diff --git a/packages/config/package.json b/packages/config/package.json
index 1cbb69139d..1f5fc72a0b 100644
--- a/packages/config/package.json
+++ b/packages/config/package.json
@@ -14,7 +14,7 @@
     "consola": "^2.15.3",
     "defu": "^4.0.1",
     "destr": "^1.1.0",
-    "dotenv": "^8.6.0",
+    "dotenv": "^9.0.0",
     "lodash": "^4.17.21",
     "rc9": "^1.2.0",
     "std-env": "^2.3.0",
diff --git a/yarn.lock b/yarn.lock
index 2d597614fc..0d6febed2e 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -5340,11 +5340,16 @@ dot-prop@^6.0.1:
   dependencies:
     is-obj "^2.0.0"
 
-dotenv@^8.2.0, dotenv@^8.6.0:
+dotenv@^8.2.0:
   version "8.6.0"
   resolved "https://registry.npmjs.org/dotenv/-/dotenv-8.6.0.tgz#061af664d19f7f4d8fc6e4ff9b584ce237adcb8b"
   integrity sha512-IrPdXQsk2BbzvCBGBOTmmSH5SodmqZNt4ERAZDmW4CT+tL8VtvinqywuANaFu4bOMWki16nqf0e4oC0QIaDr/g==
 
+dotenv@^9.0.0:
+  version "9.0.0"
+  resolved "https://registry.npmjs.org/dotenv/-/dotenv-9.0.0.tgz#2408af4e39378375b7eebe30b7b54989e36d6e46"
+  integrity sha512-yy3x9XjojW8ROTBePD25AcMoHqGHsvHmtfw8QWlpEXyMMXXPj6brUA464AptUvHuTPRmNz6Sd3ZLNLeJl6dHJA==
+
 duplexer@^0.1.1, duplexer@^0.1.2:
   version "0.1.2"
   resolved "https://registry.npmjs.org/duplexer/-/duplexer-0.1.2.tgz#3abe43aef3835f8ae077d136ddce0f276b0400e6"