chore(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the dev-dependencies group with 7 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.6	2.5.11
esbuild	0.28.1	0.28.2
gitnexus	1.6.9	1.6.10
turbo	2.10.8	2.10.12
vitest	4.1.10	4.1.11
electron	42.8.0	42.10.1
@types/vscode	1.120.0	1.134.0

Updates @biomejs/biome from 2.5.6 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

• #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• 05797b1 ci: release (#11450)
• 5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• Additional commits viewable in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates gitnexus from 1.6.9 to 1.6.10

Release notes

Sourced from gitnexus's releases.

v1.6.10

GitNexus v1.6.10

The resolution-correctness release. Receiver chains are now typed from AST structure in all 14 languages, imports resolve against declared module configuration instead of path-suffix guesses, and interface dispatch understands generic instantiation — while analyze itself gained a single-writer lock, an atomic index swap and a bounded buffer pool. 396 commits since v1.6.9.

✨ Highlights

• 🧬 Receiver chains are typed from AST structure across all 14 languages, with an explicit lower bound on what the graph is willing to claim. Inline constructors, closure-valued bindings, generic-typed fields and named receivers all resolve now. (#2708, #2744, #2747, #2833, #2855)
• 📦 Imports resolve against real module configuration — tsconfig paths, Java/Kotlin declared packages, Go module paths, PHP Composer autoload maps, Python __init__.py re-exports — instead of guessing from path suffixes. (#2953, #2955, #2984, #2987, #2990, #2864)
• 🍃 Spring modeling goes deep — AOP transactions, caching and security, @Bean factories, @Resource and constructor injection, profiles, conditions and auto-configuration, plus a full bean candidate inventory. (#2783, #2740, #2678, #2632, #2494)
• 🛡️ Analyze got much harder to break — a single-writer lock on the index write path, atomic index swap with read-pool invalidation, a bounded buffer pool sized to the graph, the large-repo OOM cascade fixed, and schema versions derived from a DDL fingerprint instead of a hand-incremented constant. (#2658, #2614, #2560, #2649, #2798)
• 🔒 MCP hardening — a repository allowlist, fail-closed read-only mode, deterministic ordering on every capped query, and bounded output budgets, so impact and context are reproducible run to run. (#2787, #2796)
• 🧭 New surfaces — NestJS decorator routes so api_impact stops calling live endpoints non-existent, full Codex support with hooks and a plugin marketplace, CodeBuddy and Qoder integrations, a bunx lane for bun-only machines, and one-click Render deploy. (#3017, #2369, #2368, #2765, #2804)

---

⚠️ Breaking changes

• Node ^22.18.0 || >=24.11.0 is now the supported floor; the @types/uuid stub is dropped
• The non-functional group matching knobs are gone — matching.bm25_threshold, matching.embedding_threshold, detect.embedding_fallback in group.yaml, the gitnexus group sync --skip-embeddings flag, and the MCP group_sync skipEmbeddings argument (#3020)

🚀 Added

• Spring framework modeling expanded end to end — AOP transactions, caching and security (#2783), @Bean factories and @Resource injection (#2740), profiles/conditions/auto-configuration (#2678), constructor and standard injection (#2632), bean candidate inventory (#2494), configuration-property consumers, and non-HTTP handler entry points (#2891)
• Receiver chains typed from AST structure across all 14 languages, with an explicit epistemic lower bound on what the graph can claim (#2708, #2744, #2747)
• Java enum constant bodies modeled as first-class instances, with JLS 13.1 anonymous-class naming (#2558)
• More route surfaces indexed — Java constant-based route paths such as @PostMapping(ApiPathConstants.X) (#2980) and JavaScript data route tables (#2972)
• MCP server hardening — repository allowlist, fail-closed read-only mode, deterministic output budgets, and normalized impact/context aliases
• bunx lane so bun-only machines can run GitNexus (#2765)
• Codex support — hooks, plugin marketplace and setup (#2328, #2369) — plus CodeBuddy and Qoder coding-agent integrations (#2368)
• Skills mirrored to .agents/skills/ when an .agents/ directory exists
• One-click Render deploy (#2804)
• serve origin/proxy configuration is validated and port-scoped (#2820)
• Expanded TypeScript/JavaScript taint sink model (#2490)
• Wiki generation accepts explicit HTTP LLM hosts (#2491)
• Embedding request-body dimensions configurable via GITNEXUS_EMBEDDING_REQUEST_DIMS (#2574)
• Refreshed MiniMax model and endpoint configuration (#2780)
• MAX_CALLABLE_VALUE_TARGETS and MAX_PROPERTY_DISPATCH_FANOUT configurable via env (#2725, #2726)
• Opt-in analyze --self-commit for AGENTS.md/CLAUDE.md churn (#2640)
• Buffer pool sized to the graph before the database opens, with an adaptive size hint
• CI review agent runs as a coordinated reviewer swarm on Sonnet 5 with structured, linked reviews (#2570, #2572), alongside the GitNexus Engineering Tool Kit skills (#2566) and an online skill-evolution loop (#2571)
• Icebug community-engine prototype behind a gate (#2376)

🐛 Fixed

• group sync stops claiming matching it never did — the advertised BM25/embedding cascade was config, help text and MCP schema with no matcher behind it; the unread matching.bm25_threshold, matching.embedding_threshold, detect.embedding_fallback and --skip-embeddings surfaces are removed (#3020)
• Emitted Next.js build output is ignored during ingestion, and the inert public/build entry is deleted (#3018)
• NestJS decorator routes are indexed so api_impact and route_map stop reporting live endpoints as non-existent (#3017)
• Import resolution gated by real module configuration instead of path-suffix guessing — TypeScript config (#2953, #2956), Java and Kotlin declared packages (#2955, #2990), Go module paths (#2984), PHP Composer autoload maps (#2987), Python __init__.py re-exports (#2864) and unaliased dotted namespace imports (#2826, #2828), and JavaScript module extensions (#3034)
• Interface dispatch is generic-instantiation aware (#2912, #2939), fans out from Case 3b receivers (#2832, #2842) and from C# record interface calls (#2904), and resolves through generic-typed field receivers in every language (#2833, #2855)

... (truncated)

Changelog

Sourced from gitnexus's changelog.

[1.6.10] - 2026-08-27

Added

• Spring framework modeling expanded end to end — AOP transactions, caching and security (#2783), @Bean factories and @Resource injection (#2740), profiles/conditions/auto-configuration (#2678), constructor and standard injection (#2632), bean candidate inventory (#2494), configuration-property consumers, and non-HTTP handler entry points (#2891)
• Receiver chains typed from AST structure across all 14 languages, with an explicit epistemic lower bound on what the graph can claim (#2708, #2744, #2747)
• Java enum constant bodies modeled as first-class instances, with JLS 13.1 anonymous-class naming (#2558)
• More route surfaces indexed — Java constant-based route paths such as @PostMapping(ApiPathConstants.X) (#2980) and JavaScript data route tables (#2972)
• MCP server hardening — repository allowlist, fail-closed read-only mode, deterministic output budgets, and normalized impact/context aliases
• bunx lane so bun-only machines can run GitNexus (#2765)
• Codex support — hooks, plugin marketplace and setup (#2328, #2369) — plus CodeBuddy and Qoder coding-agent integrations (#2368)
• Skills mirrored to .agents/skills/ when an .agents/ directory exists
• One-click Render deploy (#2804)
• serve origin/proxy configuration is validated and port-scoped (#2820)
• Expanded TypeScript/JavaScript taint sink model (#2490)
• Wiki generation accepts explicit HTTP LLM hosts (#2491)
• Embedding request-body dimensions configurable via GITNEXUS_EMBEDDING_REQUEST_DIMS (#2574)
• Refreshed MiniMax model and endpoint configuration (#2780)
• MAX_CALLABLE_VALUE_TARGETS and MAX_PROPERTY_DISPATCH_FANOUT configurable via env (#2725, #2726)
• Opt-in analyze --self-commit for AGENTS.md/CLAUDE.md churn (#2640)
• Buffer pool sized to the graph before the database opens, with an adaptive size hint
• CI review agent runs as a coordinated reviewer swarm on Sonnet 5 with structured, linked reviews (#2570, #2572), alongside the GitNexus Engineering Tool Kit skills (#2566) and an online skill-evolution loop (#2571)
• Icebug community-engine prototype behind a gate (#2376)

Fixed

• group sync stops claiming matching it never did — the advertised BM25/embedding cascade was config, help text and MCP schema with no matcher behind it; the unread matching.bm25_threshold, matching.embedding_threshold, detect.embedding_fallback and --skip-embeddings surfaces are removed (#3020)
• Emitted Next.js build output is ignored during ingestion, and the inert public/build entry is deleted (#3018)
• NestJS decorator routes are indexed so api_impact and route_map stop reporting live endpoints as non-existent (#3017)
• Import resolution gated by real module configuration instead of path-suffix guessing — TypeScript config (#2953, #2956), Java and Kotlin declared packages (#2955, #2990), Go module paths (#2984), PHP Composer autoload maps (#2987), Python __init__.py re-exports (#2864) and unaliased dotted namespace imports (#2826, #2828), and JavaScript module extensions (#3034)
• Interface dispatch is generic-instantiation aware (#2912, #2939), fans out from Case 3b receivers (#2832, #2842) and from C# record interface calls (#2904), and resolves through generic-typed field receivers in every language (#2833, #2855)
• Go method sets modeled exactly so interface satisfaction is decidable (#2813, #2829), out-of-repo package qualifiers resolve, and an undecided interface check is no longer reported as a decided negative (#2873, #2921)
• Go pointer-receiver calls resolve, reporting the program boundary instead of hedging (#2766, #2782)
• Java record support — graph nodes for record_declaration, component accessors, enum and record interface heritage (#2564, #2916, #2935, #2936), plus E.CONST.method() enum-constant receiver dispatch (#2561) and JLS binary-name identities for local classes, enums, records and interfaces (#2562, #2653)
• Rust module-qualified calls resolve against the module tree (#2730, #2741), items are qualified by their enclosing mod chain (#2742, #2745), duplicate type names stay ambiguous in range binding (#2514, #2652), and Box<dyn Trait> names normalize
• Closure bindings are call sources in every language, and function-local values carry their own identity (#2693, #2695, #2699, #2718)
• A named receiver's member never resolves lexically (#2714), platform builtins stop resolving to unrelated same-file symbols (#2549), and inline constructor receivers are typed in every spelling (#2708, #2737)
• Python calls resolve through constructor-injected fields (#2628) and module-imported classes (#2770)
• Package directories that repeat higher in the path resolve correctly (#2881, #2929)
• check stops reporting erased and deferred imports as initialization cycles (#2934)
• detect_changes no longer scales its query with the diff's hunk count (#2915, #2930), and CR-only line-ending diffs are ignored (#2839)
• group stops reporting what could not be measured as a measurement of zero (#3012), resolves HTTP consumers through configured clients and constant route tables (#3008), and preserves manifest-only impact crossings (#2784)
• impact and context are reproducible — deterministic ordering on every capped query (#2787, #2796) — and Convex caller results are marked incomplete rather than empty (#3044)
• Object handler identity is preserved during ingestion (#3046), nested source directories are discovered (#3043), and parse-node insertion is canonicalized
• Large-repo analyze OOM and the false worker-timeout cascade are fixed (#2649, #2679)
• Single-writer lock on the index write path (#2658, #2677), atomic index swap with read-pool staleness invalidation (#2614), and reliable large incremental writeback commits (#2409, #2425)
• Remote URLs are stripped of credentials before they are persisted (#2914, #2928), and every registry write gets its own tmp path (#2888, #2920)
• Schema version derived from a DDL fingerprint instead of a hand-incremented constant (#2798, #2808), and the scope-resolution relation cross product is fully declared (#2792, #2793)
• FTS reliability — binary payloads stay out of the description column and an unbuildable index is confined to its own table (#2919), FTS-indexed DML is gated before the incremental writeback (#2841, #2854), analyze degrades instead of aborting on index-build failure (#2548), real LOAD errors surface and broken extension files self-heal (#2374, #2375), and Windows missing-dependency load failures are diagnosed (#2383)
• VECTOR is loaded only when needed (#3045) and before the incremental writeback touches embedding rows (#2623, #2624)

... (truncated)

Commits

• 6088d2e chore: release v1.6.10 (#3064)
• 0f79355 fix(group)!: stop group sync claiming matching it never did (#3020)
• fb49613 fix(ingestion): ignore emitted Next.js build output, and delete the inert pub...
• 48106d3 fix(ingestion): index NestJS decorator routes so api_impact and route_map sto...
• ac68f52 fix(ingestion): preserve object handler identity (#3046)
• 09322d2 fix(storage): load VECTOR only when needed (#3045)
• 88df18b fix(ingestion): discover nested source directories (#3043)
• 9d4f029 fix(impact): mark Convex caller results incomplete (#3044)
• 2c0fb77 fix(group): stop reporting what could not be measured as a measurement of zer...
• 031e123 fix(group): resolve HTTP consumers through configured clients and constant ro...
• Additional commits viewable in compare view

Updates turbo from 2.10.8 to 2.10.12

Release notes

Sourced from turbo's releases.

Description has been truncated