deps: Update dependency dotenv to v18

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
dotenv	^17.4.2 → ^18.0.1

---

Release Notes

motdotla/dotenv (dotenv)

v18.0.1

Compare Source

Changed

• Handle file urls in config logging (#​1054)

v18.0.0

Compare Source

Added

• NEW: Dotenv now has a CLI. (#​1022)

$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#​1010)

$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#​1037)

Removed

• Remove tips (#​1031)
• Remove skill files (#​1032)
• Remove Spanish README (#​1034)
• Remove .env.vault support (#​1033)
• Remove preloading. Instead use cli dotenv run -- your-command (#​1035)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 12pm on Friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 4a98d0eb-aa00-4ac5-92b7-c266b0dd9c83

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Error: ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION

  × installing dependencies
  ╰─▶ 8 lockfile entries failed verification:
        @turbo/darwin-64@2.11.1 was published at 2026-09-18T17:28:00.000Z,
      within the minimumReleaseAge cutoff (2026-09-18T01:39:28.441Z)
        @turbo/darwin-arm64@2.11.1 was published at 2026-09-18T17:28:08.000Z,
      within the minimumReleaseAge cutoff (2026-09-18T01:39:28.441Z)
        @turbo/linux-64@2.11.1 was published at 2026-09-18T17:28:15.000Z,
      within the minimumReleaseAge cutoff (2026-09-18T01:39:28.441Z)
        @turbo/linux-arm64@2.11.1 was published at 2026-09-18T17:28:22.000Z,
      within the minimumReleaseAge cutoff (2026-09-18T01:39:28.441Z)
        @turbo/windows-64@2.11.1 was published at 2026-09-18T17:28:31.000Z,
      within the minimumReleaseAge cutoff (2026-09-18T01:39:28.441Z)
        @turbo/windows-arm64@2.11.1 was published at 2026-09-18T17:28:38.000Z,
      within the minimumReleaseAge cutoff (2026-09-18T01:39:28.441Z)
        eslint@10.11.0 was published at 2026-09-18T20:15:36.485Z, within the
      minimumReleaseAge cutoff (2026-09-18T01:39:28.441Z)
        turbo@2.11.1 was published at 2026-09-18T17:29:25.000Z, within the
      minimumReleaseAge cutoff (2026-09-18T01:39:28.441Z)
  help: The lockfile contains entries that the active policies reject. This
        can mean the lockfile is stale, or that someone committed a lockfile
        that bypassed the policy locally — inspect recent changes to pnpm-
        lock.yaml before trusting it. If the changes look expected, run "pnpm
        clean --lockfile" and then "pnpm install" to rebuild from a fresh
        resolution. Alternatively, relax the policy that flagged them.