chore(deps-dev): bump dotenv from 17.4.2 to 18.0.0 - #303
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [dotenv](https://github.com/motdotla/dotenv) from 17.4.2 to 18.0.0. - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v17.4.2...v18.0.0) --- updated-dependencies: - dependency-name: dotenv dependency-version: 18.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
🛡️ Security Hardening Pipeline ResultsBranch: Workflow Run: 453 Scan Status
Summaries Collected: 4 Scanner Results🔬 CodeQL SAST (Javascript)Status: Completed Findings Summary
No security findings detected for Javascript. Artifacts: CodeQL Reports (Javascript) 🔗 Dependency ReviewStatus: ✅ No issues found No vulnerable or license-violating dependencies detected in this PR. 🔑 Gitleaks (Secrets)No 🔑 Gitleaks (Secrets) findings summary was produced. 📦 OSV (Dependencies)No 📦 OSV (Dependencies) findings summary was produced. Generated by Argus Generated by Argus |
Rebuilds #302, #303 and #304 against beta. All three were opened against main, whose package.json trails beta by everything in #297, so most of what they propose is already here and their lockfiles no longer apply. @release-it/conventional-changelog ^12.0.0 -> ^12.0.2 @types/node ^26.5.1 -> ^26.6.1 dotenv ^17.4.2 -> ^18.0.0 js-yaml ^5.4.1 -> ^5.4.2 mocha ^12.0.0 -> ^12.0.2 release-it ^21.0.2 -> ^21.1.0 js-yaml is the only one that reaches the packaged extension — src imports it and esbuild bundles it — and it is a patch. The rest are tooling. The root conventional-changelog-conventionalcommits pin stays at 9.3.1; the 10.x that moves in the lockfile is release-it's own nested copy, already on 10.x before this change. dotenv is declared but imported nowhere in the repo, so its major bump is inert — worth removing rather than tracking, separately. release-it 21.1.0 pulls in one new transitive package, verkit@0.4.0 (MIT). Every version here was published at least three days ago. Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
|
Rebuilt against This was opened against Dependabot reads |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps dotenv from 17.4.2 to 18.0.0.
Changelog
Sourced from dotenv's changelog.
Commits
2815fa818.0.0451c6cbadd spacing7c7ed02update README and changelog7454f56Merge pull request #1052 from motdotla/cli-cleanupf5de622.cmd coverage75289b1changelog33bd964spawn for windows2b4cc00update changelogde91a69cli cleanupfa8788eMerge pull request #1049 from webdevelopersrinu/fix-populate-nullDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)