Skip to content

chore(deps): bump dotenv from 17.4.2 to 18.0.5 in /frontend - #101

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/dotenv-18.0.4
Closed

chore(deps): bump dotenv from 17.4.2 to 18.0.5 in /frontend#101
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/dotenv-18.0.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps dotenv from 17.4.2 to 18.0.5.

Changelog

Sourced from dotenv's changelog.

18.0.5 (2026-09-30)

Changed

  • Fix missing typescript module declaration (#1068)
  • Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

  • import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

  • Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

  • Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

  • Handle file urls in config logging (#1054)

18.0.0 (2026-09-17)

Added

  • NEW: Dotenv now has a CLI. (#1022)
$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv
  • NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)
$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv
</tr></table>

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 4, 2026
@0xMMA

0xMMA commented Oct 10, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot dependabot Bot changed the title chore(deps): bump dotenv from 17.4.2 to 18.0.4 in /frontend chore(deps): bump dotenv from 17.4.2 to 18.0.5 in /frontend Oct 10, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/dotenv-18.0.4 branch from 6dd4c26 to 0aa6640 Compare October 10, 2026 11:13
@0xMMA 0xMMA mentioned this pull request Oct 10, 2026
Merged
@dependabot
chore(deps): bump dotenv from 17.4.2 to 18.0.5 in /frontend
0aaa789 
Bumps [dotenv](https://github.com/motdotla/dotenv) from 17.4.2 to 18.0.5.
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v17.4.2...v18.0.5)

---
updated-dependencies:
- dependency-name: dotenv
  dependency-version: 18.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/dotenv-18.0.4 branch from 0aa6640 to 0aaa789 Compare October 10, 2026 13:33
0xMMA added a commit that referenced this pull request Oct 10, 2026
@0xMMA
chore(deps): October bumps — Angular 21.2.25, SDKs, dotenv 18 (#117)
c7684bf 
* chore(deps): October bumps — Angular 21.2.25, SDKs, dotenv 18

Folds Dependabot #100, #101 and #102 into one change. Angular moves to
21.2.25 as a whole (21.2.24 left animations behind and npm refused the
mixed peer set). Versions younger than the 7-day cooldown were held at
the last older release, transitive ones included.

openai-go stays at 3.68.0: 3.69.0 refuses plain HTTP for requests that
carry a key, which breaks the Ollama provider (#116). Dependabot ignores
>= 3.69.0 until that is fixed.

* chore(deps): regenerate lockfile, keep security updates for openai-go

Address review of #117: the hand-held lockfile was internally invalid
(express 5.2.1 with a nested content-type 2.x). Regenerated from main's
lockfile with a release-date cutoff instead, so every pinned version is
consistent; npm ls --all --package-lock-only is clean. source-map-js
moves to 1.2.2 (GHSA-68fv-2mgg-jv7q).

The openai-go ignore drops its version range: an explicit range would
also block security updates, a bare name does not.

---------

Co-authored-by: Michael <0xMMA@users.noreply.github.com>
@0xMMA

0xMMA commented Oct 10, 2026

Copy link
Copy Markdown
Owner

Superseded by #117 (merged): the bumps landed there together, with Angular moved as a whole set and openai-go held at 3.68.0 (#116).

@0xMMA 0xMMA closed this Oct 10, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 10, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/frontend/dotenv-18.0.4 branch October 10, 2026 13:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@0xMMA