Update dependency dotenv to v18

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
dotenv	17.4.2 → 18.0.7

---

Release Notes

motdotla/dotenv (dotenv)

v18.0.7

Compare Source

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#​1070)
• CLI should honor DOTENV_QUIET setting in .env file (#​1071)

v18.0.6

Compare Source

Changed

• Use smarter parseBoolean not Boolean() to fix override (#​1069)

v18.0.5

Compare Source

Changed

• Fix missing typescript module declaration (#​1068)
• Improve performance for large .env files (#​1066)

v18.0.4

Compare Source

Changed

• import dotenv/config should default quiet: true (#​1063)

v18.0.3

Compare Source

Changed

• Patch DOTENV_QUIET setting when inside .env file (#​1059)

v18.0.2

Compare Source

Changed

• Patch additional edge cases for the fast parser (#​1056)

v18.0.1

Compare Source

Changed

• Handle file urls in config logging (#​1054)

v18.0.0

Compare Source

Added

• NEW: Dotenv now has a CLI. (#​1022)

$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#​1010)

$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

faster than Node native parseEnv!

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#​1037)

Removed

• Remove tips (#​1031)
• Remove skill files (#​1032)
• Remove Spanish README (#​1034)
• Remove .env.vault support (#​1033)
• Remove preloading. Instead use cli dotenv run -- your-command (#​1035)

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "after 2am and before 8am on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: eesast-web@2024.0.0
npm error Found: graphql@17.0.2
npm error node_modules/graphql
npm error   graphql@"17.0.2" from the root project
npm error
npm error Could not resolve dependency:
npm error peer graphql@"^15.0.0 || ^16.0.0" from @apollo/client@3.14.1
npm error node_modules/@apollo/client
npm error   @apollo/client@"3.14.1" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-10-09T17_08_24_144Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-09T17_08_24_144Z-debug-0.log

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request