diff --git a/package-lock.json b/package-lock.json
index 44a87f5c..16c222b2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15226,7 +15226,7 @@
         "@ckb-lumos/codec": "0.21.1",
         "@ckb-lumos/lumos": "0.21.1",
         "@koa/cors": "5.0.0",
-        "dotenv": "16.3.2",
+        "dotenv": "16.4.2",
         "http-errors": "2.0.0",
         "koa": "2.15.0",
         "koa-body": "6.0.1"
@@ -15236,6 +15236,17 @@
         "typescript": "5.3.3"
       }
     },
+    "packages/samples/mvp-dapp/node_modules/dotenv": {
+      "version": "16.4.2",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.4.2.tgz",
+      "integrity": "sha512-rZSSFxke7d9nYQ5NeMIwp5PP+f8wXgKNljpOb7KtH6SKW1cEqcXAz9VSJYVLKe7Jhup/gUYOkaeSVyK8GJ+nBg==",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
     "packages/samples/profile": {
       "name": "kuai-project",
       "extraneous": true,
diff --git a/packages/samples/mvp-dapp/package.json b/packages/samples/mvp-dapp/package.json
index 99a65484..0137c6c6 100644
--- a/packages/samples/mvp-dapp/package.json
+++ b/packages/samples/mvp-dapp/package.json
@@ -19,7 +19,7 @@
     "@ckb-lumos/codec": "0.21.1",
     "@ckb-lumos/lumos": "0.21.1",
     "@koa/cors": "5.0.0",
-    "dotenv": "16.3.2",
+    "dotenv": "16.4.2",
     "http-errors": "2.0.0",
     "koa": "2.15.0",
     "koa-body": "6.0.1"