Update dependency turbo to v2.8.9

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
turbo (source)	2.7.5 → 2.8.9

---

Release Notes

vercel/turborepo (turbo)

v2.8.8: Turborepo v2.8.8

Compare Source

What's Changed

@​turbo/codemod

• fix: Enhance path validation in assertSafeGitArgument by @​odaysec in #​11788

Examples

• docs: Replace mysql refs with postgres by @​kyedavey in #​11827

Changelog

• fix: Use private blob store access in agents app by @​anthonyshew in #​11811
• fix: Pass non-empty body when initializing blob log files by @​anthonyshew in #​11812
• docs: Geistdocs update by @​haydenbleasel in #​11807
• fix: Allow overwriting existing blobs in run updates and log appends by @​anthonyshew in #​11813
• docs: Geistdocs update 2 by @​haydenbleasel in #​11814
• fix: Set 5-hour timeout on security audit sandbox by @​anthonyshew in #​11815
• fix: Resolve Windows TUI hang caused by portable-pty 0.9.0 ConPTY changes by @​anthonyshew in #​11816
• fix: Repair audit fixer log streaming and replace git push with patch upload by @​anthonyshew in #​11818
• chore: Small stuff for agent fixer by @​anthonyshew in #​11819
• chore: Bump tonic to 0.14 by @​anthonyshew in #​11820
• fix: Pin @​turbo/gen version to match the running turbo binary by @​anthonyshew in #​11822
• fix: Use secret_key_override in tests to eliminate env var race condition by @​anthonyshew in #​11824
• fix: Avoid panic in sandboxed environments by removing system-configuration dependency by @​anthonyshew in #​11828
• fix: Harden token protection with secrecy crate and close exposure gaps by @​anthonyshew in #​11831
• fix: Clean up orphaned Windows child processes on shutdown by @​anthonyshew in #​11829
• chore: Update lockfile for release by @​anthonyshew in #​11840
• fix: Sync lockfile with @​turbo/gen optionalDependencies by @​anthonyshew in #​11845

New Contributors

• @​haydenbleasel made their first contribution in #​11807
• @​kyedavey made their first contribution in #​11827

Full Changelog: vercel/turborepo@v2.8.7...v2.8.8

v2.8.7: Turborepo v2.8.7

Compare Source

What's Changed

Changelog

• fix: Keep stdin alive for persistent tasks in stream mode by @​anthonyshew in #​11793
• feat: Add internal agents app for repo automation by @​anthonyshew in #​11799
• chore: Add env vars by @​anthonyshew in #​11800
• fix: Handle subpath package imports in turbo boundaries by @​anthonyshew in #​11798
• feat: Add dashboard with run tracking and live logs for agent sandboxes by @​anthonyshew in #​11802
• fix: Normalize bare LF to CRLF in TUI output to prevent garbled logs by @​anthonyshew in #​11804

Full Changelog: vercel/turborepo@v2.8.6...v2.8.7

v2.8.6: Turborepo v2.8.6

Compare Source

What's Changed

Changelog

• chore: Add internal agents app for repo automation by @​anthonyshew in #​11781
• feat: Add internal agents app for repo automation by @​anthonyshew in #​11783
• chore: Manual audits by @​anthonyshew in #​11785
• chore: Fixing audit agent by @​anthonyshew in #​11786
• chore: Still iterating on sec audit fixer by @​anthonyshew in #​11787
• fix: Emit space for empty vt100 cells to fix TUI repaint on task switch by @​anthonyshew in #​11789

Full Changelog: vercel/turborepo@v2.8.5...v2.8.6

v2.8.5: Turborepo v2.8.5

Compare Source

What's Changed

@​turbo/codemod

• fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @​anthonyshew in #​11766
• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11765

@​turbo/repository

• fix: Rename cli workspace package to avoid false audit match by @​anthonyshew in #​11767

Changelog

• fix: Add Vary: Accept header to docs markdown endpoint by @​molebox in #​11759
• chore: Agentic workflows app by @​anthonyshew in #​11773
• chore: Add internal agents app for repo automation by @​anthonyshew in #​11776
• chore: Update reproduction request message by @​anthonyshew in #​11778
• Revert "fix: Upgrade node-plop to 0.32.3" by @​anthonyshew in #​11780

Full Changelog: vercel/turborepo@v2.8.4...v2.8.5

v2.8.4: Turborepo v2.8.4

Compare Source

What's Changed

create-turbo

• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11683
• fix: Upgrade inquirer to remove lodash dependency by @​anthonyshew in #​11709
• fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability by @​anthonyshew in #​11702
• fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability by @​anthonyshew in #​11706

eslint

• fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities by @​anthonyshew in #​11681
• fix: Upgrade eslint to v10 to resolve @​eslint/plugin-kit ReDoS vulnerability by @​anthonyshew in #​11705

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @​i5d6 in #​11679

Changelog

• fix: Upgrade tar to 7.5.7 to address security vulnerabilities by @​anthonyshew in #​11680
• fix: Upgrade ts-json-schema-generator to fix glob command injection vulnerability by @​anthonyshew in #​11684
• fix: Upgrade fumadocs and shiki in docs to resolve mdast-util-to-hast vulnerability by @​anthonyshew in #​11704
• fix: Replace ts-node with tsx to resolve diff DoS vulnerability by @​anthonyshew in #​11708
• fix: Upgrade bytes to >=1.11.1 to fix RUSTSEC-2026-0007 by @​anthonyshew in #​11715
• chore: Update ratatui dependencies (paste blocked upstream) by @​anthonyshew in #​11717
• Revert "chore: Update ratatui dependencies (paste blocked upstream)" by @​anthonyshew in #​11722
• fix: Upgrade ratatui to 0.30.0 to drop unmaintained paste crate by @​anthonyshew in #​11723
• chore: Upgrade reqwest toward addressing RUSTSEC-2025-0134 by @​anthonyshew in #​11718
• fix(docs): Fix code syntax highlighting by using correct Shiki CSS variable names by @​anthonyshew in #​11726
• fix: Upgrade async-io to 2.x to drop unmaintained instant crate by @​anthonyshew in #​11719
• fix: Migrate from unmaintained serde_yaml to serde_yml by @​anthonyshew in #​11720
• fix: Upgrade test-case and merge to drop unmaintained proc-macro-error by @​anthonyshew in #​11721
• fix: Upgrade indicatif to 0.18.3 to drop unmaintained number_prefix by @​anthonyshew in #​11716
• refactor: Centralize configuration resolution funnel by @​anthonyshew in #​11727
• fix: Upgrade rustls chain to resolve RUSTSEC-2025-0134 by @​anthonyshew in #​11739
• fix: Upgrade test-case to resolve transitive proc-macro-error by @​anthonyshew in #​11737
• fix: Upgrade pest/pest_derive to resolve yanked version by @​anthonyshew in #​11734
• fix: Upgrade git2 to fix RUSTSEC-2026-0008 by @​anthonyshew in #​11729
• fix: Upgrade pprof to fix RUSTSEC-2024-0408 by @​anthonyshew in #​11730
• fix: Upgrade portable-pty to resolve RUSTSEC-2017-0008 by @​anthonyshew in #​11732
• fix: Upgrade oxc_resolver to resolve yanked papaya dependency by @​anthonyshew in #​11733
• fix: Upgrade futures/futures-util to resolve yanked futures-util 0.3.30 by @​anthonyshew in #​11735
• fix: Replace unic-segment with unicode-segmentation in globwatch by @​anthonyshew in #​11736
• fix: Replace serde_yml with serde_yaml_ng to fix RUSTSEC-2025-0067/0068 by @​anthonyshew in #​11755
• fix: Replace oxc_resolver with unrs_resolver to fix yanked papaya dependency by @​anthonyshew in #​11754
• fix: Upgrade node-plop to 0.32.3 by @​anthonyshew in #​11756
• docs: Capitalizaiton in update github-actions.mdx by @​anthonyshew in #​11762

Full Changelog: vercel/turborepo@v2.8.3...v2.8.4

v2.8.3: Turborepo v2.8.3

Compare Source

What's Changed

Changelog

• fix: Upgrade capnp to 0.24 by @​anthonyshew in #​11656
• fix: Upgrade h2 to fix CONTINUATION Flood by @​anthonyshew in #​11658
• fix: Upgrade crossbeam-channel to 0.5.15 by @​anthonyshew in #​11657
• chore: Remove abandoned turbo clone command by @​anthonyshew in #​11673
• fix: Upgrade rustls and ring by @​anthonyshew in #​11659
• fix: Upgrade openssl to 0.10.75 by @​anthonyshew in #​11660
• fix: Replace unmaintained adler with adler2 by @​anthonyshew in #​11661

Full Changelog: vercel/turborepo@v2.8.2...v2.8.3

v2.8.2: Turborepo v2.8.2

Compare Source

What's Changed

Docs

• fix: Upgrade next to fix HTTP deserialization DoS by @​anthonyshew in #​11597
• fix: Upgrade mermaid to fix lodash-es vulnerability by @​anthonyshew in #​11611
• fix: Upgrade recharts to fix lodash vulnerability by @​anthonyshew in #​11606
• chore: Move applications to apps/ directory by @​anthonyshew in #​11613
• fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @​anthonyshew in #​11616

create-turbo

• fix: Upgrade tsup to fix rollup and glob vulnerabilities by @​anthonyshew in #​11601
• fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @​anthonyshew in #​11622
• fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @​anthonyshew in #​11623
• feat: Migrate from tsup to tsdown by @​anthonyshew in #​11649

@​turbo/codemod

• fix: Upgrade axios to fix SSRF vulnerability by @​anthonyshew in #​11599
• fix: Replace axios with native fetch in turbo-codemod by @​anthonyshew in #​11600
• fix: Upgrade diff to fix DoS vulnerabilities by @​anthonyshew in #​11621

eslint

• fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @​anthonyshew in #​11610
• fix: Upgrade esbuild to fix arbitrary request vulnerability by @​anthonyshew in #​11615

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @​i5d6 in #​11591
• fix: escaping for link titles in LinksService by @​odaysec in #​11632

Changelog

• fix: Add allowComments and allowTrailingCommas to turbo.json schema by @​ddmoney420 in #​11579
• chore: Eliminate ts-rs serde attribute parse warnings by @​anthonyshew in #​11589
• fix: Extract git argument validation into reusable helper by @​anthonyshew in #​11593
• fix: Upgrade fast-xml-parser to fix RangeError DoS by @​anthonyshew in #​11598
• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11596
• fix: Upgrade tar to fix security vulnerabilities by @​anthonyshew in #​11602
• fix: Upgrade @​actions/github to fix @​octokit vulnerabilities by @​anthonyshew in #​11607
• fix: Upgrade @​vercel/blob and @​actions packages to fix undici vulnerability by @​anthonyshew in #​11608
• docs: Running Root Tasks by @​Netail in #​11630
• Update README.md title and remove features section by @​anthonyshew in #​11651
• docs: Update using-environment-variables.mdx by @​anthonyshew in #​11652
• fix: Upgrade js-yaml to address CVE-2025-64718 by @​alexmkio in #​11650
• fix: Remove smooth scrolling from docs by @​anthonyshew in #​11654
• fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @​anthonyshew in #​11655

New Contributors

• @​ddmoney420 made their first contribution in #​11579
• @​i5d6 made their first contribution in #​11591
• @​Netail made their first contribution in #​11630
• @​alexmkio made their first contribution in #​11650

Full Changelog: vercel/turborepo@v2.8.1...v2.8.2

v2.8.1: Turborepo v2.8.1

Compare Source

What's Changed

Docs

• docs: Release post for 2.8 by @​anthonyshew in #​11559
• docs: Update oxc.mdx to include cache false by @​bestickley in #​11571
• docs: Fix curl markdown Accept header syntax in 2.8 release blog by @​marko-hologram in #​11580
• docs: Fix worktree command in blog post by @​anthonyshew in #​11583
• docs: Rename command → subcommand by @​anthonyshew in #​11584
• feat: Add requestType tracking for header-negotiated markdown by @​molebox in #​11585

Changelog

• fix: Support trailing commas in microfrontends JSONC files by @​anthonyshew in #​11573
• perf: Replace third-party crates with Rust std lib equivalents by @​anthonyshew in #​11569
• perf: Reduce duplicate dependency versions by @​anthonyshew in #​11568
• chore: Remove legacy Go/goreleaser buildcontainer directory by @​anthonyshew in #​11576
• chore: Rename README.md to RULE.md in skills directory by @​anthonyshew in #​11582
• fix: Validate turbo version from lockfile for all package managers by @​anthonyshew in #​11587

New Contributors

• @​bestickley made their first contribution in #​11571
• @​marko-hologram made their first contribution in #​11580

Full Changelog: vercel/turborepo@v2.8.0...v2.8.1

v2.8.0: Turborepo v2.8.0

Compare Source

What's Changed

Docs

• fix(docs): Hide line numbers for terminal code blocks by @​anthonyshew in #​11560
• fix: Disable pointer events on closed chat panel by @​anthonyshew in #​11561

@​turbo/repository

• chore: Update to Rust 1.93.0 by @​ognevny in #​11548

Changelog

• chore: Update docs:dev script filter to point to the correct documentation site path by @​yujiseok in #​11551
• docs(skills): Standardize --dry flag usage by @​jeniabrook in #​11550
• fix: Normalize ANSI escape codes in insta snapshots by @​anthonyshew in #​11564
• chore: Remove unused dependencies by @​anthonyshew in #​11565

New Contributors

• @​yujiseok made their first contribution in #​11551

Full Changelog: vercel/turborepo@v2.7.6...v2.8.0

v2.7.6

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	turbo@​2.7.5 ⏵ 2.8.9			+1	+1

View full report