---
collection: js-toolchain
collection_name: JavaScript Runtimes & Tooling
week_start: 2026-05-11
title: Turborepo's triple security fix overshadows a quiet week
release_count: 8
generated: 2026-07-11
canonical: https://releases.sh/collections/js-toolchain/digest/2026-05-11
---

# Turborepo's triple security fix overshadows a quiet week

Turborepo patched a high-severity command injection vulnerability in its VS Code extension alongside fixes for CSRF and unintended code execution, while Bun shipped v1.3.14 and Vitest released a minor bug-fix update.

### Security hardening takes center stage at Turborepo

The biggest story of the week is undoubtedly [Turborepo's v2.9.14](/release/rel_bbKVZk2yEMAAwFg1Lbbky-turborepo-v2-9-14-fixes-vscode-extension-command-injection-and-login-csrf), which addresses three CVEs discovered in the tool. Most critically, a high-severity **command injection vulnerability** (GHSA-5xc8-49mv-x4mm) in the VS Code Extension was closed — this could have allowed attackers to execute arbitrary commands through crafted workspace inputs. Two lower-severity issues were also patched: a login callback CSRF/session fixation bug (GHSA-hcf7-66rw-9f5r) and a case of unexpected local code execution during Yarn Berry detection (GHSA-3qcw-2rhx-2726). Any team using the Turborepo VS Code extension — especially in CI or shared environments — should upgrade immediately.

The security theme continued across the canary channel. [Turborepo v2.9.13-canary.1](/release/rel_xdAokgEbVUxN0WEJ7tFTf-turborepo-v2-9-13-canary-1-hardens-auth-callback-validation-and-lsp-diagnostics) hardened auth callback state validation and further tightened VS Code extension command execution. It also improved LSP diagnostics by allowing `$TURBO_EXTENDS$` and transit nodes, and fixed package manager detection to avoid accidentally picking up a project-local Yarn installation.

### Packaging and UX polish for the monorepo tool

Several canary releases brought incremental but meaningful improvements to Turborepo's DX. [v2.9.11-canary.4](/release/rel_pRRx0seBLZQugEOsR6pje-turborepo-v2-9-11-canary-4-reduces-vs-code-extension-startup-popups-and-adds) reduces the frequency of VS Code extension startup popups — a welcome fix for anyone annoyed by the noise — and adds support for `turbo.jsonc` configuration files in the extension, aligning with the CLI's existing JSONC support. The same release removed a redundant task key gradient from the VS Code UI.

[v2.9.15-canary.1](/release/rel_cV8kKKt-VV3WH4s23LtXw-turborepo-v2-9-15-canary-1-fixes-prune-and-process-tree-handling) fixed a subtle bug where `prune` didn't correctly handle `package.json` workspaces, and more importantly ensured that task completion properly waits for the entire process tree before returning — preventing premature shutdowns in complex task graphs. [v2.9.15-canary.3](/release/rel_egNQyHMJ5S4KnyutohUe2-turborepo-v2-9-15-canary-3-prevents-cache-archive-symlink-reads) then fixed a cache archive symlink read issue and introduced signed macOS release binaries, improving trust in the supply chain.

### Bun and Vitest round out the week

Bun shipped [v1.3.14](/release/rel_lFtvJ0e6KfcYDwtxYllgO-bun-v1-3-14) from 11 contributors. While the release notes point to the Bun blog for full details, this is a general maintenance release with the usual set of compatibility and performance improvements; no single headline feature stood out this week.

Vitest released [v4.1.6](/release/rel_aMQ5ijBj2ILdB1lfSnYed-v4-1-6), a focused bug-fix release. It resolved a browser-mode issue where `toMatchScreenshot` needed a proper project reference, and cleaned up the interaction between global `sequence.concurrent: true` and top-level `test(..., { concurrent: false })` — a corner case that could cause surprising test behavior. The release also deprecated the `sequential` test API and options, moving toward a clearer concurrency model.

## Releases covered

### Bun

- [Bun v1.3.14](https://releases.sh/release/rel_lFtvJ0e6KfcYDwtxYllgO-bun-v1-3-14)

### Vercel

- [Turborepo v2.9.14 fixes VSCode extension command injection and login CSRF vulnerabilities](https://releases.sh/release/rel_bbKVZk2yEMAAwFg1Lbbky-vscode-extension-command-injection-fixed-login-csrf-patched)
- [Turborepo v2.9.13-canary.1 hardens auth callback validation and LSP diagnostics](https://releases.sh/release/rel_xdAokgEbVUxN0WEJ7tFTf-auth-callback-validation-hardened-lsp-diagnostics-improved)
- [Turborepo v2.9.11-canary.4 reduces VS Code extension startup popups and adds turbo.jsonc support](https://releases.sh/release/rel_pRRx0seBLZQugEOsR6pje-vs-code-extension-startup-popups-reduced-turbo-jsonc-now-supported)
- [Turborepo v2.9.15-canary.1 fixes prune and process tree handling](https://releases.sh/release/rel_cV8kKKt-VV3WH4s23LtXw-prune-package-json-workspaces-fixed-process-trees-await-task-completion)
- [Turborepo v2.9.15-canary.3 prevents cache archive symlink reads](https://releases.sh/release/rel_egNQyHMJ5S4KnyutohUe2-cache-archive-symlink-reads-prevented)

### Vitest

- [v4.1.6](https://releases.sh/release/rel_aMQ5ijBj2ILdB1lfSnYed-v4-1-6)