deps(deps): bump dotenv from 16.5.0 to 18.0.4

[dependabot]

Bumps dotenv from 16.5.0 to 18.0.4.

Changelog

Sourced from dotenv's changelog.

18.0.4 (2026-09-25)

Changed

• import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

• Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

• Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

• Handle file urls in config logging (#1054)

18.0.0 (2026-09-17)

Added

• NEW: Dotenv now has a CLI. (#1022)

$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)

$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#1037)

Removed

... (truncated)

Commits

• 86804c0 18.0.4
• 2403db5 changelog
• 75b775e npm audit
• 7e1750c Merge pull request #1064 from motdotla/dependabot/npm_and_yarn/ip-address-10.7.2
• a6ade63 Merge pull request #1063 from motdotla/import
• 288b0d7 patch test
• 00da912 Bump ip-address from 10.2.0 to 10.7.2
• e6b5816 import 'dotenv/config' should still be defaulting to quiet
• 3646ac5 Merge pull request #1061 from motdotla/fast
• 83fc961 report dotenv vs native vs dotenv.fast
• Additional commits viewable in compare view

[cursor]

Approved. Cursor Bugbot was not present after the first check poll, so that signal was skipped; no approval policy required human review. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}