[dependabot]

Bumps dotenv from 17.2.2 to 18.0.8.

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

• Fast parser should strip appended extra quotes (#1073)
• Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#1070)
• CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

• Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

• Fix missing typescript module declaration (#1068)
• Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

• import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

• Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

• Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

• Handle file urls in config logging (#1054)

... (truncated)

Commits

• e2fe95e 18.0.8
• 7aa712a type detail improvement
• 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
• 0b4843a changelog
• 55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity
• f757811 fix(types): allow undefined values in populate output
• fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries
• 2953207 18.0.7
• 9944723 make more readable for undefined -> null
• d455db0 Merge branch 'master' of github.com:motdotla/dotenv
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: experimental. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[netlify]

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name	Link
🔨 Latest commit	baa890d
🔍 Latest deploy log	https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/6ae0405991d7d80c59ef0c79

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/dotenv	18.0.8	🟢 4.7	Details Check Score Reason Code-Review 🟢 3 Found 8/21 approved changesets -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 9 security policy file detected Maintained 🟢 10 30 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/is-stream	2.0.1	🟢 3.6	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Maintained ⚠️ 0 1 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Security-Policy 🟢 9 security policy file detected Code-Review ⚠️ 2 Found 8/30 approved changesets -- score normalized to 2 Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• experimental/license-inventory/package-lock.json

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.