build(deps): Bump dotenv from 17.4.2 to 18.0.1

[dependabot]

Bumps dotenv from 17.4.2 to 18.0.1.

Changelog

Sourced from dotenv's changelog.

18.0.1 (2026-09-18)

Changed

• Handle file urls in config logging (#1054)

18.0.0 (2026-09-17)

Added

• NEW: Dotenv now has a CLI. (#1022)

$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)

$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#1037)

Removed

• Remove tips (#1031)
• Remove skill files (#1032)
• Remove Spanish README (#1034)
• Remove .env.vault support (#1033)
• Remove preloading. Instead use cli dotenv run -- your-command (#1035)

Commits

• ce3bfb4 18.0.1
• 294230e changelog
• 4fcffd4 Merge pull request #1054 from jakezwang/fix-url-path-logging
• 8ea84d6 fix: handle file URLs in config logging
• 2815fa8 18.0.0
• 451c6cb add spacing
• 7c7ed02 update README and changelog
• 7454f56 Merge pull request #1052 from motdotla/cli-cleanup
• f5de622 .cmd coverage
• 75289b1 changelog
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​dotenv@​17.4.2 ⏵ 18.0.1				-1

View full report