Bump dotenv from 17.4.2 to 18.0.3 in /api

[dependabot]

Bumps dotenv from 17.4.2 to 18.0.3.

Changelog

Sourced from dotenv's changelog.

18.0.3 (2026-09-22)

Changed

• Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

• Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

• Handle file urls in config logging (#1054)

18.0.0 (2026-09-17)

Added

• NEW: Dotenv now has a CLI. (#1022)

$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)

$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#1037)

Removed

• Remove tips (#1031)
• Remove skill files (#1032)
• Remove Spanish README (#1034)
• Remove .env.vault support (#1033)
• Remove preloading. Instead use cli dotenv run -- your-command (#1035)

Commits

• f6390d1 18.0.3
• 456da68 changelog
• 12ea34b Merge pull request #1059 from motdotla/config-quiet
• a654bc2 patch DOTENV_QUIET
• a0ae3e0 Merge pull request #1058 from SulimanAbdulrazzaq/fix/fast-parser-lone-export-...
• d6b3a1d demonstrate DOTENV_QUIET failing
• d57e0bc fix: keep assignments after a bare export line in the fast parser
• 5203712 perf: skip quoted text and short-circuit ASCII whitespace checks
• c69ed11 chore: align package version with 18.0.2 changelog
• 2db9acf fix: retain closing quote candidates in the fast scanner
• Additional commits viewable in compare view

[sridharkalaibala]

The API checks are green, but this is a major dotenv upgrade. Before merging, please verify the v18 migration notes against the application's dotenv usage and run an API startup check with representative environment loading.

[sridharkalaibala]

Verified the v18 changes against the API usage: this code uses config() with quiet and path options, not removed preloading or .env.vault functionality. CI and CodeQL are green, and a focused dotenv v18 config API check passed. Approved.

[sridharkalaibala]

Reviewed the 18.0.3 refresh: it remains a low-risk patch update within the already validated dotenv v18 configuration path. All CI and CodeQL checks are green; approved.

[dependabot]

Superseded by #1019.