chore(deps): update dependency turbo to v2.9.6 by renovate[bot] · Pull Request #1520 · settlemint/sdk

renovate · 2026-01-12T02:02:18Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
turbo (source)	devDependencies	minor	`2.7.3` → `2.9.6`

Release Notes

vercel/turborepo (turbo)

`v2.9.6`: Turborepo v2.9.6

Compare Source

What's Changed

create-turbo

chore: Update dependencies found in audits by @anthonyshew in #12586

Examples

fix: Add missing @types/node to with-svelte example apps by @anthonyshew in #12585

Changelog

docs: Add Bun equivalent for updating dependencies by @anthonyshew in #12580
fix: Mention turbo.json in concurrency error message by @anthonyshew in #12582
fix: Surface actionable message when remote cache is requested but not linked by @anthonyshew in #12584
chore: Delete agents app by @anthonyshew in #12587
fix: Load custom CA certificates in fast webpki-only HTTP client by @anthonyshew in #12591
docs: Remove pre-release badges by @anthonyshew in #12592

Full Changelog: vercel/turborepo@v2.9.5...v2.9.6

`v2.9.5`: Turborepo v2.9.5

Compare Source

What's Changed

create-turbo

feat: Replace package manager commands in scaffolded README files by @DependerKumarSoni in #6747

@turbo/telemetry

fix: Suppress telemetry alert when running on Vercel by @anthonyshew in #12576

Changelog

feat: Add circular package dependency detection to boundaries by @anthonyshew in #12567
perf: Increase remote cache upload chunk size from 8KB to 256KB by @anthonyshew in #12568
perf: Parallelize boundaries checking with Rayon and cache DFS traversals by @anthonyshew in #12569

New Contributors

@DependerKumarSoni made their first contribution in #6747

Full Changelog: vercel/turborepo@v2.9.4...v2.9.5

`v2.9.4`: Turborepo v2.9.4

Compare Source

What's Changed

@turbo/codemod

fix: Always update $schema URL to versioned format during migration by @anthonyshew in #12529
fix: Support turbo.jsonc in codemod transforms by @anthonyshew in #12532
fix: Preserve prerelease info in schema URL during codemod migration by @anthonyshew in #12542

Examples

build(deps): Bump @xmldom/xmldom from 0.8.11 to 0.8.12 in /examples/with-react-native-web by @dependabot[bot] in #12537

Changelog

feat: Add incremental task caching by @anthonyshew in #12531
docs: Send siteId as label on feedback GitHub issues by @molebox in #12527
Replace local ai-agent-detection with @vercel/agent-readability by @molebox in #12528
fix: Prevent filterUsingTasks --filter from pulling dependents into Task Graph by @anthonyshew in #12535
fix: Only enforce signature key length for keys that exist by @anthonyshew in #12538
fix: Validate engine concurrency after task-level filtering by @anthonyshew in #12540
feat: Allow --affected and --filter to be combined by @anthonyshew in #12543
fix(config): Deep-merge nested OTEL config across priority sources by @bitttttten in #12513
fix: Retain microfrontend proxy tasks when using filterUsingTasks by @anthonyshew in #12545
fix: Bun workspace lockfile pruning producing invalid output by @JRoy in #12548
fix: Respect dirty .gitignore patterns during task input hashing by @anthonyshew in #12557

New Contributors

@JRoy made their first contribution in #12548

Full Changelog: vercel/turborepo@v2.9.3...v2.9.4

`v2.9.3`: Turborepo v2.9.3

Compare Source

What's Changed

Changelog

fix: Preserve per-workspace lockfiles during pnpm pruning by @anthonyshew in #12519

Full Changelog: vercel/turborepo@v2.9.2...v2.9.3

`v2.9.2`: Turborepo v2.9.2

Compare Source

What's Changed

Examples

feat(examples): Add Next.js + Elysia full-stack starter template by @eastgold15 in #12414

Changelog

docs: Add documentation for cacheMaxAge and cacheMaxSize options by @anthonyshew in #12500
fix: Resolve correct nested bun lockfile versions during prune by @anthonyshew in #12506
Revert "fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes" by @anthonyshew in #12507
fix: Unblock watch loop so interruptible persistent tasks restart on file changes by @anthonyshew in #12509
fix(api-client): Treat * as wildcard in preflight Access-Control-Allow-Headers by @bitttttten in #12503
docs: Document turbo.* generator variables by @anthonyshew in #12511
fix: Backfill missing pnpm workspace importer entries during prune by @anthonyshew in #12514
fix: Include transitive dependencies in engine graph pruning for affected paths using Task Graph by @anthonyshew in #12516
fix: Update AI-generated response disclaimer to include human attribution by @Copilot in #12517
fix: Preserve shallow install strategy during npm lockfile pruning by @anthonyshew in #12520

New Contributors

@eastgold15 made their first contribution in #12414

Full Changelog: vercel/turborepo@v2.9.1...v2.9.2

`v2.9.1`: Turborepo v2.9.1

Compare Source

What's Changed

@turbo/codemod

feat: Handle package manager catalogs in migration codemod by @anthonyshew in #12496

@turbo/repository

feat: Add cacheMaxAge and cacheMaxSize for local cache eviction by @anthonyshew in #12487

Changelog

docs: Release post for 2.9 by @anthonyshew in #12441

Full Changelog: vercel/turborepo@v2.9.0...v2.9.1

`v2.9.0`: Turborepo v2.9.0

Compare Source

What's Changed

Docs

docs: Release post for 2.8 by @anthonyshew in #11559
docs: Update oxc.mdx to include cache false by @bestickley in #11571
docs: Fix curl markdown Accept header syntax in 2.8 release blog by @marko-hologram in #11580
docs: Fix worktree command in blog post by @anthonyshew in #11583
docs: Rename command → subcommand by @anthonyshew in #11584
feat: Add requestType tracking for header-negotiated markdown by @molebox in #11585
fix: Upgrade next to fix HTTP deserialization DoS by @anthonyshew in #11597
fix: Upgrade mermaid to fix lodash-es vulnerability by @anthonyshew in #11611
fix: Upgrade recharts to fix lodash vulnerability by @anthonyshew in #11606
chore: Move applications to apps/ directory by @anthonyshew in #11613
fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @anthonyshew in #11616
chore: Migrate to Ultracite by @haydenbleasel in #11948
fix: Strip JSX components from heading anchors and TOC entries by @anthonyshew in #12404

create-turbo

fix: Upgrade tsup to fix rollup and glob vulnerabilities by @anthonyshew in #11601
fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @anthonyshew in #11622
fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @anthonyshew in #11623
feat: Migrate from tsup to tsdown by @anthonyshew in #11649
fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11683
fix: Upgrade inquirer to remove lodash dependency by @anthonyshew in #11709
fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability by @anthonyshew in #11702
fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability by @anthonyshew in #11706
fix: Recover version numbering to 2.8.9-canary.0 by @anthonyshew in #11853
fix: Sanitize git command inputs in create-turbo by @anthonyshew in #11876
chore: Remove pnpm-eslint .vscode transform from create-turbo by @anthonyshew in #12186
fix: Improve create-turbo connectivity check and offline error messages by @anthonyshew in #12257
feat: Add affectedUsingTaskInputs future flag for task-level --affected detection by @anthonyshew in #12247
fix: Replace dns.lookup with https.get for create-turbo online check by @anthonyshew in #12277
fix: Remove redundant online check from create-turbo by @anthonyshew in #12281
fix: Sort uninstalled package managers to bottom of create-turbo selection by @anthonyshew in #12353

turbo-ignore

fix: Resolve pnpm audit vulnerabilities via dependency bumps by @anthonyshew in #12220
feat: Deprecate turbo-ignore in favor of turbo query affected by @anthonyshew in #12382
fix: Tailored turbo-ignore deprecation notice for Vercel users by @anthonyshew in #12385

@turbo/codemod

fix: Upgrade axios to fix SSRF vulnerability by @anthonyshew in #11599
fix: Replace axios with native fetch in turbo-codemod by @anthonyshew in #11600
fix: Upgrade diff to fix DoS vulnerabilities by @anthonyshew in #11621
fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @anthonyshew in #11766
fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11765
fix: Enhance path validation in assertSafeGitArgument by @odaysec in #11788
fix: Guard against missing pipeline key in clean-globs codemod by @anthonyshew in #12235
fix: Stop add-package-names codemod from silently renaming existing packages by @anthonyshew in #12332
fix: Handle Yarn 2+ in @turbo/codemod install commands by @anthonyshew in #12477

eslint

fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @anthonyshew in #11610
fix: Upgrade esbuild to fix arbitrary request vulnerability by @anthonyshew in #11615
fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities by @anthonyshew in #11681
fix: Upgrade eslint to v10 to resolve @eslint/plugin-kit ReDoS vulnerability by @anthonyshew in #11705
fix(eslint-plugin-turbo): Guard against missing tasks/pipeline in forEachTaskDef by @sleitor in #12411

@turbo/repository

fix: Rename cli workspace package to avoid false audit match by @anthonyshew in #11767
perf: Defer TLS initialization to a background thread by @anthonyshew in #11967
fix: Add repository field to @turbo/repository package.json by @anthonyshew in #11982
release(library): 0.0.1-canary.19 by @github-actions[bot] in #11983
feat: Add experimentalObservability with an OTel backend by @bkonkle in #11130
release(library): 0.0.1-canary.20 by @github-actions[bot] in #12116
chore: Update to Rust 1.94.0 by @ognevny in #12192
feat: Add packagesFromLockfile() NAPI binding to @turbo/repository by @anthonyshew in #12454
release(library): 0.0.1-canary.21 by @github-actions[bot] in #12455

Examples

examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in #11591
fix: escaping for link titles in LinksService by @odaysec in #11632
examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in #11679
docs: Replace mysql refs with postgres by @kyedavey in #11827
feat: Add with-otel example with pre-configured Grafana dashboard by @anthonyshew in #12043
examples: Upgrade with-react-native-web example to use latest versions by @serjooo in #12085
fix: Duplicate /signup? in Vercel URL by @04cb in #12088
examples: Fix markdown links inside code blocks in basic README by @sleitor in #11946
fix: Match vite and @vitejs/plugin-react versions on example by @GabrielBB in #12193
fix: Sync yarn lockfile before upgrading turbo in examples updater by @anthonyshew in #12286
chore: Upgrade Next.js to 16.2.0 in examples and apps by @anthonyshew in #12389
fix(examples): Update of with-svelte example by @floriansalihovic in #11952
fix: Use script-shell=bash for cross-platform with-shell-commands example by @Goldyvaiiii in #12436

Changelog

fix: Support trailing commas in microfrontends JSONC files by @anthonyshew in #11573
perf: Replace third-party crates with Rust std lib equivalents by @anthonyshew in #11569
perf: Reduce duplicate dependency versions by @anthonyshew in #11568
chore: Remove legacy Go/goreleaser buildcontainer directory by @anthonyshew in #11576
chore: Rename README.md to RULE.md in skills directory by @anthonyshew in #11582
fix: Validate turbo version from lockfile for all package managers by @anthonyshew in #11587
fix: Add allowComments and allowTrailingCommas to turbo.json schema by @ddmoney420 in #11579
chore: Eliminate ts-rs serde attribute parse warnings by @anthonyshew in #11589
fix: Extract git argument validation into reusable helper by @anthonyshew in #11593
fix: Upgrade fast-xml-parser to fix RangeError DoS by @anthonyshew in #11598
fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11596
fix: Upgrade tar to fix security vulnerabilities by @anthonyshew in #11602
fix: Upgrade @actions/github to fix @octokit vulnerabilities by @anthonyshew in #11607
fix: Upgrade @vercel/blob and @actions packages to fix undici vulnerability by @anthonyshew in #11608
docs: Running Root Tasks by @Netail in #11630
Update README.md title and remove features section by @anthonyshew in #11651
docs: Update using-environment-variables.mdx by @anthonyshew in #11652
fix: Upgrade js-yaml to address CVE-2025-64718 by @alexmkio in #11650
fix: Remove smooth scrolling from docs by @anthonyshew in #11654
fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @anthonyshew in #11655
fix: Upgrade capnp to 0.24 by @anthonyshew in #11656
fix: Upgrade h2 to fix CONTINUATION Flood by @anthonyshew in #11658
fix: Upgrade crossbeam-channel to 0.5.15 by @anthonyshew in #11657
chore: Remove abandoned turbo clone command by @anthonyshew in #11673
fix: Upgrade rustls and ring by @anthonyshew in #11659
fix: Upgrade openssl to 0.10.75 by @anthonyshew in #11660
fix: Replace unmaintained adler with adler2 by @anthonyshew in #11661
fix: Upgrade tar to 7.5.7 to address security vulnerabilities by @anthonyshew in #11680
fix: Upgrade ts-json-schema-generator to fix glob command injection vulnerability by @anthonyshew in #11684
fix: Upgrade fumadocs and shiki in docs to resolve mdast-util-to-hast vulnerability by @anthonyshew in #11704
fix: Replace ts-node with tsx to resolve diff DoS vulnerability by @anthonyshew in #11708
fix: Upgrade bytes to >=1.11.1 to fix RUSTSEC-2026-0007 by @anthonyshew in #11715
chore: Update ratatui dependencies (paste blocked upstream) by @anthonyshew in #11717
Revert "chore: Update ratatui dependencies (paste blocked upstream)" by @anthonyshew in #11722
fix: Upgrade ratatui to 0.30.0 to drop unmaintained paste crate by @anthonyshew in #11723
chore: Upgrade reqwest toward addressing RUSTSEC-2025-0134 by @anthonyshew in #11718
fix(docs): Fix code syntax highlighting by using correct Shiki CSS variable names by @anthonyshew in #11726
fix: Upgrade async-io to 2.x to drop unmaintained instant crate by @anthonyshew in #11719
fix: Migrate from unmaintained serde_yaml to serde_yml by @anthonyshew in #11720
fix: Upgrade test-case and merge to drop unmaintained proc-macro-error by @anthonyshew in #11721
fix: Upgrade indicatif to 0.18.3 to drop unmaintained number_prefix by @anthonyshew in #11716
refactor: Centralize configuration resolution funnel by @anthonyshew in #11727
fix: Upgrade rustls chain to resolve RUSTSEC-2025-0134 by @anthonyshew in #11739
fix: Upgrade test-case to resolve transitive proc-macro-error by @anthonyshew in #11737
fix: Upgrade pest/pest_derive to resolve yanked version by @anthonyshew in #11734
fix: Upgrade git2 to fix RUSTSEC-2026-0008 by @anthonyshew in #11729
fix: Upgrade pprof to fix RUSTSEC-2024-0408 by @anthonyshew in #11730
fix: Upgrade portable-pty to resolve RUSTSEC-2017-0008 by @anthonyshew in #11732
fix: Upgrade oxc_resolver to resolve yanked papaya dependency by @anthonyshew in #11733
fix: Upgrade futures/futures-util to resolve yanked futures-util 0.3.30 by @anthonyshew in #11735
fix: Replace unic-segment with unicode-segmentation in globwatch by @anthonyshew in #11736
fix: Replace serde_yml with serde_yaml_ng to fix RUSTSEC-2025-0067/0068 by @anthonyshew in #11755
fix: Replace oxc_resolver with unrs_resolver to fix yanked papaya dependency by @anthonyshew in #11754
fix: Upgrade node-plop to 0.32.3 by @anthonyshew in #11756
docs: Capitalizaiton in update github-actions.mdx by @anthonyshew in #11762
fix: Add Vary: Accept header to docs markdown endpoint by @molebox in #11759
chore: Agentic workflows app by @anthonyshew in #11773
chore: Add internal agents app for repo automation by @anthonyshew in #11776
chore: Update reproduction request message by @anthonyshew in #11778
Revert "fix: Upgrade node-plop to 0.32.3" by @anthonyshew in #11780
chore: Add internal agents app for repo automation by @anthonyshew in #11781
feat: Add internal agents app for repo automation by @anthonyshew in #11783
chore: Manual audits by @anthonyshew in #11785
chore: Fixing audit agent by @anthonyshew in #11786
chore: Still iterating on sec audit fixer by @anthonyshew in #11787
fix: Emit space for empty vt100 cells to fix TUI repaint on task switch by @anthonyshew in #11789
fix: Keep stdin alive for persistent tasks in stream mode by @anthonyshew in #11793
feat: Add internal agents app for repo automation by @anthonyshew in #11799
chore: Add env vars by @anthonyshew in #11800
fix: Handle subpath package imports in turbo boundaries by @anthonyshew in #11798
feat: Add dashboard with run tracking and live logs for agent sandboxes by @anthonyshew in #11802
fix: Normalize bare LF to CRLF in TUI output to prevent garbled logs by @anthonyshew in #11804
fix: Use private blob store access in agents app by @anthonyshew in #11811
fix: Pass non-empty body when initializing blob log files by @anthonyshew in #11812
docs: Geistdocs update by @haydenbleasel in #11807
fix: Allow overwriting existing blobs in run updates and log appends by @anthonyshew in #11813
docs: Geistdocs update 2 by @haydenbleasel in #11814
fix: Set 5-hour timeout on security audit sandbox by @anthonyshew in #11815
fix: Resolve Windows TUI hang caused by portable-pty 0.9.0 ConPTY changes by @anthonyshew in #11816
fix: Repair audit fixer log streaming and replace git push with patch upload by @anthonyshew in #11818
chore: Small stuff for agent fixer by @anthonyshew in #11819
chore: Bump tonic to 0.14 by @anthonyshew in #11820
fix: Pin @turbo/gen version to match the running turbo binary by @anthonyshew in #11822
fix: Use secret_key_override in tests to eliminate env var race condition by @anthonyshew in #11824
fix: Avoid panic in sandboxed environments by removing system-configuration dependency by @anthonyshew in #11828
fix: Harden token protection with secrecy crate and close exposure gaps by @anthonyshew in #11831
fix: Clean up orphaned Windows child processes on shutdown by @anthonyshew in #11829
chore: Update lockfile for release by @anthonyshew in #11840
fix: Sync lockfile with @turbo/gen optionalDependencies by @anthonyshew in #11845
docs: Update Vitest guide with projects configuration by @PeterPCW in #11760
fix: Prevent premature git tag push during release staging by @anthonyshew in #11851
fix: Replace unsafe pre_exec/setsid with tokio process_group(0) by @anthonyshew in #11854
fix: Resolve external npm packages in @turbo/gen compiled binary (#11855) by @anthonyshew in #11856
fix: Move node-plop to dependencies so PlopTypes resolves for consumers by @anthonyshew in #11862
chore: Use 2024 edition in more packages, do not ignore some clippy l… by @ognevny in #11860
perf: Optimize hot-path hash computation by avoiding clones and using unstable sorts by @anthonyshew in #11872
perf: Replace twox-hash with xxhash-rust and optimize file hashing by @anthonyshew in #11874
fix: Restrict credential file permissions to owner-only by @anthonyshew in #11870
perf: Reduce allocations in globwalk by @anthonyshew in #11528
perf: Replace O(V³) Floyd-Warshall with O(V+E) DFS in watch mode subgraph creation by @anthonyshew in #11878
feat: Generate LLM-friendly markdown alongside --profile trace output by @anthonyshew in #11880
feat: Make --profile and --anon-profile filename optional by @anthonyshew in #11883
perf: Batch per-package git subprocess calls into repo-wide index by @anthonyshew in #11887
perf: Parallelize and pre-build RepoGitIndex by @anthonyshew in #11889
perf: Pre-compile glob exclusion filter and cache path prefix in file hashing by @anthonyshew in #11891
fix: Get all pnpm lockfile pruning tests passing by @anthonyshew in #11897
perf: Optimize pnpm lockfile transitive closure resolution by @anthonyshew in #11898
fix: Resolve npm packages in @turbo/gen compiled binary by @anthonyshew in #11900
perf: Deduplicate file hashing and parallelize globwalks by @anthonyshew in #11902
perf: Improve transitive dependency resolution cache sharing across workspaces by @anthonyshew in #11903
perf: Reduce filesystem syscalls in globwalk, SCM hashing, and task scheduling by @anthonyshew in #11907
feat: Remove daemon from turbo run, deprecate daemon flags and config by @anthonyshew in #11910
test: Replace help text integration tests with insta snapshots by @anthonyshew in #11911
perf: Reduce allocations in SCM hashing, glob preprocessing, and cache lookups by @anthonyshew in #11916
perf: Parallelize package.json loading and reduce builder allocations by @anthonyshew in #11918
perf: Cache compiled env wildcard regexes for builtin pass-through patterns by @anthonyshew in #11920
perf: Replace O(N) workspace path lookup with HashMap index in DependencySplitter by @anthonyshew in #11922
perf: Parallelize lockfile parsing with workspace discovery by @anthonyshew in #11927
perf: Optimize turbo run hotpath with parallelization and reduced allocations by @anthonyshew in #11928
perf: Share HTTP client and improve profile instrumentation by @anthonyshew in #11929
perf: Share HTTP client and improve profile instrumentation by @anthonyshew in #11932
perf: Reduce git subprocess calls on startup by @anthonyshew in #11934
chore: Upgrade zstd 0.12.3 to 0.13.3 by @anthonyshew in #11936
perf: Replace git subprocesses with libgit2 and skip unnecessary summary work by @anthonyshew in #11938
perf: Reduce per-package hashing overhead and eliminate SCM subprocesses by @anthonyshew in #11942
perf: Reduce CPU overhead in turbo run hot path by @anthonyshew in #11947
perf: Replace libgit2 git status with gix-index for faster file hashing by @anthonyshew in #11950
perf: Resolve literal input paths via stat instead of glob walk by @anthonyshew in #11955
perf: Optimize engine builder, task visitor, and untracked file discovery by @anthonyshew in #11956
perf: Parallelize turbo run pre-execution hot path by @anthonyshew in #11958
chore: Add tracing spans to uninstrumented hot path functions by @anthonyshew in #11959
perf: Use Arc<str> for task dependency hashes to avoid heap clones by @anthonyshew in #11962
perf: Add more tracing spans into startup path by @anthonyshew in #11965
perf: Parallelize task hash computation across topological waves by @anthonyshew in #11969
perf: Send engine callback before tracker bookkeeping and add tracing spans by @anthonyshew in #11970
fix: Resolve git_root to worktree root in linked worktrees by @anthonyshew in #11974
perf: Fast path for shallow wildcard glob patterns in workspace discovery by @anthonyshew in #11972
chore: Move git hooks from pre-commit to pre-push and match CI lint checks by @anthonyshew in #11977
chore: Update AGENTS.md by @anthonyshew in #11978
perf: Replace heap-allocated String with stack-allocated OidHash for git OIDs by @anthonyshew in #11984
perf: Eliminate redundant syscalls in FSCache fetch and exists by @anthonyshew in #11985
perf: Reduce per-task allocations in visitor dispatch loop by @anthonyshew in #11986
docs: Fix same-page anchor links that don't scroll to target by @anthonyshew in #11989
docs: Mention inputs key in package hash inputs table by @anthonyshew in #11990
fix(docs): update sitemap.md to single-line pipe-delimited format by @molebox in #11976
fix: Disable husky pre-push hook during release staging by [@anthonyshew](https://redirect.github.com/anthonyshe

Configuration

📅 Schedule: (UTC)

Branch creation
- At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
- Only on Sunday and Saturday (* * * * 0,6)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

cubic-dev-ai

No issues found across 2 files

socket-security · 2026-03-31T10:50:56Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	turbo@2.7.3 ⏵ 2.9.6	⁺¹		⁺¹	⁺¹

View full report

socket-security · 2026-03-31T10:50:58Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot added the dependencies Dependency updates label Jan 12, 2026

renovate bot enabled auto-merge (squash) January 12, 2026 02:02

renovate-approve-2 bot approved these changes Jan 12, 2026

View reviewed changes

renovate-approve bot approved these changes Jan 12, 2026

View reviewed changes

github-actions bot added qa:running QA workflow is currently running status:approved Pull request has been approved labels Jan 12, 2026

cubic-dev-ai bot reviewed Jan 12, 2026

View reviewed changes

renovate bot force-pushed the renovate/turbo-monorepo branch from 251f2c7 to 155afcc Compare January 17, 2026 06:10

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.7.4~~ chore(deps): update dependency turbo to v2.7.5 Jan 17, 2026

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.7.5~~ chore(deps): update dependency turbo to v2.7.6 Jan 24, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch 2 times, most recently from 3cf97f2 to 1dc5318 Compare January 28, 2026 19:15

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.7.6~~ chore(deps): update dependency turbo to v2.8.0 Jan 28, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 1dc5318 to 9901082 Compare January 30, 2026 22:42

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.0~~ chore(deps): update dependency turbo to v2.8.1 Jan 30, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 9901082 to d3e0bef Compare February 3, 2026 06:14

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.1~~ chore(deps): update dependency turbo to v2.8.2 Feb 3, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from d3e0bef to a9926e7 Compare February 3, 2026 23:00

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.2~~ chore(deps): update dependency turbo to v2.8.3 Feb 3, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from a9926e7 to 4a94302 Compare February 10, 2026 23:52

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.3~~ chore(deps): update dependency turbo to v2.8.5 Feb 10, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 4a94302 to e09ef1c Compare February 11, 2026 15:35

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.5~~ chore(deps): update dependency turbo to v2.8.6 Feb 11, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from e09ef1c to bee6f7d Compare February 11, 2026 23:10

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.6~~ chore(deps): update dependency turbo to v2.8.7 Feb 11, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from bee6f7d to 392faaa Compare February 13, 2026 22:57

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.7~~ chore(deps): update dependency turbo to v2.8.8 Feb 13, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 392faaa to d0014ae Compare February 15, 2026 02:31

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.8~~ chore(deps): update dependency turbo to v2.8.9 Feb 15, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from d0014ae to 7e19c3d Compare February 18, 2026 12:06

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.12~~ chore(deps): update dependency turbo to v2.8.13 Mar 3, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 4d5de6b to 96c5d59 Compare March 6, 2026 15:02

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.13~~ chore(deps): update dependency turbo to v2.8.14 Mar 6, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 96c5d59 to 28210f2 Compare March 9, 2026 23:18

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.14~~ chore(deps): update dependency turbo to v2.8.15 Mar 9, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 28210f2 to 9b9f1f2 Compare March 11, 2026 06:49

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.15~~ chore(deps): update dependency turbo to v2.8.16 Mar 11, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 9b9f1f2 to 9d09123 Compare March 13, 2026 19:17

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.16~~ chore(deps): update dependency turbo to v2.8.17 Mar 13, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 9d09123 to f4e7f55 Compare March 18, 2026 18:45

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.17~~ chore(deps): update dependency turbo to v2.8.18 Mar 18, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from f4e7f55 to d85f7be Compare March 18, 2026 22:42

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.18~~ chore(deps): update dependency turbo to v2.8.19 Mar 18, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from d85f7be to 58623bc Compare March 19, 2026 18:19

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.19~~ chore(deps): update dependency turbo to v2.8.20 Mar 19, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 58623bc to ec523ff Compare March 31, 2026 10:49

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.20~~ chore(deps): update dependency turbo to v2.9.1 Mar 31, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from ec523ff to dfb0465 Compare March 31, 2026 22:39

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.9.1~~ chore(deps): update dependency turbo to v2.9.2 Mar 31, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from dfb0465 to 020196f Compare April 1, 2026 02:29

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.9.2~~ chore(deps): update dependency turbo to v2.9.3 Apr 1, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 020196f to 3fcfe85 Compare April 6, 2026 02:47

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.9.3~~ chore(deps): update dependency turbo to v2.9.4 Apr 6, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 3fcfe85 to b3c70da Compare April 7, 2026 19:00

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.9.4~~ chore(deps): update dependency turbo to v2.9.5 Apr 7, 2026

chore(deps): update dependency turbo to v2.9.6

0ba2605

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot force-pushed the renovate/turbo-monorepo branch from b3c70da to 0ba2605 Compare April 10, 2026 15:39

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.9.5~~ chore(deps): update dependency turbo to v2.9.6 Apr 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency turbo to v2.9.6#1520

chore(deps): update dependency turbo to v2.9.6#1520
renovate[bot] wants to merge 1 commit intomainfrom
renovate/turbo-monorepo

renovate bot commented Jan 12, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

socket-security bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.9.6: Turborepo v2.9.6

What's Changed

create-turbo

Examples

Changelog

v2.9.5: Turborepo v2.9.5

What's Changed

create-turbo

@​turbo/telemetry

Changelog

New Contributors

v2.9.4: Turborepo v2.9.4

What's Changed

@​turbo/codemod

Examples

Changelog

New Contributors

v2.9.3: Turborepo v2.9.3

What's Changed

Changelog

v2.9.2: Turborepo v2.9.2

What's Changed

Examples

Changelog

New Contributors

v2.9.1: Turborepo v2.9.1

What's Changed

@​turbo/codemod

@​turbo/repository

Changelog

v2.9.0: Turborepo v2.9.0

What's Changed

Docs

create-turbo

turbo-ignore

@​turbo/codemod

eslint

@​turbo/repository

Examples

Changelog

Configuration

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

socket-security bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Jan 12, 2026 •

edited

Loading

`v2.9.6`: Turborepo v2.9.6

`v2.9.5`: Turborepo v2.9.5

@turbo/telemetry

`v2.9.4`: Turborepo v2.9.4

@turbo/codemod

`v2.9.3`: Turborepo v2.9.3

`v2.9.2`: Turborepo v2.9.2

`v2.9.1`: Turborepo v2.9.1

@turbo/codemod

@turbo/repository

`v2.9.0`: Turborepo v2.9.0

@turbo/codemod

@turbo/repository

socket-security bot commented Mar 31, 2026 •

edited

Loading

socket-security bot commented Mar 31, 2026 •

edited

Loading