Bump dotenv from 16.5.0 to 17.4.0

[dependabot]

Bumps dotenv from 16.5.0 to 17.4.0.

Changelog

Sourced from dotenv's changelog.

17.4.0 (2026-04-01)

Added

• Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

• Tighten up logs: ◇ injecting env (14) from .env (#1003)

17.3.1 (2026-02-12)

Changed

• Fix as2 example command in README and update spanish README

17.3.0 (2026-02-12)

Added

• Add a new README section on dotenv’s approach to the agentic future.

Changed

• Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

17.2.4 (2026-02-05)

Changed

• Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)

• Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

17.2.3 (2025-09-29)

Changed

• Fixed typescript error definition (#912)

17.2.2 (2025-09-02)

Added

• 🙏 A big thank you to new sponsor Tuple.app - the premier screen sharing app for developers on macOS and Windows. Go check them out. It's wonderful and generous of them to give back to open source by sponsoring dotenv. Give them some love back.

17.2.1 (2025-07-24)

Changed

• Fix clickable tip links by removing parentheses (#897)

... (truncated)

Commits

• a2e31d6 17.4.0
• 4f041ee changelog 🪵
• bab8b98 README
• 516d47e update
• ce9b98f adjust quickstart
• d3a9065 update links
• 9a3f955 add banner
• d35b6a9 clean up
• a115e3a remove version
• 185e641 hide as2 for now - very early beta
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Greptile Summary

This PR bumps dotenv from 16.5.0 to 17.4.0 (a major-version increment), updating package.json, package-lock.json, and pnpm-lock.yaml accordingly.

Key observations:

• The changelog for v16.5.0 → v17.4.0 shows only documentation rewrites, README updates, a TypeScript type fix (DotenvPopulateInput accepting NodeJS.ProcessEnv), and cosmetic log-message tightening — no breaking API changes were identified.
• After the bump, typeorm resolves its own copy of dotenv@16.6.1 as a nested dependency (visible in package-lock.json), leaving two versions in the tree. This is normal npm/pnpm deduplication behavior and does not affect the application.
• The pnpm-lock.yaml surfaces a pre-existing deprecation warning on glob@10.4.5, which is unrelated to this PR and was already present in the dependency tree.

Confidence Score: 4/5

Safe to merge — a major-version bump with no breaking API changes and standard lock file updates.

This is a routine automated dependency bump. The v16 → v17 major version increment sounds alarming, but the full changelog between 16.5.0 and 17.4.0 contains only documentation rewrites, a minor TypeScript type improvement, and cosmetic log changes — no breaking changes to the public API. The application's usage pattern of dotenv (calling config() at startup) is unaffected. One point deducted because major bumps carry inherent unknown risk and there are no explicit regression tests for env loading in this PR.

No files require special attention; all changes are auto-generated lock file and manifest updates.

Important Files Changed

Filename	Overview
package.json	Bumps dotenv from 16.5.0 to 17.4.0 (major version bump); changelog shows mostly documentation/README changes and minor TypeScript type fixes with no breaking API changes.
package-lock.json	Lock file updated to dotenv@17.4.0; typeorm now resolves its own dotenv peer to 16.6.1, resulting in two dotenv versions in the tree — expected npm deduplication behavior.
pnpm-lock.yaml	pnpm lockfile updated to dotenv@17.4.0; also exposes a deprecation notice on glob@10.4.5 that was already present in the tree (unrelated to this bump).

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Application] -->|requires| B[dotenv v17.4.0]
    C[typeorm] -->|nested peer| D[dotenv v16.6.1]
    B --> E[Parse .env and inject into process.env]
    D --> E

Loading

_{Reviews (1): Last reviewed commit: "Bump dotenv from 16.5.0 to 17.4.0" | Re-trigger Greptile}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes. Give us feedback}

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.