Update dependency dotenv to v18

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
dotenv	^17.0.0 → ^18.0.0

---

Release Notes

motdotla/dotenv (dotenv)

v18.0.0

Compare Source

Added

• NEW: Dotenv now has a CLI. (#​1022)

$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#​1010)

$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#​1037)

Removed

• Remove tips (#​1031)
• Remove skill files (#​1032)
• Remove Spanish README (#​1034)
• Remove .env.vault support (#​1033)
• Remove preloading. Instead use cli dotenv run -- your-command (#​1035)

v17.4.2

Compare Source

Changed

• Improved skill files - tightened up details (#​1009)

v17.4.1

Compare Source

Changed

• Change text injecting to injected (#​1005)

v17.4.0

Compare Source

Added

• Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

• Tighten up logs: ◇ injecting env (14) from .env (#​1003)

v17.3.1

Compare Source

Changed

• Fix as2 example command in README and update spanish README

v17.3.0

Compare Source

Added

• Add a new README section on dotenv’s approach to the agentic future.

Changed

• Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

v17.2.4

Compare Source

Changed

• Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#​915)

• Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

---

Configuration

📅 Schedule: (in timezone Asia/Jerusalem)

• Branch creation
  • "after 10pm every weekday,every weekend,before 5am every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Summary by cubic

Update dotenv from v17 to v18, a major version with breaking changes. Drops .env.vault support and preloading; use the new CLI (dotenv run -- your-command) instead of preloading, and the injected-env message now goes to stderr. Projects relying on preloading or .env.vault will need a migration.

^{Written for commit 8d9dcb1. Summary will update on new commits.}

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @testing-library/react@13.4.0
npm error Found: react@19.2.4
npm error node_modules/react
npm error   react@"^19.2.4" from the root project
npm error   peer react@">=16" from @descope/react-sdk@2.26.2
npm error   node_modules/@descope/react-sdk
npm error     @descope/react-sdk@"^2.26.2" from the root project
npm error   3 more (@reduxjs/toolkit, react-dom, react-scripts)
npm error
npm error Could not resolve dependency:
npm error peer react@"^18.0.0" from @testing-library/react@13.4.0
npm error node_modules/@testing-library/react
npm error   @testing-library/react@"^13.0.0" from the root project
npm error
npm error Conflicting peer dependency: react@18.3.1
npm error node_modules/react
npm error   peer react@"^18.0.0" from @testing-library/react@13.4.0
npm error   node_modules/@testing-library/react
npm error     @testing-library/react@"^13.0.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-09-20T23_33_58_459Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-20T23_33_58_459Z-debug-0.log