{"collection":{"slug":"js-toolchain","name":"JavaScript Runtimes & Tooling"},"digest":{"id":"cwd_T_mig3vZVit3j1fE1XSnD","weekStart":"2026-05-11","title":"Turborepo's triple security fix overshadows a quiet week","intro":"Turborepo patched a high-severity command injection vulnerability in its VS Code extension alongside fixes for CSRF and unintended code execution, while Bun shipped v1.3.14 and Vitest released a minor bug-fix update.","body":"### Security hardening takes center stage at Turborepo\n\nThe biggest story of the week is undoubtedly [Turborepo's v2.9.14](/release/rel_bbKVZk2yEMAAwFg1Lbbky-turborepo-v2-9-14-fixes-vscode-extension-command-injection-and-login-csrf), which addresses three CVEs discovered in the tool. Most critically, a high-severity **command injection vulnerability** (GHSA-5xc8-49mv-x4mm) in the VS Code Extension was closed — this could have allowed attackers to execute arbitrary commands through crafted workspace inputs. Two lower-severity issues were also patched: a login callback CSRF/session fixation bug (GHSA-hcf7-66rw-9f5r) and a case of unexpected local code execution during Yarn Berry detection (GHSA-3qcw-2rhx-2726). Any team using the Turborepo VS Code extension — especially in CI or shared environments — should upgrade immediately.\n\nThe security theme continued across the canary channel. [Turborepo v2.9.13-canary.1](/release/rel_xdAokgEbVUxN0WEJ7tFTf-turborepo-v2-9-13-canary-1-hardens-auth-callback-validation-and-lsp-diagnostics) hardened auth callback state validation and further tightened VS Code extension command execution. It also improved LSP diagnostics by allowing `$TURBO_EXTENDS$` and transit nodes, and fixed package manager detection to avoid accidentally picking up a project-local Yarn installation.\n\n### Packaging and UX polish for the monorepo tool\n\nSeveral canary releases brought incremental but meaningful improvements to Turborepo's DX. [v2.9.11-canary.4](/release/rel_pRRx0seBLZQugEOsR6pje-turborepo-v2-9-11-canary-4-reduces-vs-code-extension-startup-popups-and-adds) reduces the frequency of VS Code extension startup popups — a welcome fix for anyone annoyed by the noise — and adds support for `turbo.jsonc` configuration files in the extension, aligning with the CLI's existing JSONC support. The same release removed a redundant task key gradient from the VS Code UI.\n\n[v2.9.15-canary.1](/release/rel_cV8kKKt-VV3WH4s23LtXw-turborepo-v2-9-15-canary-1-fixes-prune-and-process-tree-handling) fixed a subtle bug where `prune` didn't correctly handle `package.json` workspaces, and more importantly ensured that task completion properly waits for the entire process tree before returning — preventing premature shutdowns in complex task graphs. [v2.9.15-canary.3](/release/rel_egNQyHMJ5S4KnyutohUe2-turborepo-v2-9-15-canary-3-prevents-cache-archive-symlink-reads) then fixed a cache archive symlink read issue and introduced signed macOS release binaries, improving trust in the supply chain.\n\n### Bun and Vitest round out the week\n\nBun shipped [v1.3.14](/release/rel_lFtvJ0e6KfcYDwtxYllgO-bun-v1-3-14) from 11 contributors. While the release notes point to the Bun blog for full details, this is a general maintenance release with the usual set of compatibility and performance improvements; no single headline feature stood out this week.\n\nVitest released [v4.1.6](/release/rel_aMQ5ijBj2ILdB1lfSnYed-v4-1-6), a focused bug-fix release. It resolved a browser-mode issue where `toMatchScreenshot` needed a proper project reference, and cleaned up the interaction between global `sequence.concurrent: true` and top-level `test(..., { concurrent: false })` — a corner case that could cause surprising test behavior. The release also deprecated the `sequential` test API and options, moving toward a clearer concurrency model.","releaseIds":["rel_bbKVZk2yEMAAwFg1Lbbky","rel_xdAokgEbVUxN0WEJ7tFTf","rel_pRRx0seBLZQugEOsR6pje","rel_cV8kKKt-VV3WH4s23LtXw","rel_egNQyHMJ5S4KnyutohUe2","rel_lFtvJ0e6KfcYDwtxYllgO","rel_aMQ5ijBj2ILdB1lfSnYed"],"releaseCount":8,"generatedAt":"2026-07-11T16:53:59.970Z","releases":[{"id":"rel_bbKVZk2yEMAAwFg1Lbbky","title":"Turborepo v2.9.14 fixes VSCode extension command injection and login CSRF vulnerabilities","path":"/release/rel_bbKVZk2yEMAAwFg1Lbbky-vscode-extension-command-injection-fixed-login-csrf-patched","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_xdAokgEbVUxN0WEJ7tFTf","title":"Turborepo v2.9.13-canary.1 hardens auth callback validation and LSP diagnostics","path":"/release/rel_xdAokgEbVUxN0WEJ7tFTf-auth-callback-validation-hardened-lsp-diagnostics-improved","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_pRRx0seBLZQugEOsR6pje","title":"Turborepo v2.9.11-canary.4 reduces VS Code extension startup popups and adds turbo.jsonc support","path":"/release/rel_pRRx0seBLZQugEOsR6pje-vs-code-extension-startup-popups-reduced-turbo-jsonc-now-supported","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_cV8kKKt-VV3WH4s23LtXw","title":"Turborepo v2.9.15-canary.1 fixes prune and process tree handling","path":"/release/rel_cV8kKKt-VV3WH4s23LtXw-prune-package-json-workspaces-fixed-process-trees-await-task-completion","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_egNQyHMJ5S4KnyutohUe2","title":"Turborepo v2.9.15-canary.3 prevents cache archive symlink reads","path":"/release/rel_egNQyHMJ5S4KnyutohUe2-cache-archive-symlink-reads-prevented","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_lFtvJ0e6KfcYDwtxYllgO","title":"Bun v1.3.14","path":"/release/rel_lFtvJ0e6KfcYDwtxYllgO-bun-v1-3-14","org":{"slug":"bun","name":"Bun"},"importance":null},{"id":"rel_aMQ5ijBj2ILdB1lfSnYed","title":"v4.1.6","path":"/release/rel_aMQ5ijBj2ILdB1lfSnYed-v4-1-6","org":{"slug":"vitest","name":"Vitest"},"importance":null}]}}