Changes for users:

- (BREAKING) `dotenv run` exits with status code 1 instead of 2 if the command
  provided as argument can't be found.
- `dotenv run` prints a friendly error message instead of a stack trace
  if the command provided as argument can't be found.

Notes:

The existing test case was wrongly testing for that situation: it was
actually observing a "missing env file" error, not a "command not found
error". I thus added an appropriate test case for full coverage.

Co-authored-by: Saurabh Kumar <theskumar@users.noreply.github.com>

…d_dotenv` and `dotenv_values` (#614)

* Fix: strip UTF-8 BOM from .env files to prevent silent first-variable loss

When a .env file is saved with a UTF-8 BOM (common with JetBrains IDEs
on Windows), the BOM character (\ufeff) was prepended to the first
variable name, making it silently inaccessible via its intended key.

Strip the BOM in Reader.__init__ so all variables are parsed correctly
regardless of whether the file contains a BOM.

Fixes #637

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: add changelog entry for BOM fix

---------

Co-authored-by: h1whelan <h1whelan@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Saurabh Kumar <theskumar@users.noreply.github.com>

…ivilege permissions (#650)

- Pin all GitHub Actions to full SHA with version comments
- Add top-level permissions: contents: read to test.yml
- Add top-level permissions: contents: read to release.yml (write only at job level)
- Upgrade pypa/gh-action-pypi-publish from release/v1 tag to v1.14.0 SHA
- Add pip ecosystem tracking to dependabot
- Add commit-message prefixes and labels to dependabot config

…github-actions group (#651)

Bumps the github-actions group with 1 update: [peaceiris/actions-gh-pages](https://github.com/peaceiris/actions-gh-pages).


Updates `peaceiris/actions-gh-pages` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/peaceiris/actions-gh-pages/releases)
- [Changelog](https://github.com/peaceiris/actions-gh-pages/blob/main/CHANGELOG.md)
- [Commits](peaceiris/actions-gh-pages@4f9cc66...84c30a8)

---
updated-dependencies:
- dependency-name: peaceiris/actions-gh-pages
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: liwenjun-dev <liwenjun.dev@gmail.com>

Updates the requirements on [pytest](https://github.com/pytest-dev/pytest) to permit the latest version.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@3.9.0...9.0.3)

---
updated-dependencies:
- dependency-name: pytest
  dependency-version: 9.0.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…=6.0.0 to >=7.3.0 (#652)

Updates the requirements on [mkdocs-include-markdown-plugin](https://github.com/mondeja/mkdocs-include-markdown-plugin) to permit the latest version.
- [Release notes](https://github.com/mondeja/mkdocs-include-markdown-plugin/releases)
- [Commits](mondeja/mkdocs-include-markdown-plugin@v6.0.0...v7.3.0)

---
updated-dependencies:
- dependency-name: mkdocs-include-markdown-plugin
  dependency-version: 7.3.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ions group (#658)

Bumps the github-actions group with 1 update: [actions/checkout](https://github.com/actions/checkout).


Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...df4cb1c)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

`set_key` writes single-quoted values but only escaped single quotes,
not backslashes. The single-quoted-value parser decodes `\` and `\'`,
so any value with a backslash came back wrong:

    set_key(".env", "P", r"C:\Users")   # writes P='C:\Users'
    get_key(".env", "P")                # -> "C:Users"

Escape backslashes before single quotes when writing.

That alone is not enough for a value that ends in a backslash. The
quoted-value patterns treated `\'` as an escape but not `\`, so in
`P='back\'` the second backslash paired with the closing quote. `[^']`
matches newlines, so the match ran on into the following lines and the
binding failed to parse, taking the next entries with it. Both the
single- and double-quoted patterns now treat a backslash as escaping
whatever follows it.

Fixes #661

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>