Embedded sccache for Cargo; path traversal rejected
v2.10.5
3 features5 enhancements7 fixesThis release3 featuresNew capabilities5 enhancementsImprovements to existing features7 fixesBug fixesAI-tallied from the release notes
From the original release noteView original ↗
<!-- Release notes generated using configuration in .github/release.yml at v2.10.5 -->
What's Changed
Changelog
- perf: Evaluate simple include globs without wax compilation by @anthonyshew in https://github.com/vercel/turborepo/pull/13285
- chore: Dogfood native Cargo support in this repository by @anthonyshew in https://github.com/vercel/turborepo/pull/13283
- release(turborepo): 2.10.4 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/13286
- ci: Remove dead sccache configuration by @anthonyshew in https://github.com/vercel/turborepo/pull/13289
- feat: Serve the Remote Cache as an sccache backend for Cargo tasks by @anthonyshew in https://github.com/vercel/turborepo/pull/13288
- fix: Reject output path traversal by @anthonyshew in https://github.com/vercel/turborepo/pull/13290
- fix: Disable the sccache proxy when remote cache use is off by @anthonyshew in https://github.com/vercel/turborepo/pull/13291
- feat: Embed sccache so the Cargo compile cache needs no installation by @anthonyshew in https://github.com/vercel/turborepo/pull/13293
- release(turborepo): 2.10.5-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/13294
- fix: Pin a flag-aware turbo canary for the eve-agent deployment by @anthonyshew in https://github.com/vercel/turborepo/pull/13295
- fix: Make the sccache compile cache actually cache by @anthonyshew in https://github.com/vercel/turborepo/pull/13296
- release(turborepo): 2.10.5-canary.2 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/13297
- fix: Stop ambient CARGO_INCREMENTAL from suppressing compile cache injection by @anthonyshew in https://github.com/vercel/turborepo/pull/13298
- fix: Never let compile cache storage failures fail the build by @anthonyshew in https://github.com/vercel/turborepo/pull/13299
- test: Add outputs path-traversal negative-case regression tests by @dnukumamras in https://github.com/vercel/turborepo/pull/13300
- release(turborepo): 2.10.5-canary.3 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/13302
- ci: Authenticate to Remote Cache via OIDC token exchange by @anthonyshew in https://github.com/vercel/turborepo/pull/13303
- fix: Keep pnpm patches with version range keys during prune by @anthonyshew in https://github.com/vercel/turborepo/pull/13307
- test: Scrub ambient turbo configuration from integration test children by @anthonyshew in https://github.com/vercel/turborepo/pull/13306
- fix: Show toolchain tasks in the TUI and never run in silence by @anthonyshew in https://github.com/vercel/turborepo/pull/13308
- ci: Fix change detection on push events by @anthonyshew in https://github.com/vercel/turborepo/pull/13304
- refactor: Rename the Cargo toolchain id to rust by @anthonyshew in https://github.com/vercel/turborepo/pull/13311
- fix: Remove extraneous bun.lock entries during prune by @anthonyshew in https://github.com/vercel/turborepo/pull/13317
- feat: Require a user-declared name for the Cargo workspace package by @anthonyshew in https://github.com/vercel/turborepo/pull/13312
- feat: Parse and validate the task command field by @anthonyshew in https://github.com/vercel/turborepo/pull/13313
- chore: Harden turbo-vsc to invoke turbo without a shell by @dnukumamras in https://github.com/vercel/turborepo/pull/13319
- feat: Resolve and execute task command overrides by @anthonyshew in https://github.com/vercel/turborepo/pull/13315
- release(turborepo): 2.10.5-canary.4 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/13325
- feat: Run the Rust workspace tests through nextest via command override by @anthonyshew in https://github.com/vercel/turborepo/pull/13316
- feat: Engage the Remote Cache and sccache compile cache for Rust CI by @anthonyshew in https://github.com/vercel/turborepo/pull/13292
- ci: Pin GitHub Actions to full commit SHAs by @XananasX7 in https://github.com/vercel/turborepo/pull/13143
- fix: Make npm prune rehoisting deterministic and complete by @anthonyshew in https://github.com/vercel/turborepo/pull/13323
- feat: Report incremental cache reuse in the run summary by @anthonyshew in https://github.com/vercel/turborepo/pull/13327
- chore: Remove planning docs by @anthonyshew in https://github.com/vercel/turborepo/pull/13329
- docs: Migrate docs site to @vercel/geistdocs package by @molebox in https://github.com/vercel/turborepo/pull/13320
- ci: Update Remote Cache action by @anthonyshew in https://github.com/vercel/turborepo/pull/13330
- release(turborepo): 2.10.5-canary.5 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/13331
- ci: Remove path-based workflow scheduling by @anthonyshew in https://github.com/vercel/turborepo/pull/13332
- fix: Resolve EADDRINUSE in kitchen-sink api dev script by @ashusnapx in https://github.com/vercel/turborepo/pull/13328
- ci: Disable telemetry messages in workflows by @anthonyshew in https://github.com/vercel/turborepo/pull/13334
- fix: Prevent Cargo run tasks from being cached by @anthonyshew in https://github.com/vercel/turborepo/pull/13335
- fix: Isolate Cargo cache by host platform by @anthonyshew in https://github.com/vercel/turborepo/pull/13337
- fix: Continue TUI text selection beyond viewport by @anthonyshew in https://github.com/vercel/turborepo/pull/13338
- ci: Dogfood Cargo target restoration by @anthonyshew in https://github.com/vercel/turborepo/pull/13336
- fix: Require current Cargo lockfiles for caching by @anthonyshew in https://github.com/vercel/turborepo/pull/13339
- fix: Reject unsupported Cargo local packages by @anthonyshew in https://github.com/vercel/turborepo/pull/13340
- fix: Allow outputs outside package roots by @anthonyshew in https://github.com/vercel/turborepo/pull/13342
- fix: Resolve Cargo lock dependencies by source by @anthonyshew in https://github.com/vercel/turborepo/pull/13343
- docs: Update Cargo workspace support by @anthonyshew in https://github.com/vercel/turborepo/pull/13349
- fix: Build Ghostty for baseline CPUs by @anthonyshew in https://github.com/vercel/turborepo/pull/13352
- fix: Preserve watch rerun semantics for task inputs by @anthonyshew in https://github.com/vercel/turborepo/pull/13351
- fix: Isolate Command Overrides From Toolchain Cache I/O by @anthonyshew in https://github.com/vercel/turborepo/pull/13354
- release(turborepo): 2.10.5-canary.6 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/13355
- fix: Include patched Ghostty crate in Cargo workspace by @anthonyshew in https://github.com/vercel/turborepo/pull/13357
- ci: Shard Rust tests across runners by @anthonyshew in https://github.com/vercel/turborepo/pull/13356
- fix: Hash Cargo build environment inputs by @anthonyshew in https://github.com/vercel/turborepo/pull/13348
- fix: Synchronize Cargo prune Docker lockfile by @anthonyshew in https://github.com/vercel/turborepo/pull/13350
- chore: Update agents app Eve dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/13364
- fix: Preserve Yarn package extension ranges when pruning by @anthonyshew in https://github.com/vercel/turborepo/pull/13363
- refactor: Add
Toolchainoutput availability by @anthonyshew in https://github.com/vercel/turborepo/pull/13360
New Contributors
- @dnukumamras made their first contribution in https://github.com/vercel/turborepo/pull/13300
- @XananasX7 made their first contribution in https://github.com/vercel/turborepo/pull/13143
- @ashusnapx made their first contribution in https://github.com/vercel/turborepo/pull/13328
Full Changelog: https://github.com/vercel/turborepo/compare/v2.10.4...v2.10.5
Fetched July 13, 2026
