[dependabot]

Bumps dotenv from 16.5.0 to 18.0.4.

Changelog

Sourced from dotenv's changelog.

18.0.4 (2026-09-25)

Changed

• import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

• Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

• Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

• Handle file urls in config logging (#1054)

18.0.0 (2026-09-17)

Added

• NEW: Dotenv now has a CLI. (#1022)

$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)

$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#1037)

Removed

... (truncated)

Commits

• 86804c0 18.0.4
• 2403db5 changelog
• 75b775e npm audit
• 7e1750c Merge pull request #1064 from motdotla/dependabot/npm_and_yarn/ip-address-10.7.2
• a6ade63 Merge pull request #1063 from motdotla/import
• 288b0d7 patch test
• 00da912 Bump ip-address from 10.2.0 to 10.7.2
• e6b5816 import 'dotenv/config' should still be defaulting to quiet
• 3646ac5 Merge pull request #1061 from motdotla/fast
• 83fc961 report dotenv vs native vs dotenv.fast
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[cursor]

Approved. Cursor Bugbot was not present after the first check poll, so that signal was skipped; no approval policy required human review. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[jonbeckman]

Closing: Dependabot does not update nub.lock (ERR_NUB_OUTDATED_LOCKFILE). Replaced by a combined deps PR that regenerates nub.lock.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.