Repository navigation
Bump dotenv from 17.4.2 to 18.0.8 - #121
Merged
Merged
Conversation
dependabot
Bot
added
dependencies
Contributor
🟡 Waiting for changesOutcome: reviewed Last updated: 2026-10-26 00:30 UTC |
rtibblesbot
reviewed
Oct 25, 2026
rtibblesbot
left a comment
rtibblesbot
left a comment
Contributor
There was a problem hiding this comment.
PR #121 is safe to merge. No source file imports or preloads dotenv, so 18.0.0's removals do not apply.
- Package:
dotenv17.4.2 → 18.0.8 - Semver risk: major
- Dependency type: production; declared in
package.jsonbut unused - Breaking changes (18.0.0): none used here
- Preloading removed.
.env.vaultsupport removed.- Injection message moves to stderr.
- Defaults (18.0.4): none used here
dotenv/configis quiet by default.- The fast parser is opt-in.
- Security fixes: none
- Peer dependencies: no changes; the lockfile changes only the
dotenventry. - CI: passing
Written by rtibblesbot, an LLM-based coding agent.
Bumps [dotenv](https://github.com/motdotla/dotenv) from 17.4.2 to 18.0.8. - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v17.4.2...v18.0.8) --- updated-dependencies: - dependency-name: dotenv dependency-version: 18.0.8 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/dotenv-18.0.8
branch
from
October 26, 2026 00:22
66d9db8 to
32347c6
Compare
rtibblesbot
approved these changes
Oct 26, 2026
rtibblesbot
left a comment
rtibblesbot
left a comment
Contributor
There was a problem hiding this comment.
PR #121 is safe to merge: nothing in this repo imports dotenv.
dotenv17.4.2 → 18.0.8: major bump, production dependency.- 18.0.0's breaking changes (preload,
.env.vault, stderr injection message) can't reach code that never loads it. - No security fixes or peer-dependency changes.
- Lockfile changes only the
dotenventry. - CI passing.
Prior-finding status
No prior findings.
Written by rtibblesbot, an LLM-based coding agent.
leq-bot
approved these changes
Oct 26, 2026
Contributor
|
Quick check on rtibblesbot's review of this PR: react 👍 helpful · 😕 mixed · 👎 not helpful. Reply with anything specific. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps dotenv from 17.4.2 to 18.0.8.
Changelog
Sourced from dotenv's changelog.
... (truncated)
Commits
e2fe95e18.0.87aa712atype detail improvement53405b0Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...0b4843achangelog55855abMerge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parityf757811fix(types): allow undefined values in populate outputfde5db2Keep fast-parser unquoting consistent at Unicode line boundaries295320718.0.79944723make more readable for undefined -> nulld455db0Merge branch 'master' of github.com:motdotla/dotenv