chore(deps): dotenv 16 → 17, quiet:true everywhere

[ToddHebebrand]

Summary

Bumps dotenv to 17.4.2 in ee/workspace/package.json — apps/api and e2e-tests were already on ^17.4.2 on main (pnpm -r up dotenv@latest was a no-op for them). Adds quiet: true to every dotenv config call in the repo so the v17 "injecting env" banner (on by default now) doesn't re-litter API/test/tooling logs.

Why

Clears a major-version bump dependabot could not propose, and keeps output clean under the new default (docs/superpowers/plans/2026-09-14-dependency-major-upgrades.md).

What changed

Repo-wide grep for config( calls from dotenv and for the dotenv/config side-effect import found 8 call sites across 7 files — one more file than the brief listed (ee/workspace/vitest.integration.config.ts):

• apps/api/src/db/index.ts — both config({ path: '../../.env' }) and the bare config() cwd fallback
• apps/api/src/__tests__/integration/loadEnv.ts
• apps/api/vitest.config.rls-coverage.ts
• apps/api/vitest.integration.config.ts
• ee/workspace/vitest.integration.config.ts (not in the brief's list)
• e2e-tests/live-signup/monitor.ts
• e2e-tests/perf-harness/run-perf.ts

Also converted the two import 'dotenv/config' side-effect preloads (apps/api/src/index.ts, apps/api/src/worker.ts — the two real production entrypoints) to explicit import { config } from 'dotenv'; config({ quiet: true }). The magic dotenv/config import has no way to receive inline options — it only reads DOTENV_CONFIG_QUIET from the environment/CLI args — so leaving it as-is would have kept printing the new banner on every API/worker boot. Updated a stale comment in normalizeNodeEnv.ts that referenced the old dotenv/config import spelling.

Verification

pnpm -r up dotenv@latest    # only ee/workspace/package.json changed (16.6.1 → 17.4.2)
pnpm install --frozen-lockfile --offline   # lockfile consistent

cd apps/api && npx tsx -e "import './src/db/index'" 2>&1 | grep -c '\[dotenv'
# 0  (brief's required silence check)

cd apps/api && NODE_OPTIONS=--max-old-space-size=8192 npx tsc --noEmit -p tsconfig.json   # 0 errors
cd ee/workspace && NODE_OPTIONS=--max-old-space-size=8192 npx tsc --noEmit -p tsconfig.json   # 0 errors

cd apps/api && npx vitest run src/db     # 71 files, 2396 tests passed
cd ee/workspace && npx vitest run --config vitest.config.ts   # 38 files, 670 tests passed

npx eslint src/db/index.ts src/index.ts src/worker.ts src/__tests__/integration/loadEnv.ts   # clean

Lockfile drift

Regenerated pnpm-lock.yaml via git checkout origin/main -- pnpm-lock.yaml && pnpm install --lockfile-only to strip unrelated pnpm up resolution noise. Remaining diff is exactly the dotenv specifier/version bump plus one vitest-internal snapshot key re-keying to a different (already-present) vite peer resolution instance — not a new package, no drift outside dotenv's own dependency graph.

Concerns

None. e2e-tests has no dedicated typecheck script and its ad-hoc tsc --noEmit -p tsconfig.json fails on an unrelated pre-existing @types/node resolution error — reproduced identically on origin/main with zero local changes, so it predates this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_018cms2ECUY322qubUH3PmVA

[cloudflare-workers-and-pages]

Deploying breeze with    Cloudflare Pages

Latest commit:	db90628
Status:	✅  Deploy successful!
Preview URL:	https://49e97ed0.breeze-9te.pages.dev
Branch Preview URL:	https://chore-deps-dotenv-17.breeze-9te.pages.dev

View logs