuration

📅 Schedule: (in timezone Europe/Oslo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	dotenv@​17.2.4 ⏵ 18.0.7

View full report