Bumps dotenv from 17.4.2 to 18.0.3.

Changelog

Sourced from dotenv's changelog.

18.0.3 (2026-09-22)

Changed

• Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

• Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

• Handle file urls in config logging (#1054)

18.0.0 (2026-09-17)

Added

• NEW: Dotenv now has a CLI. (#1022)

$ dotenv run -- node index.js

◇ injected env (2) from .env

Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)

$ dotenv run --fast -- node index.js

◇ injected env (2) from .env

Hello Dotenv

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#1037)

Removed

• Remove tips (#1031)


• Remove skill files (#1032)


• Remove Spanish README (#1034)


• Remove .env.vault support (#1033)


• Remove preloading. Instead use cli dotenv run -- your-command (#1035)

Commits

• 
  f6390d1 18.0.3


• 
  456da68 changelog


• 
  12ea34b Merge pull request #1059 from motdotla/config-quiet


• 
  a654bc2 patch DOTENV_QUIET


• 
  a0ae3e0 Merge pull request #1058 from SulimanAbdulrazzaq/fix/fast-parser-lone-export-...


• 
  d6b3a1d demonstrate DOTENV_QUIET failing


• 
  d57e0bc fix: keep assignments after a bare export line in the fast parser


• 
  5203712 perf: skip quoted text and short-circuit ASCII whitespace checks


• 
  c69ed11 chore: align package version with 18.0.2 changelog


• 
  2db9acf fix: retain closing quote candidates in the fast scanner


• Additional commits viewable in compare view
  

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)