build(deps): bump dotenv from 16.6.1 to 18.0.3 in /backend

[dependabot]

Bumps dotenv from 16.6.1 to 18.0.3.

Changelog

Sourced from dotenv's changelog.

18.0.3 (2026-09-22)

Changed

• Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

• Patch additional edge cases for the fast parser (#1056)

18.0.1 (2026-09-18)

Changed

• Handle file urls in config logging (#1054)

18.0.0 (2026-09-17)

Added

• NEW: Dotenv now has a CLI. (#1022)

$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv

• NEW: Dotenv now has a fast parser thanks to @​homanp of superagent.sh. Pass config({ fast: true }), flag --fast, or set DOTENV_FAST=true to opt-in to ~2x faster character-scanner parser. (#1010)

$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv

Changed

• Injecting message sent to stderr rather than stdout and tips removed (#1037)

Removed

• Remove tips (#1031)
• Remove skill files (#1032)
• Remove Spanish README (#1034)
• Remove .env.vault support (#1033)
• Remove preloading. Instead use cli dotenv run -- your-command (#1035)

... (truncated)

Commits

• f6390d1 18.0.3
• 456da68 changelog
• 12ea34b Merge pull request #1059 from motdotla/config-quiet
• a654bc2 patch DOTENV_QUIET
• a0ae3e0 Merge pull request #1058 from SulimanAbdulrazzaq/fix/fast-parser-lone-export-...
• d6b3a1d demonstrate DOTENV_QUIET failing
• d57e0bc fix: keep assignments after a bare export line in the fast parser
• 5203712 perf: skip quoted text and short-circuit ASCII whitespace checks
• c69ed11 chore: align package version with 18.0.2 changelog
• 2db9acf fix: retain closing quote candidates in the fast scanner
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sai4u-dev]

Superseded by chore/consolidated-dependabot-updates (pushed): this bump is landed there along with the Express 5 / fiber-peer / lockfile compat fixes, verified green (backend lint+tests+E2E, frontend lint+build, audit, docker images). Closing to clear the backlog — please review/merge chore/consolidated-dependabot-updates.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.