chore(deps-dev): bump dotenv from 17.2.0 to 17.4.2

[dependabot]

Bumps dotenv from 17.2.0 to 17.4.2.

Changelog

Sourced from dotenv's changelog.

17.4.2 (2026-04-12)

Changed

• Improved skill files - tightened up details (#1009)

17.4.1 (2026-04-05)

Changed

• Change text injecting to injected (#1005)

17.4.0 (2026-04-01)

Added

• Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

• Tighten up logs: ◇ injecting env (14) from .env (#1003)

17.3.1 (2026-02-12)

Changed

• Fix as2 example command in README and update spanish README

17.3.0 (2026-02-12)

Added

• Add a new README section on dotenv’s approach to the agentic future.

Changed

• Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

17.2.4 (2026-02-05)

Changed

• Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)

• Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

17.2.3 (2025-09-29)

Changed

• Fixed typescript error definition (#912)

... (truncated)

Commits

• f116f70 17.4.2
• 3a81612 fix visual order of faq
• 13f55a8 Merge branch 'skill'
• 4bbbf73 reorganize faq
• c3da64b Merge pull request #1009 from motdotla/skill
• 6f743b1 update source
• fc2c624 update skill
• 972315b Tighten up skill
• 2795fce reorganize faq
• d5495d4 adjust skill
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
langfuse-js	Ready	Preview	May 4, 2026 11:58am

[claude]

LGTM — routine Dependabot dev-dependency bump with no breaking changes.

Extended reasoning...

Overview

This PR bumps dotenv from 17.2.0 to 17.4.1 in package.json and pnpm-lock.yaml. It is a dev-dependency only, used for loading environment variables in tests/local development. The changes are two lines in package.json and the corresponding lock file hash/version updates.

Security risks

None. dotenv is a dev dependency not shipped in production bundles. The intermediate releases (17.2.4, 17.3.x, 17.4.0, 17.4.1) contain only a TypeScript type fix, README rewrites, minor log text tweaks, and documentation additions — no security-relevant changes.

Level of scrutiny

Very low. This is a mechanical Dependabot version bump of a well-known, widely-used library with no breaking or behavioral changes between the current and target versions. The changes are entirely in configuration/lock files.

Other factors

No bugs were reported by the automated bug-hunting system. No prior reviewer comments are outstanding. The PR is fresh with only the Vercel bot comment. This class of change (minor/patch dev-dep bump) is safe to auto-approve.