[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
dotenv	18.0.7 → 18.0.8

---

Release Notes

motdotla/dotenv (dotenv)

v18.0.8

Compare Source

Changed

• Fast parser should strip appended extra quotes (#​1073)
• Type detail improvement (#​1074)

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Fallow audit report

Quality gate failed

Found 2 findings.

Dependencies (2)

Severity	Rule	Location	Description
major	fallow/unused-dependency	apps/web/package.json:53	Package 'graphql' is in dependencies but never imported
minor	fallow/unused-dev-dependency	apps/web/package.json:84	Package 'vite' is in devDependencies but never imported

Generated by fallow.

Gate outcomes: passed audit-verdict.

[pullfrog]

✅ No new issues found.

Reviewed changes — reviewed the full 18.0.7 → 18.0.8 dependency bump (1 commit, dbbf728).

• apps/web/package.json — exact-pin dotenv moved from 18.0.7 to 18.0.8, matching the repo's exact-version dependency convention.
• pnpm-lock.yaml — importer specifier/version, packages resolution + integrity hash, and the snapshots entry all updated in lockstep; engines: {node: '>=12'} and hasBin: true preserved, no transitive drift.
• Release-note impact on this repo's usage — dotenv is consumed only through dotenv.parse() in apps/web/scripts/loadScriptEnv.ts:11, apps/web/scripts/run-next-build.mjs:14, and apps/web/scripts/resolve-postgres-url.ts:14. Both upstream changes in 18.0.8 are inert here: the parser fix (motdotla/dotenv#1073) only touches the opt-in fast parser (fast: true / --fast / DOTENV_FAST=true), which this repo never enables, and the type change (#1074) widens DotenvPopulateOutput to string | undefined, which only affects populate() — also never called.
• Worth noting — loadScriptEnv.ts:43 sanitizePulledEnvFile hand-rolls the KEY="" strip for Vercel pulls; that behaviour is independent of this bump (the classic parser already returned '' for ""), so no interaction.

  ^{｜ View workflow run ｜ Using space-bunny-free (free) ｜ 𝕏}

[pullfrog]

✅ Approved — auto-merge enabled; GitHub will merge once required checks pass.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using space-bunny-free (free) ｜ 𝕏}