[dependabot]

Bumps the prod group with 2 updates in the / directory: dotenv and es-toolkit.

Updates dotenv from 18.0.9 to 18.0.10

Changelog

Sourced from dotenv's changelog.

18.0.10 (2026-11-08)

Changed

• Fix dotenv.parse in Vite by moving the CLI shebang to a separate entry point (#1082)

Commits

• 7ed8f36 18.0.10
• 2c291ba Merge pull request #1082 from motdotla/dotenv-18-fe
• 9b4bf24 Changelog
• a3734e8 separate run to its own entry
• 3d11a6e npm audit fix
• 32ab610 Merge pull request #1078 from NgoQuocViet2001/fix-cli-ignored-signal-hang
• 7c67590 fix(cli): exit when the command dies from SIGPIPE
• c40119a Merge pull request #1077 from renanmpimentel/test/home-path-array
• 0084cb3 test: cover home expansion in path arrays
• 513aafd npm audit fix
• See full diff in compare view

Updates es-toolkit from 1.53.0 to 1.53.2

Release notes

Sourced from es-toolkit's releases.

v1.53.2

Released on November 6th, 2026.

• Added support for per-function imports like es-toolkit/array/chunk. (#2173)
• Fixed reduceAsync to preserve explicitly provided null and undefined initial values. (#2176)
• Fixed circular dependency warnings in bundlers when importing orderBy or sortBy. (#2187)
• Fixed truncate in es-toolkit/compat to preserve separator boundaries, matching Lodash's behavior. (#2180)
• Fixed isError in es-toolkit/compat to return true for DOMException and error-like objects, matching Lodash's behavior. (#2188)
• Fixed incorrect example outputs in the documentation for random, keysIn, setWith, and curryRight. (#2183)
• Replaced Prettier and ESLint with oxfmt and oxlint, and forbade circular imports. (#2185, #2189, #2190)
• Enhanced the dist and browser compatibility checks to verify the packed tarball and only exported functions. (#2182, #2192)

We sincerely thank @​D-Sketon, @​frogscooper, @​MycroCosmo, @​raon0211, @​subotac, and @​ys0v9 for their contributions. We appreciate your great efforts!

v1.53.1

Released on October 31st, 2026.

This release includes security fixes for es-toolkit/compat, and we recommend upgrading. The fixes match Lodash, so results may differ if you relied on the previous behavior.

• Fixed compat/template to reject variable values and imports keys that are not plain parameter names, and to replace all whitespace in sourceURL, preventing code injection.
• Fixed compat/defaultsDeep to ignore __proto__ keys, preventing prototype pollution.
• Fixed compat/unset, compat/omit, and compat/pullAt to stop when __proto__, constructor, or prototype appears before the last path key, preventing the deletion of built-in prototype properties.

The following are other fixes in this release.

• Fixed clone to preserve the offset and length of a DataView. ([#2166])
• Fixed split to keep surrogate pairs and combining marks together for an empty separator. ([#2171])
• Fixed withTimeout to clear its timer after the operation completes. ([#2170])
• Fixed compat/pickBy to not treat objects with a numeric length as array-like. ([#2165])
• Fixed compat/findLast and compat/some to not treat length as an element of array-likes. ([#2168])

We sincerely thank @​arba-octo, @​dayongkr, @​frogscooper, and @​KooYS for their contributions. We appreciate your great efforts!

Changelog

Sourced from es-toolkit's changelog.

Version v1.53.2

Released on November 6th, 2026.

• Added support for per-function imports like es-toolkit/array/chunk. (#2173)
• Fixed reduceAsync to preserve explicitly provided null and undefined initial values. (#2176)
• Fixed circular dependency warnings in bundlers when importing orderBy or sortBy. (#2187)
• Fixed truncate in es-toolkit/compat to preserve separator boundaries, matching Lodash's behavior. (#2180)
• Fixed isError in es-toolkit/compat to return true for DOMException and error-like objects, matching Lodash's behavior. (#2188)
• Fixed incorrect example outputs in the documentation for random, keysIn, setWith, and curryRight. (#2183)
• Replaced Prettier and ESLint with oxfmt and oxlint, and forbade circular imports. (#2185, #2189, #2190)
• Enhanced the dist and browser compatibility checks to verify the packed tarball and only exported functions. (#2182, #2192)

We sincerely thank @​D-Sketon, @​frogscooper, @​MycroCosmo, @​raon0211, @​subotac, and @​ys0v9 for their contributions. We appreciate your great efforts!

Version v1.53.1

Released on October 31st, 2026.

This release includes security fixes for es-toolkit/compat, and we recommend upgrading. The fixes match Lodash, so results may differ if you relied on the previous behavior.

• Fixed compat/template to reject variable values and imports keys that are not plain parameter names, and to replace all whitespace in sourceURL, preventing code injection.
• Fixed compat/defaultsDeep to ignore __proto__ keys, preventing prototype pollution.
• Fixed compat/unset, compat/omit, and compat/pullAt to stop when __proto__, constructor, or prototype appears before the last path key, preventing the deletion of built-in prototype properties.

The following are other fixes in this release.

• Fixed clone to preserve the offset and length of a DataView. (#2166)
• Fixed split to keep surrogate pairs and combining marks together for an empty separator. (#2171)
• Fixed withTimeout to clear its timer after the operation completes. (#2170)
• Fixed compat/pickBy to not treat objects with a numeric length as array-like. (#2165)
• Fixed compat/findLast and compat/some to not treat length as an element of array-likes. (#2168)

We sincerely thank @​arba-octo, @​dayongkr, @​frogscooper, and @​KooYS for their contributions. We appreciate your great efforts!

Commits

• 1913a76 v1.53.2
• be3ad03 test(browser-compat): harvest examples only from exported declarations (#2192)
• 91156c4 fix[isError]: match lodash for DOMException and error-like objects (#2188)
• 728a626 fix[serialize]: remove circular module dependencies (#2187)
• 93d507b test: update bundle size snapshots (#2191)
• c986957 chore: forbid circular imports with import/no-cycle (#2190)
• 261f013 chore: replace ESLint with oxlint (#2189)
• 61e8bb7 docs(compat): fix incorrect example outputs in random, keysIn, setWith, and c...
• 4fb8c4e test[check-dist]: fix entrypoint list and verify the packed tarball end-to-en...
• c04a0fb chore: replace Prettier with oxfmt (#2185)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions