Refresh compatible dependencies

[mohanagy]

Supersedes #342 and #346 with one maintainer-owned, independently reviewed dependency refresh so the repository's required CodeRabbit status can run.

What changed

• update dotenv from 16.6.1 to 17.4.2
• update ESLint from 10.6.0 to 10.8.0
• update typescript-eslint from 8.63.0 to 8.65.0
• refresh the lockfile without including the incompatible Vitest 4 or TypeScript 7 upgrades

Why

The original Dependabot PRs could not satisfy the required CodeRabbit status because that status was not emitted for bot-authored PRs. The other open major-upgrade PRs are intentionally excluded: Vitest 4 currently misses protected coverage thresholds, and TypeScript 7 is outside typescript-eslint's supported peer range.

Validation

• npm run lint
• npm run typecheck
• npm test — 1,828 passed, 33 skipped
• npm run build
• npm run smoke:cli — schema command passed
• npm run check:pack — 48 package paths verified
• package artifact contract included in the full suite

Security impact

• no credential, redaction, OAuth, policy, audit, or subprocess implementation changes
• dotenv remains confined to the existing configuration-loading boundary and its major update is covered by configuration, secret-provider, CLI, and package-contract tests
• the ESLint and typescript-eslint updates are development-only
• the existing npm audit result remains visible and is not claimed as resolved by this maintenance PR

[coderabbitai]

📝 Walkthrough

Walkthrough

The package manifest updates the declared ranges for dotenv, eslint, and typescript-eslint.

Changes

Dependency range updates

Layer / File(s)	Summary
Update dependency ranges package.json	The manifest updates dotenv, eslint, and typescript-eslint. tsup and typescript remain unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

I’m a rabbit with a tidy pack,
Fresh versions hop into the stack.
dotenv leaps, lint tools grow,
Type checks follow in a row.
Clean manifest, ready to go!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The description explains the dependency changes, exclusions, security impact, and validation results, but it does not use every template heading or checklist item.
Title check	✅ Passed	The title clearly and concisely identifies the main change: refreshing compatible dependencies.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/safe-dependency-refresh

---

_{Comment @coderabbitai help to get the list of available commands.}