From 951c01c5bc1a56743bf584be6d5714c374186b2d Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Fri, 2 Oct 2026 21:33:35 +0200
Subject: [PATCH] Task/upgrade dotenv to version 18 (#8008)

* Update dotenv to version 18.0.3

* Update changelog
---
 CHANGELOG.md      |  6 ++++++
 package-lock.json | 36 ++++++++++++++++++++++++++++++++----
 package.json      |  2 +-
 3 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2e0ad31db0..987e11433a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+
+### Changed
+
+- Upgraded `dotenv` from version `17.4.2` to `18.0.3`
+
 ## 3.77.0 - 2026-10-02
 
 ### Added
diff --git a/package-lock.json b/package-lock.json
index 877a61cb0d..b01c143378 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -71,7 +71,7 @@
         "countries-list": "3.4.1",
         "countup.js": "2.10.1",
         "date-fns": "4.4.0",
-        "dotenv": "17.4.2",
+        "dotenv": "18.0.3",
         "dotenv-expand": "13.0.0",
         "envalid": "8.2.0",
         "express": "5.2.1",
@@ -18022,6 +18022,19 @@
       "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/c12/node_modules/dotenv": {
+      "version": "17.4.2",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
+      "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==",
+      "devOptional": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
     "node_modules/c12/node_modules/jiti": {
       "version": "2.6.1",
       "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
@@ -20710,10 +20723,13 @@
       }
     },
     "node_modules/dotenv": {
-      "version": "17.4.2",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
-      "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==",
+      "version": "18.0.3",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-18.0.3.tgz",
+      "integrity": "sha512-/8CJTyL817qPnfbQrJgOEcrU3fDrJkRIoXBE566wHuvIXKOCHUZhPqGPbCPi9SogjdGnreF0TlvnTgK6J/8zpA==",
       "license": "BSD-2-Clause",
+      "bin": {
+        "dotenv": "dist/index.cjs"
+      },
       "engines": {
         "node": ">=12"
       },
@@ -20736,6 +20752,18 @@
         "url": "https://dotenvx.com"
       }
     },
+    "node_modules/dotenv-expand/node_modules/dotenv": {
+      "version": "17.4.2",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
+      "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
diff --git a/package.json b/package.json
index 264cf0a21b..f40bfb50cf 100644
--- a/package.json
+++ b/package.json
@@ -115,7 +115,7 @@
     "countries-list": "3.4.1",
     "countup.js": "2.10.1",
     "date-fns": "4.4.0",
-    "dotenv": "17.4.2",
+    "dotenv": "18.0.3",
     "dotenv-expand": "13.0.0",
     "envalid": "8.2.0",
     "express": "5.2.1",