Turborepo

<!-- Release notes generated using configuration in .github/release.yml at v2.9.15 -->

What's Changed

Changelog

• release(turborepo): 2.9.14 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12805
• fix: Prune package.json workspaces by @anthonyshew in https://github.com/vercel/turborepo/pull/12808
• fix: Wait for process trees before task completion by @anthonyshew in https://github.com/vercel/turborepo/pull/12809
• release(turborepo): 2.9.15-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12810
• ci: Sign macOS release binaries by @anthonyshew in https://github.com/vercel/turborepo/pull/12811
• release(turborepo): 2.9.15-canary.2 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12812
• fix: Prevent cache archive symlink reads by @anthonyshew in https://github.com/vercel/turborepo/pull/12813
• release(turborepo): 2.9.15-canary.3 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12814
• fix: Avoid path-racy chmod during directory restore by @anthonyshew in https://github.com/vercel/turborepo/pull/12815
• fix: Prevent cache restore symlink race writes by @anthonyshew in https://github.com/vercel/turborepo/pull/12817
• chore: Deny Rust panic extraction by default by @anthonyshew in https://github.com/vercel/turborepo/pull/12818
• fix: Make structured log symlink defense race-safe by @anthonyshew in https://github.com/vercel/turborepo/pull/12821
• fix: Preserve Bun alias child packages by @anthonyshew in https://github.com/vercel/turborepo/pull/12822
• fix: Avoid UTF-8 panics at boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/12823
• fix: Preserve non-UTF-8 Git path boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/12826
• fix: Create daemon dirs with private permissions by @anthonyshew in https://github.com/vercel/turborepo/pull/12827
• fix: Return Berry lockfile errors instead of panicking by @anthonyshew in https://github.com/vercel/turborepo/pull/12828
• fix: Isolate Corepack state in integration tests by @anthonyshew in https://github.com/vercel/turborepo/pull/12831
• ci: Use larger Windows runners for Rust tests by @anthonyshew in https://github.com/vercel/turborepo/pull/12832
• docs: Add with-vite-module-federation example by @gioboa in https://github.com/vercel/turborepo/pull/12794
• test: Run Rust tests without partitioning by @anthonyshew in https://github.com/vercel/turborepo/pull/12833
• chore: Remove TaskHashTracker-based expect() calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12836
• chore: Deduplicate hash canonicalization by @anthonyshew in https://github.com/vercel/turborepo/pull/12837
• fix: Prevent Windows process drain hangs by @anthonyshew in https://github.com/vercel/turborepo/pull/12838
• fix: Refactor execsync to execfilesync for Shell command built from environment values by @bjormgyg in https://github.com/vercel/turborepo/pull/12829
• test: Bound vt100 random quickcheck by @anthonyshew in https://github.com/vercel/turborepo/pull/12839
• fix: Validate daemon discovery responses by @anthonyshew in https://github.com/vercel/turborepo/pull/12840
• fix: Store PackageGraph root invariants by @anthonyshew in https://github.com/vercel/turborepo/pull/12841
• chore: Avoid engine graph node expects by @anthonyshew in https://github.com/vercel/turborepo/pull/12842
• test: Make Rust tests parallel-safe by @anthonyshew in https://github.com/vercel/turborepo/pull/12843
• fix: Avoid graph utility node lookup panics by @anthonyshew in https://github.com/vercel/turborepo/pull/12844
• fix: Avoid graph walker expect() calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12845
• fix: Remove fs panic extraction lints by @anthonyshew in https://github.com/vercel/turborepo/pull/12846
• fix: Remove fixed map panic extraction calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12847
• fix: Remove devtools WebSocket panics by @anthonyshew in https://github.com/vercel/turborepo/pull/12850
• fix: Remove json rewrite panic lint allow by @anthonyshew in https://github.com/vercel/turborepo/pull/12848
• fix: Remove turborepo-types panic lint allows by @anthonyshew in https://github.com/vercel/turborepo/pull/12849
• chore: Remove turborepo-hash build expect by @anthonyshew in https://github.com/vercel/turborepo/pull/12851
• fix: Remove napi panic lint allows by @anthonyshew in https://github.com/vercel/turborepo/pull/12852
• fix: Avoid globwatch expect calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12853
• fix: Remove LSP expect callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12854
• fix: Remove scope panic lint allows by @anthonyshew in https://github.com/vercel/turborepo/pull/12855
• fix: Remove task hash panic lints by @anthonyshew in https://github.com/vercel/turborepo/pull/12856
• fix: Remove frameworks panic lint allows by @anthonyshew in https://github.com/vercel/turborepo/pull/12857
• fix: Remove microfrontends proxy expect lint allow by @anthonyshew in https://github.com/vercel/turborepo/pull/12859
• fix: Avoid API client expect calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12858
• fix: Avoid task executor expect calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12860
• fix: Remove turbo-trace unwrap callsite by @anthonyshew in https://github.com/vercel/turborepo/pull/12863
• fix: Remove Vercel API mock expect usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12862
• fix: Remove vt100 expect lint allow by @anthonyshew in https://github.com/vercel/turborepo/pull/12861
• fix: Remove turborepo-shim expect callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12864
• test: Deflake daemon existing process test by @anthonyshew in https://github.com/vercel/turborepo/pull/12865
• fix: Avoid repository NAPI unwrap calls by @anthonyshew in https://github.com/vercel/turborepo/pull/12866
• fix: Remove pidlock panic callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12867
• fix: Remove telemetry panic callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12868
• chore: Remove Rust re-export shims by @anthonyshew in https://github.com/vercel/turborepo/pull/12870
• fix: Remove turbo-json panic lint allows by @anthonyshew in https://github.com/vercel/turborepo/pull/12869
• fix: Remove globwalk's expect() callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12871
• fix: Remove turbopath's expect() callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12872
• test: Deflake Corepack prepare lock on Windows by @anthonyshew in https://github.com/vercel/turborepo/pull/12873
• fix: Remove signals panic callsites by @anthonyshew in https://github.com/vercel/turborepo/pull/12874
• fix: Remove turbo-trace's expect() allow by @anthonyshew in https://github.com/vercel/turborepo/pull/12876
• fix: Remove Vercel API mock unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12877
• fix: Remove task executor unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12878
• fix: Remove run summary expect usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12879
• fix: Remove microfrontends proxy unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12880
• fix: Remove api client unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12881
• fix: Remove globwalk unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12883
• fix: Remove UI expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12882
• fix: Remove microfrontends expect usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12885
• fix: Remove boundaries's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12887
• fix: Remove turborepo-process's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12888
• fix: Remove UI unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12889
• fix: Remove microfrontends unwrap allow by @anthonyshew in https://github.com/vercel/turborepo/pull/12890
• fix: Remove turborepo-process's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12891
• fix: Remove scm expect usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12893
• fix: Remove auth unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12886
• fix: Remove turbopath's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12884
• fix: Remove auth's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12895
• fix: Remove wax unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12899
• fix: Remove scm unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12897
• fix: Remove turborepo-boundaries's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12896
• fix: Remove daemon unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12898
• fix: Include lockfile-changed packages in affected tasks by @anthonyshew in https://github.com/vercel/turborepo/pull/12900
• fix: Remove turborepo-wax's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12901
• fix: Remove turborepo-filewatch's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12903
• fix: Remove turborepo-cache's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12902
• fix: Remove turborepo-daemon's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12904
• fix: Remove turborepo-engine's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12906
• fix: Remove filewatch unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12907
• fix: Remove engine expect usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12908
• fix: Remove cache unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12909
• fix: Remove turborepo-lockfiles expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12910
• chore: Set pnpm minimum release age by @anthonyshew in https://github.com/vercel/turborepo/pull/12912
• fix: Remove turborepo-lockfiles's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12911
• fix: Remove turborepo-vt100's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12913
• release(turborepo): 2.9.15-canary.4 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12905
• fix: Remove turborepo-lib's unwrap() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12915
• fix: Remove turborepo-lib's expect() usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12914
• fix: Remove shim test unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12917
• fix: Remove turbo json test unwrap allowance by @anthonyshew in https://github.com/vercel/turborepo/pull/12918
• fix: Remove run summary test unwrap usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12916
• release(turborepo): 2.9.15-canary.5 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12919
• fix: Restore task completion semantics by @anthonyshew in https://github.com/vercel/turborepo/pull/12923
• fix: Preserve nested Bun workspace dependency versions by @anthonyshew in https://github.com/vercel/turborepo/pull/12924
• release(turborepo): 2.9.15-canary.6 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12925
• fix: Restore release PR auto-merge by @anthonyshew in https://github.com/vercel/turborepo/pull/12927
• perf: Index repo gitignore matchers by @anthonyshew in https://github.com/vercel/turborepo/pull/12928
• ci: Disable incremental Rust test builds by @anthonyshew in https://github.com/vercel/turborepo/pull/12929
• perf: Trim OpenTelemetry crate features by @anthonyshew in https://github.com/vercel/turborepo/pull/12930
• perf: Trim microfrontends proxy HTTP features by @anthonyshew in https://github.com/vercel/turborepo/pull/12931
• fix: Accept experimentalCI object config by @anthonyshew in https://github.com/vercel/turborepo/pull/12934
• release(turborepo): 2.9.15-canary.7 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12935
• fix: Restore a few internal invariant checks by @anthonyshew in https://github.com/vercel/turborepo/pull/12933
• fix: Improve profile tracing coverage by @anthonyshew in https://github.com/vercel/turborepo/pull/12936
• fix: Use build-scale OTel duration buckets by @anthonyshew in https://github.com/vercel/turborepo/pull/12939
• fix: Preserve pnpm injected peer package entries by @anthonyshew in https://github.com/vercel/turborepo/pull/12940
• feat: Add heap allocation profiling by @anthonyshew in https://github.com/vercel/turborepo/pull/12943
• release(turborepo): 2.9.15-canary.8 by @anthonyshew in https://github.com/vercel/turborepo/pull/12945
• docs: Correct attribute presence claims in turborepo-otel by @adityasingh2400 in https://github.com/vercel/turborepo/pull/12932
• chore(turbo-codemod): Remove duplicate "in" in transforms path comment by @mvanhorn in https://github.com/vercel/turborepo/pull/12948
• chore: Switch Geist font imports to npm geist package by @christopherkindl in https://github.com/vercel/turborepo/pull/12952
• fix: Respect root gitignore during prune by @anthonyshew in https://github.com/vercel/turborepo/pull/12953
• fix: Harden OTEL endpoint validation by @anthonyshew in https://github.com/vercel/turborepo/pull/12954

New Contributors

• @gioboa made their first contribution in https://github.com/vercel/turborepo/pull/12794
• @bjormgyg made their first contribution in https://github.com/vercel/turborepo/pull/12829
• @adityasingh2400 made their first contribution in https://github.com/vercel/turborepo/pull/12932
• @mvanhorn made their first contribution in https://github.com/vercel/turborepo/pull/12948
• @christopherkindl made their first contribution in https://github.com/vercel/turborepo/pull/12952

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.14...v2.9.15

High:

• GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection

Low:

• GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation
• GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection

<!-- Release notes generated using configuration in .github/release.yml at v2.9.14 -->

What's Changed

Changelog

• release(turborepo): 2.9.12 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12774
• fix: Restore docs mobile menu by @anthonyshew in https://github.com/vercel/turborepo/pull/12782
• ci: Use pull_request for PR title linting by @anthonyshew in https://github.com/vercel/turborepo/pull/12787
• ci: Scope GitHub Actions caches by branch by @anthonyshew in https://github.com/vercel/turborepo/pull/12788
• test: Validate lockfiles without dependency downloads by @anthonyshew in https://github.com/vercel/turborepo/pull/12789
• Removed unneeded import form hash creation script in docs by @dancrumb in https://github.com/vercel/turborepo/pull/12799
• fix: Validate auth callback state by @anthonyshew in https://github.com/vercel/turborepo/pull/12802
• fix: Harden VS Code extension command execution by @anthonyshew in https://github.com/vercel/turborepo/pull/12800
• fix: Avoid project-local Yarn during detection by @anthonyshew in https://github.com/vercel/turborepo/pull/12801
• chore: Release 2.9.13 by @anthonyshew in https://github.com/vercel/turborepo/pull/12803

New Contributors

• @dancrumb made their first contribution in https://github.com/vercel/turborepo/pull/12799

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.12...v2.9.14

<!-- Release notes generated using configuration in .github/release.yml at v2.9.12 -->

What's Changed

Changelog

• release(turborepo): 2.9.11 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12771
• fix: Allow transit nodes in LSP diagnostics by @anthonyshew in https://github.com/vercel/turborepo/pull/12773

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.11...v2.9.12

<!-- Release notes generated using configuration in .github/release.yml at v2.9.11 -->

What's Changed

Changelog

• release(turborepo): 2.9.10 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12745
• ci: Publish VS Code extension on release by @anthonyshew in https://github.com/vercel/turborepo/pull/12747
• fix: Start daemon for VSCode Extension from the extension itself by @anthonyshew in https://github.com/vercel/turborepo/pull/12749
• release(turborepo): 2.9.11-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12748
• fix: Include file URIs in LSP lifecycle logs by @anthonyshew in https://github.com/vercel/turborepo/pull/12751
• fix: Handle JSON decoration visitor depth by @anthonyshew in https://github.com/vercel/turborepo/pull/12752
• fix: Resolve relative turbo path in VS Code extension by @anthonyshew in https://github.com/vercel/turborepo/pull/12753
• fix: Preserve Bun nested dependencies during prune by @anthonyshew in https://github.com/vercel/turborepo/pull/12754
• fix: Prefer installed Turbo for LSP by @anthonyshew in https://github.com/vercel/turborepo/pull/12755
• release(turborepo): 2.9.11-canary.2 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12750
• ci: Parallelize LSP release publishing by @anthonyshew in https://github.com/vercel/turborepo/pull/12758
• fix: Reduce VS Code extension startup popups by @anthonyshew in https://github.com/vercel/turborepo/pull/12759
• fix: Support turbo.jsonc in VS Code extension by @anthonyshew in https://github.com/vercel/turborepo/pull/12760
• fix: Remove VS Code task key gradient by @anthonyshew in https://github.com/vercel/turborepo/pull/12761
• release(turborepo): 2.9.11-canary.3 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12756
• chore: Release v2.9.11-canary.4 by @anthonyshew in https://github.com/vercel/turborepo/pull/12762
• ci: Stop VS Code publish from blocking release PR by @anthonyshew in https://github.com/vercel/turborepo/pull/12763
• release(turborepo): 2.9.11-canary.5 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12764
• fix: Publish VS Code extension from release tag by @anthonyshew in https://github.com/vercel/turborepo/pull/12765
• fix: Support shimmed VS Code LSP probes by @anthonyshew in https://github.com/vercel/turborepo/pull/12767
• release(turborepo): 2.9.11-canary.6 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12766
• release(turborepo): 2.9.11-canary.7 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12768
• fix: Allow $TURBO_EXTENDS$ in LSP diagnostics by @anthonyshew in https://github.com/vercel/turborepo/pull/12770

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.10...v2.9.11

<!-- Release notes generated using configuration in .github/release.yml at v2.9.10 -->

What's Changed

Changelog

• release(turborepo): 2.9.9-canary.4 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12716
• release(turborepo): 2.9.9 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12719
• fix: Respect SCM env vars in turbo query affected by @anthonyshew in https://github.com/vercel/turborepo/pull/12722
• ci: Package VSCode extension in release workflow by @anthonyshew in https://github.com/vercel/turborepo/pull/12723
• fix: Avoid some raw create-turbo example telemetry by @anthonyshew in https://github.com/vercel/turborepo/pull/12725
• fix: Escape graph HTML payloads by @anthonyshew in https://github.com/vercel/turborepo/pull/12726
• fix: Prevent OTEL token injection to spoofed origins by @anthonyshew in https://github.com/vercel/turborepo/pull/12727
• fix: Retry HTTP status failures by @anthonyshew in https://github.com/vercel/turborepo/pull/12728
• fix: Validate microfrontend proxy Host header by @anthonyshew in https://github.com/vercel/turborepo/pull/12730
• fix: Redact task hash env debug logs by @anthonyshew in https://github.com/vercel/turborepo/pull/12733
• fix: Filter microfrontend proxy environments by @anthonyshew in https://github.com/vercel/turborepo/pull/12732
• fix: Preserve FSEvents mount points for device-relative paths by @anthonyshew in https://github.com/vercel/turborepo/pull/12729
• fix: Validate proxy Host headers by @anthonyshew in https://github.com/vercel/turborepo/pull/12731
• fix: Resolve TypeScript .js extension imports to .ts files in boundaries by @maschwenk in https://github.com/vercel/turborepo/pull/12644
• fix: Use random temp path for repo downloads by @anthonyshew in https://github.com/vercel/turborepo/pull/12736
• release(turborepo): 2.9.10-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12734
• fix: Reject OTel endpoints with userinfo by @anthonyshew in https://github.com/vercel/turborepo/pull/12737
• fix: Authenticate local devtools WebSocket by @anthonyshew in https://github.com/vercel/turborepo/pull/12738
• fix: Handle clipboard exec errors by @anthonyshew in https://github.com/vercel/turborepo/pull/12739
• fix: Restrict Vercel token reuse to trusted API origins by @anthonyshew in https://github.com/vercel/turborepo/pull/12740
• fix: Keep workspace config discovery inside root by @anthonyshew in https://github.com/vercel/turborepo/pull/12741
• fix: Hardening for daemon IPC endpoints by @anthonyshew in https://github.com/vercel/turborepo/pull/12742
• fix: Enforce cache filesystem boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/12743

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.9...v2.9.10

<!-- Release notes generated using configuration in .github/release.yml at v2.9.9 -->

What's Changed

Changelog

• release(turborepo): 2.9.8 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12700
• fix: Remove Unix parent death watchdogs by @anthonyshew in https://github.com/vercel/turborepo/pull/12699
• release(turborepo): 2.9.9-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12705
• fix: Scope repo index prefixes to Git root by @anthonyshew in https://github.com/vercel/turborepo/pull/12706
• release(turborepo): 2.9.9-canary.2 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12708
• ci: Harden non-release GitHub Actions by @anthonyshew in https://github.com/vercel/turborepo/pull/12707
• docs: Add pnpm workspace flag (-w) to Oxc setup docs by @mattjoll in https://github.com/vercel/turborepo/pull/12655
• fix: Harden OG image signatures by @anthonyshew in https://github.com/vercel/turborepo/pull/12709
• fix: Scope release npm publishing credentials by @anthonyshew in https://github.com/vercel/turborepo/pull/12710
• ci: Harden release workflows by @anthonyshew in https://github.com/vercel/turborepo/pull/12711
• release(turborepo): 2.9.9-canary.3 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12712
• fix: Harden docs security endpoints by @anthonyshew in https://github.com/vercel/turborepo/pull/12713
• ci: Harden internal GitHub Actions by @anthonyshew in https://github.com/vercel/turborepo/pull/12714
• ci: Harden release workflow handling by @anthonyshew in https://github.com/vercel/turborepo/pull/12715
• fix: Preserve lockfiles during dry-run conversion by @anthonyshew in https://github.com/vercel/turborepo/pull/12717
• ci: Fix LSP workflow container matrix by @anthonyshew in https://github.com/vercel/turborepo/pull/12718

New Contributors

• @mattjoll made their first contribution in https://github.com/vercel/turborepo/pull/12655

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.8...v2.9.9

<!-- Release notes generated using configuration in .github/release.yml at v2.9.8 -->

What's Changed

@turbo/repository

• chore: Update to Rust 1.95.0 by @ognevny in https://github.com/vercel/turborepo/pull/12636

Changelog

• release(turborepo): 2.9.7 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12679
• test: Add regression for gitignored output restore by @anthonyshew in https://github.com/vercel/turborepo/pull/12681
• docs: Clarify root task guidance by @anthonyshew in https://github.com/vercel/turborepo/pull/12683
• fix: Preserve concrete dependency precedence by @anthonyshew in https://github.com/vercel/turborepo/pull/12682
• release(turborepo): 2.9.8-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12685
• fix: Resolve Yarn catalog affected packages by @anthonyshew in https://github.com/vercel/turborepo/pull/12684
• release(turborepo): 2.9.8-canary.2 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12687
• fix: Preserve Bun prune lockfile validity by @anthonyshew in https://github.com/vercel/turborepo/pull/12686
• release(turborepo): 2.9.8-canary.3 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12689
• fix: Create prune docker bin stubs by @anthonyshew in https://github.com/vercel/turborepo/pull/12688
• release(turborepo): 2.9.8-canary.4 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12690
• fix: Keep tbx shell connections stable by @anthonyshew in https://github.com/vercel/turborepo/pull/12692
• perf: Reduce turbo watch hash memory spikes by @anthonyshew in https://github.com/vercel/turborepo/pull/12695
• release(turborepo): 2.9.8-canary.5 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12696
• fix: Reduce parent-death watchdog CPU usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12697
• release(turborepo): 2.9.8-canary.6 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12698

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.7...v2.9.8

<!-- Release notes generated using configuration in .github/release.yml at v2.9.7 -->

What's Changed

eslint

• chore: Upgrade dependencies to resolve their known vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/12604

Examples

• feat(sandbox): Bump @vercel/sandbox from v1 to beta by @marc-vercel in https://github.com/vercel/turborepo/pull/12595
• chore: Update examples to Turbo 2.9.6 by @cursor[bot] in https://github.com/vercel/turborepo/pull/12600
• examples: Add Ultracite example by @haydenbleasel in https://github.com/vercel/turborepo/pull/12615

Changelog

• fix: Align Markdown docs routing with docs/md endpoints by @molebox in https://github.com/vercel/turborepo/pull/12596
• fix: Support two-dot git ranges in filter selectors by @anthonyshew in https://github.com/vercel/turborepo/pull/12599
• feat: Graceful shutdown by @anthonyshew in https://github.com/vercel/turborepo/pull/12607
• test: Add stdin EOF startup regression coverage by @anthonyshew in https://github.com/vercel/turborepo/pull/12609
• fix: Ignore SIGINT in shim after spawning local turbo by @anthonyshew in https://github.com/vercel/turborepo/pull/12612
• fix: Support pnpm v11 multi-document lockfiles by @anthonyshew in https://github.com/vercel/turborepo/pull/12616
• fix: Preserve graceful shutdown exit code by @anthonyshew in https://github.com/vercel/turborepo/pull/12620
• fix: Keep Node wrapper alive during graceful shutdown by @anthonyshew in https://github.com/vercel/turborepo/pull/12622
• fix: Preserve PTY graceful shutdown semantics by @anthonyshew in https://github.com/vercel/turborepo/pull/12624
• feat: Move Vercel auth to standard OAuth/device flows by @markandrus in https://github.com/vercel/turborepo/pull/12526
• fix: Preserve legacy Vercel auth compatibility by @anthonyshew in https://github.com/vercel/turborepo/pull/12629
• fix: Recover Vercel auth tokens across login flows by @anthonyshew in https://github.com/vercel/turborepo/pull/12631
• docs: Fix TURBO_PLATFORM_ENV_DISABLED value in docs (true, not false) by @sleitor in https://github.com/vercel/turborepo/pull/12633
• chore: Update flags SDK by @AndyBitz in https://github.com/vercel/turborepo/pull/12646
• ci: Disable AWS-backed sccache by @anthonyshew in https://github.com/vercel/turborepo/pull/12663
• fix: Prevent prune from overmatching gitignore entries by @anthonyshew in https://github.com/vercel/turborepo/pull/12662
• ci: Harden release API commits by @anthonyshew in https://github.com/vercel/turborepo/pull/12664
• ci: Fix release API commit paths by @anthonyshew in https://github.com/vercel/turborepo/pull/12665
• release(turborepo): 2.9.7-canary.14 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12666
• chore: Add tbx sandbox helper by @anthonyshew in https://github.com/vercel/turborepo/pull/12668
• fix: Allow npm registry in tbx sandboxes by @anthonyshew in https://github.com/vercel/turborepo/pull/12669
• fix: Install turbo globally in tbx base by @anthonyshew in https://github.com/vercel/turborepo/pull/12670
• docs: Clarify package hash file inputs by @anthonyshew in https://github.com/vercel/turborepo/pull/12671
• fix: Allow tbx sandboxes to use stale bases by @anthonyshew in https://github.com/vercel/turborepo/pull/12672
• fix: Install dotfiles during tbx base refresh by @anthonyshew in https://github.com/vercel/turborepo/pull/12673
• fix: Improve tbx sandbox startup by @anthonyshew in https://github.com/vercel/turborepo/pull/12674
• fix: Improve tbx sandbox startup defaults by @anthonyshew in https://github.com/vercel/turborepo/pull/12675
• fix: Support pnpm 11 flat patch lockfiles by @anthonyshew in https://github.com/vercel/turborepo/pull/12676
• docs: Fix link to passthrough variables source code by @Wartijn in https://github.com/vercel/turborepo/pull/12643
• release(turborepo): 2.9.7-canary.15 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12677
• fix: Avoid rerunning non-cacheable watch dependencies by @anthonyshew in https://github.com/vercel/turborepo/pull/12678

New Contributors

• @marc-vercel made their first contribution in https://github.com/vercel/turborepo/pull/12595
• @cursor[bot] made their first contribution in https://github.com/vercel/turborepo/pull/12600
• @markandrus made their first contribution in https://github.com/vercel/turborepo/pull/12526
• @AndyBitz made their first contribution in https://github.com/vercel/turborepo/pull/12646
• @Wartijn made their first contribution in https://github.com/vercel/turborepo/pull/12643

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.6...v2.9.7

<!-- Release notes generated using configuration in .github/release.yml at v2.9.6 -->

What's Changed

create-turbo

• chore: Update dependencies found in audits by @anthonyshew in https://github.com/vercel/turborepo/pull/12586

Examples

• fix: Add missing @types/node to with-svelte example apps by @anthonyshew in https://github.com/vercel/turborepo/pull/12585

Changelog

• docs: Add Bun equivalent for updating dependencies by @anthonyshew in https://github.com/vercel/turborepo/pull/12580
• fix: Mention turbo.json in concurrency error message by @anthonyshew in https://github.com/vercel/turborepo/pull/12582
• fix: Surface actionable message when remote cache is requested but not linked by @anthonyshew in https://github.com/vercel/turborepo/pull/12584
• chore: Delete agents app by @anthonyshew in https://github.com/vercel/turborepo/pull/12587
• fix: Load custom CA certificates in fast webpki-only HTTP client by @anthonyshew in https://github.com/vercel/turborepo/pull/12591
• docs: Remove pre-release badges by @anthonyshew in https://github.com/vercel/turborepo/pull/12592

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.5...v2.9.6

<!-- Release notes generated using configuration in .github/release.yml at v2.9.5 -->

What's Changed

create-turbo

• feat: Replace package manager commands in scaffolded README files by @DependerKumarSoni in https://github.com/vercel/turborepo/pull/6747

@turbo/telemetry

• fix: Suppress telemetry alert when running on Vercel by @anthonyshew in https://github.com/vercel/turborepo/pull/12576

Changelog

• feat: Add circular package dependency detection to boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/12567
• perf: Increase remote cache upload chunk size from 8KB to 256KB by @anthonyshew in https://github.com/vercel/turborepo/pull/12568
• perf: Parallelize boundaries checking with Rayon and cache DFS traversals by @anthonyshew in https://github.com/vercel/turborepo/pull/12569

New Contributors

• @DependerKumarSoni made their first contribution in https://github.com/vercel/turborepo/pull/6747

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.4...v2.9.5

<!-- Release notes generated using configuration in .github/release.yml at v2.9.4 -->

What's Changed

@turbo/codemod

• fix: Always update $schema URL to versioned format during migration by @anthonyshew in https://github.com/vercel/turborepo/pull/12529
• fix: Support turbo.jsonc in codemod transforms by @anthonyshew in https://github.com/vercel/turborepo/pull/12532
• fix: Preserve prerelease info in schema URL during codemod migration by @anthonyshew in https://github.com/vercel/turborepo/pull/12542

Examples

• build(deps): Bump @xmldom/xmldom from 0.8.11 to 0.8.12 in /examples/with-react-native-web by @dependabot[bot] in https://github.com/vercel/turborepo/pull/12537

Changelog

• feat: Add incremental task caching by @anthonyshew in https://github.com/vercel/turborepo/pull/12531
• docs: Send siteId as label on feedback GitHub issues by @molebox in https://github.com/vercel/turborepo/pull/12527
• Replace local ai-agent-detection with @vercel/agent-readability by @molebox in https://github.com/vercel/turborepo/pull/12528
• fix: Prevent filterUsingTasks --filter from pulling dependents into Task Graph by @anthonyshew in https://github.com/vercel/turborepo/pull/12535
• fix: Only enforce signature key length for keys that exist by @anthonyshew in https://github.com/vercel/turborepo/pull/12538
• fix: Validate engine concurrency after task-level filtering by @anthonyshew in https://github.com/vercel/turborepo/pull/12540
• feat: Allow --affected and --filter to be combined by @anthonyshew in https://github.com/vercel/turborepo/pull/12543
• fix(config): Deep-merge nested OTEL config across priority sources by @bitttttten in https://github.com/vercel/turborepo/pull/12513
• fix: Retain microfrontend proxy tasks when using filterUsingTasks by @anthonyshew in https://github.com/vercel/turborepo/pull/12545
• fix: Bun workspace lockfile pruning producing invalid output by @JRoy in https://github.com/vercel/turborepo/pull/12548
• fix: Respect dirty .gitignore patterns during task input hashing by @anthonyshew in https://github.com/vercel/turborepo/pull/12557

New Contributors

• @JRoy made their first contribution in https://github.com/vercel/turborepo/pull/12548

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.3...v2.9.4

<!-- Release notes generated using configuration in .github/release.yml at v2.9.3 -->

What's Changed

Changelog

• fix: Preserve per-workspace lockfiles during pnpm pruning by @anthonyshew in https://github.com/vercel/turborepo/pull/12519

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.2...v2.9.3

<!-- Release notes generated using configuration in .github/release.yml at v2.9.2 -->

What's Changed

Examples

• feat(examples): Add Next.js + Elysia full-stack starter template by @eastgold15 in https://github.com/vercel/turborepo/pull/12414

Changelog

• docs: Add documentation for cacheMaxAge and cacheMaxSize options by @anthonyshew in https://github.com/vercel/turborepo/pull/12500
• fix: Resolve correct nested bun lockfile versions during prune by @anthonyshew in https://github.com/vercel/turborepo/pull/12506
• Revert "fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes" by @anthonyshew in https://github.com/vercel/turborepo/pull/12507
• fix: Unblock watch loop so interruptible persistent tasks restart on file changes by @anthonyshew in https://github.com/vercel/turborepo/pull/12509
• fix(api-client): Treat * as wildcard in preflight Access-Control-Allow-Headers by @bitttttten in https://github.com/vercel/turborepo/pull/12503
• docs: Document turbo.* generator variables by @anthonyshew in https://github.com/vercel/turborepo/pull/12511
• fix: Backfill missing pnpm workspace importer entries during prune by @anthonyshew in https://github.com/vercel/turborepo/pull/12514
• fix: Include transitive dependencies in engine graph pruning for affected paths using Task Graph by @anthonyshew in https://github.com/vercel/turborepo/pull/12516
• fix: Update AI-generated response disclaimer to include human attribution by @Copilot in https://github.com/vercel/turborepo/pull/12517
• fix: Preserve shallow install strategy during npm lockfile pruning by @anthonyshew in https://github.com/vercel/turborepo/pull/12520

New Contributors

• @eastgold15 made their first contribution in https://github.com/vercel/turborepo/pull/12414

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.1...v2.9.2

<!-- Release notes generated using configuration in .github/release.yml at v2.9.1 -->

What's Changed

@turbo/codemod

• feat: Handle package manager catalogs in migration codemod by @anthonyshew in https://github.com/vercel/turborepo/pull/12496

@turbo/repository

• feat: Add cacheMaxAge and cacheMaxSize for local cache eviction by @anthonyshew in https://github.com/vercel/turborepo/pull/12487

Changelog

• docs: Release post for 2.9 by @anthonyshew in https://github.com/vercel/turborepo/pull/12441

Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.0...v2.9.1

<!-- Release notes generated using configuration in .github/release.yml at v2.9.0 -->

What's Changed

Docs

• docs: Release post for 2.8 by @anthonyshew in https://github.com/vercel/turborepo/pull/11559
• docs: Update oxc.mdx to include cache false by @bestickley in https://github.com/vercel/turborepo/pull/11571
• docs: Fix curl markdown Accept header syntax in 2.8 release blog by @marko-hologram in https://github.com/vercel/turborepo/pull/11580
• docs: Fix worktree command in blog post by @anthonyshew in https://github.com/vercel/turborepo/pull/11583
• docs: Rename command → subcommand by @anthonyshew in https://github.com/vercel/turborepo/pull/11584
• feat: Add requestType tracking for header-negotiated markdown by @molebox in https://github.com/vercel/turborepo/pull/11585
• fix: Upgrade next to fix HTTP deserialization DoS by @anthonyshew in https://github.com/vercel/turborepo/pull/11597
• fix: Upgrade mermaid to fix lodash-es vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11611
• fix: Upgrade recharts to fix lodash vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11606
• chore: Move applications to apps/ directory by @anthonyshew in https://github.com/vercel/turborepo/pull/11613
• fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11616
• chore: Migrate to Ultracite by @haydenbleasel in https://github.com/vercel/turborepo/pull/11948
• fix: Strip JSX components from heading anchors and TOC entries by @anthonyshew in https://github.com/vercel/turborepo/pull/12404

create-turbo

• fix: Upgrade tsup to fix rollup and glob vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11601
• fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11622
• fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11623
• feat: Migrate from tsup to tsdown by @anthonyshew in https://github.com/vercel/turborepo/pull/11649
• fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11683
• fix: Upgrade inquirer to remove lodash dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/11709
• fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11702
• fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11706
• fix: Recover version numbering to 2.8.9-canary.0 by @anthonyshew in https://github.com/vercel/turborepo/pull/11853
• fix: Sanitize git command inputs in create-turbo by @anthonyshew in https://github.com/vercel/turborepo/pull/11876
• chore: Remove pnpm-eslint .vscode transform from create-turbo by @anthonyshew in https://github.com/vercel/turborepo/pull/12186
• fix: Improve create-turbo connectivity check and offline error messages by @anthonyshew in https://github.com/vercel/turborepo/pull/12257
• feat: Add affectedUsingTaskInputs future flag for task-level --affected detection by @anthonyshew in https://github.com/vercel/turborepo/pull/12247
• fix: Replace dns.lookup with https.get for create-turbo online check by @anthonyshew in https://github.com/vercel/turborepo/pull/12277
• fix: Remove redundant online check from create-turbo by @anthonyshew in https://github.com/vercel/turborepo/pull/12281
• fix: Sort uninstalled package managers to bottom of create-turbo selection by @anthonyshew in https://github.com/vercel/turborepo/pull/12353

turbo-ignore

• fix: Resolve pnpm audit vulnerabilities via dependency bumps by @anthonyshew in https://github.com/vercel/turborepo/pull/12220
• feat: Deprecate turbo-ignore in favor of turbo query affected by @anthonyshew in https://github.com/vercel/turborepo/pull/12382
• fix: Tailored turbo-ignore deprecation notice for Vercel users by @anthonyshew in https://github.com/vercel/turborepo/pull/12385

@turbo/codemod

• fix: Upgrade axios to fix SSRF vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11599
• fix: Replace axios with native fetch in turbo-codemod by @anthonyshew in https://github.com/vercel/turborepo/pull/11600
• fix: Upgrade diff to fix DoS vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11621
• fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11766
• fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11765
• fix: Enhance path validation in assertSafeGitArgument by @odaysec in https://github.com/vercel/turborepo/pull/11788
• fix: Guard against missing pipeline key in clean-globs codemod by @anthonyshew in https://github.com/vercel/turborepo/pull/12235
• fix: Stop add-package-names codemod from silently renaming existing packages by @anthonyshew in https://github.com/vercel/turborepo/pull/12332
• fix: Handle Yarn 2+ in @turbo/codemod install commands by @anthonyshew in https://github.com/vercel/turborepo/pull/12477

eslint

• fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11610
• fix: Upgrade esbuild to fix arbitrary request vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11615
• fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11681
• fix: Upgrade eslint to v10 to resolve @eslint/plugin-kit ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11705
• fix(eslint-plugin-turbo): Guard against missing tasks/pipeline in forEachTaskDef by @sleitor in https://github.com/vercel/turborepo/pull/12411

@turbo/repository

• fix: Rename cli workspace package to avoid false audit match by @anthonyshew in https://github.com/vercel/turborepo/pull/11767
• perf: Defer TLS initialization to a background thread by @anthonyshew in https://github.com/vercel/turborepo/pull/11967
• fix: Add repository field to @turbo/repository package.json by @anthonyshew in https://github.com/vercel/turborepo/pull/11982
• release(library): 0.0.1-canary.19 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/11983
• feat: Add experimentalObservability with an OTel backend by @bkonkle in https://github.com/vercel/turborepo/pull/11130
• release(library): 0.0.1-canary.20 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12116
• chore: Update to Rust 1.94.0 by @ognevny in https://github.com/vercel/turborepo/pull/12192
• feat: Add packagesFromLockfile() NAPI binding to @turbo/repository by @anthonyshew in https://github.com/vercel/turborepo/pull/12454
• release(library): 0.0.1-canary.21 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12455

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in https://github.com/vercel/turborepo/pull/11591
• fix: escaping for link titles in LinksService by @odaysec in https://github.com/vercel/turborepo/pull/11632
• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in https://github.com/vercel/turborepo/pull/11679
• docs: Replace mysql refs with postgres by @kyedavey in https://github.com/vercel/turborepo/pull/11827
• feat: Add with-otel example with pre-configured Grafana dashboard by @anthonyshew in https://github.com/vercel/turborepo/pull/12043
• examples: Upgrade with-react-native-web example to use latest versions by @serjooo in https://github.com/vercel/turborepo/pull/12085
• fix: Duplicate /signup? in Vercel URL by @04cb in https://github.com/vercel/turborepo/pull/12088
• examples: Fix markdown links inside code blocks in basic README by @sleitor in https://github.com/vercel/turborepo/pull/11946
• fix: Match vite and @vitejs/plugin-react versions on example by @GabrielBB in https://github.com/vercel/turborepo/pull/12193
• fix: Sync yarn lockfile before upgrading turbo in examples updater by @anthonyshew in https://github.com/vercel/turborepo/pull/12286
• chore: Upgrade Next.js to 16.2.0 in examples and apps by @anthonyshew in https://github.com/vercel/turborepo/pull/12389
• fix(examples): Update of with-svelte example by @floriansalihovic in https://github.com/vercel/turborepo/pull/11952
• fix: Use script-shell=bash for cross-platform with-shell-commands example by @Goldyvaiiii in https://github.com/vercel/turborepo/pull/12436

Changelog

• fix: Support trailing commas in microfrontends JSONC files by @anthonyshew in https://github.com/vercel/turborepo/pull/11573
• perf: Replace third-party crates with Rust std lib equivalents by @anthonyshew in https://github.com/vercel/turborepo/pull/11569
• perf: Reduce duplicate dependency versions by @anthonyshew in https://github.com/vercel/turborepo/pull/11568
• chore: Remove legacy Go/goreleaser buildcontainer directory by @anthonyshew in https://github.com/vercel/turborepo/pull/11576
• chore: Rename README.md to RULE.md in skills directory by @anthonyshew in https://github.com/vercel/turborepo/pull/11582
• fix: Validate turbo version from lockfile for all package managers by @anthonyshew in https://github.com/vercel/turborepo/pull/11587
• fix: Add allowComments and allowTrailingCommas to turbo.json schema by @ddmoney420 in https://github.com/vercel/turborepo/pull/11579
• chore: Eliminate ts-rs serde attribute parse warnings by @anthonyshew in https://github.com/vercel/turborepo/pull/11589
• fix: Extract git argument validation into reusable helper by @anthonyshew in https://github.com/vercel/turborepo/pull/11593
• fix: Upgrade fast-xml-parser to fix RangeError DoS by @anthonyshew in https://github.com/vercel/turborepo/pull/11598
• fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11596
• fix: Upgrade tar to fix security vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11602
• fix: Upgrade @actions/github to fix @octokit vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11607
• fix: Upgrade @vercel/blob and @actions packages to fix undici vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11608
• docs: Running Root Tasks by @Netail in https://github.com/vercel/turborepo/pull/11630
• Update README.md title and remove features section by @anthonyshew in https://github.com/vercel/turborepo/pull/11651
• docs: Update using-environment-variables.mdx by @anthonyshew in https://github.com/vercel/turborepo/pull/11652
• fix: Upgrade js-yaml to address CVE-2025-64718 by @alexmkio in https://github.com/vercel/turborepo/pull/11650
• fix: Remove smooth scrolling from docs by @anthonyshew in https://github.com/vercel/turborepo/pull/11654
• fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @anthonyshew in https://github.com/vercel/turborepo/pull/11655
• fix: Upgrade capnp to 0.24 by @anthonyshew in https://github.com/vercel/turborepo/pull/11656
• fix: Upgrade h2 to fix CONTINUATION Flood by @anthonyshew in https://github.com/vercel/turborepo/pull/11658
• fix: Upgrade crossbeam-channel to 0.5.15 by @anthonyshew in https://github.com/vercel/turborepo/pull/11657
• chore: Remove abandoned turbo clone command by @anthonyshew in https://github.com/vercel/turborepo/pull/11673
• fix: Upgrade rustls and ring by @anthonyshew in https://github.com/vercel/turborepo/pull/11659
• fix: Upgrade openssl to 0.10.75 by @anthonyshew in https://github.com/vercel/turborepo/pull/11660
• fix: Replace unmaintained adler with adler2 by @anthonyshew in https://github.com/vercel/turborepo/pull/11661
• fix: Upgrade tar to 7.5.7 to address security vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11680
• fix: Upgrade ts-json-schema-generator to fix glob command injection vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11684
• fix: Upgrade fumadocs and shiki in docs to resolve mdast-util-to-hast vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11704
• fix: Replace ts-node with tsx to resolve diff DoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11708
• fix: Upgrade bytes to >=1.11.1 to fix RUSTSEC-2026-0007 by @anthonyshew in https://github.com/vercel/turborepo/pull/11715
• chore: Update ratatui dependencies (paste blocked upstream) by @anthonyshew in https://github.com/vercel/turborepo/pull/11717
• Revert "chore: Update ratatui dependencies (paste blocked upstream)" by @anthonyshew in https://github.com/vercel/turborepo/pull/11722
• fix: Upgrade ratatui to 0.30.0 to drop unmaintained paste crate by @anthonyshew in https://github.com/vercel/turborepo/pull/11723
• chore: Upgrade reqwest toward addressing RUSTSEC-2025-0134 by @anthonyshew in https://github.com/vercel/turborepo/pull/11718
• fix(docs): Fix code syntax highlighting by using correct Shiki CSS variable names by @anthonyshew in https://github.com/vercel/turborepo/pull/11726
• fix: Upgrade async-io to 2.x to drop unmaintained instant crate by @anthonyshew in https://github.com/vercel/turborepo/pull/11719
• fix: Migrate from unmaintained serde_yaml to serde_yml by @anthonyshew in https://github.com/vercel/turborepo/pull/11720
• fix: Upgrade test-case and merge to drop unmaintained proc-macro-error by @anthonyshew in https://github.com/vercel/turborepo/pull/11721
• fix: Upgrade indicatif to 0.18.3 to drop unmaintained number_prefix by @anthonyshew in https://github.com/vercel/turborepo/pull/11716
• refactor: Centralize configuration resolution funnel by @anthonyshew in https://github.com/vercel/turborepo/pull/11727
• fix: Upgrade rustls chain to resolve RUSTSEC-2025-0134 by @anthonyshew in https://github.com/vercel/turborepo/pull/11739
• fix: Upgrade test-case to resolve transitive proc-macro-error by @anthonyshew in https://github.com/vercel/turborepo/pull/11737
• fix: Upgrade pest/pest_derive to resolve yanked version by @anthonyshew in https://github.com/vercel/turborepo/pull/11734
• fix: Upgrade git2 to fix RUSTSEC-2026-0008 by @anthonyshew in https://github.com/vercel/turborepo/pull/11729
• fix: Upgrade pprof to fix RUSTSEC-2024-0408 by @anthonyshew in https://github.com/vercel/turborepo/pull/11730
• fix: Upgrade portable-pty to resolve RUSTSEC-2017-0008 by @anthonyshew in https://github.com/vercel/turborepo/pull/11732
• fix: Upgrade oxc_resolver to resolve yanked papaya dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/11733
• fix: Upgrade futures/futures-util to resolve yanked futures-util 0.3.30 by @anthonyshew in https://github.com/vercel/turborepo/pull/11735
• fix: Replace unic-segment with unicode-segmentation in globwatch by @anthonyshew in https://github.com/vercel/turborepo/pull/11736
• fix: Replace serde_yml with serde_yaml_ng to fix RUSTSEC-2025-0067/0068 by @anthonyshew in https://github.com/vercel/turborepo/pull/11755
• fix: Replace oxc_resolver with unrs_resolver to fix yanked papaya dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/11754
• fix: Upgrade node-plop to 0.32.3 by @anthonyshew in https://github.com/vercel/turborepo/pull/11756
• docs: Capitalizaiton in update github-actions.mdx by @anthonyshew in https://github.com/vercel/turborepo/pull/11762
• fix: Add Vary: Accept header to docs markdown endpoint by @molebox in https://github.com/vercel/turborepo/pull/11759
• chore: Agentic workflows app by @anthonyshew in https://github.com/vercel/turborepo/pull/11773
• chore: Add internal agents app for repo automation by @anthonyshew in https://github.com/vercel/turborepo/pull/11776
• chore: Update reproduction request message by @anthonyshew in https://github.com/vercel/turborepo/pull/11778
• Revert "fix: Upgrade node-plop to 0.32.3" by @anthonyshew in https://github.com/vercel/turborepo/pull/11780
• chore: Add internal agents app for repo automation by @anthonyshew in https://github.com/vercel/turborepo/pull/11781
• feat: Add internal agents app for repo automation by @anthonyshew in https://github.com/vercel/turborepo/pull/11783
• chore: Manual audits by @anthonyshew in https://github.com/vercel/turborepo/pull/11785
• chore: Fixing audit agent by @anthonyshew in https://github.com/vercel/turborepo/pull/11786
• chore: Still iterating on sec audit fixer by @anthonyshew in https://github.com/vercel/turborepo/pull/11787
• fix: Emit space for empty vt100 cells to fix TUI repaint on task switch by @anthonyshew in https://github.com/vercel/turborepo/pull/11789
• fix: Keep stdin alive for persistent tasks in stream mode by @anthonyshew in https://github.com/vercel/turborepo/pull/11793
• feat: Add internal agents app for repo automation by @anthonyshew in https://github.com/vercel/turborepo/pull/11799
• chore: Add env vars by @anthonyshew in https://github.com/vercel/turborepo/pull/11800
• fix: Handle subpath package imports in turbo boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/11798
• feat: Add dashboard with run tracking and live logs for agent sandboxes by @anthonyshew in https://github.com/vercel/turborepo/pull/11802
• fix: Normalize bare LF to CRLF in TUI output to prevent garbled logs by @anthonyshew in https://github.com/vercel/turborepo/pull/11804
• fix: Use private blob store access in agents app by @anthonyshew in https://github.com/vercel/turborepo/pull/11811
• fix: Pass non-empty body when initializing blob log files by @anthonyshew in https://github.com/vercel/turborepo/pull/11812
• docs: Geistdocs update by @haydenbleasel in https://github.com/vercel/turborepo/pull/11807
• fix: Allow overwriting existing blobs in run updates and log appends by @anthonyshew in https://github.com/vercel/turborepo/pull/11813
• docs: Geistdocs update 2 by @haydenbleasel in https://github.com/vercel/turborepo/pull/11814
• fix: Set 5-hour timeout on security audit sandbox by @anthonyshew in https://github.com/vercel/turborepo/pull/11815
• fix: Resolve Windows TUI hang caused by portable-pty 0.9.0 ConPTY changes by @anthonyshew in https://github.com/vercel/turborepo/pull/11816
• fix: Repair audit fixer log streaming and replace git push with patch upload by @anthonyshew in https://github.com/vercel/turborepo/pull/11818
• chore: Small stuff for agent fixer by @anthonyshew in https://github.com/vercel/turborepo/pull/11819
• chore: Bump tonic to 0.14 by @anthonyshew in https://github.com/vercel/turborepo/pull/11820
• fix: Pin @turbo/gen version to match the running turbo binary by @anthonyshew in https://github.com/vercel/turborepo/pull/11822
• fix: Use secret_key_override in tests to eliminate env var race condition by @anthonyshew in https://github.com/vercel/turborepo/pull/11824
• fix: Avoid panic in sandboxed environments by removing system-configuration dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/11828
• fix: Harden token protection with secrecy crate and close exposure gaps by @anthonyshew in https://github.com/vercel/turborepo/pull/11831
• fix: Clean up orphaned Windows child processes on shutdown by @anthonyshew in https://github.com/vercel/turborepo/pull/11829
• chore: Update lockfile for release by @anthonyshew in https://github.com/vercel/turborepo/pull/11840
• fix: Sync lockfile with @turbo/gen optionalDependencies by @anthonyshew in https://github.com/vercel/turborepo/pull/11845
• docs: Update Vitest guide with projects configuration by @PeterPCW in https://github.com/vercel/turborepo/pull/11760
• fix: Prevent premature git tag push during release staging by @anthonyshew in https://github.com/vercel/turborepo/pull/11851
• fix: Replace unsafe pre_exec/setsid with tokio process_group(0) by @anthonyshew in https://github.com/vercel/turborepo/pull/11854
• fix: Resolve external npm packages in @turbo/gen compiled binary (#11855) by @anthonyshew in https://github.com/vercel/turborepo/pull/11856
• fix: Move node-plop to dependencies so PlopTypes resolves for consumers by @anthonyshew in https://github.com/vercel/turborepo/pull/11862
• chore: Use 2024 edition in more packages, do not ignore some clippy l… by @ognevny in https://github.com/vercel/turborepo/pull/11860
• perf: Optimize hot-path hash computation by avoiding clones and using unstable sorts by @anthonyshew in https://github.com/vercel/turborepo/pull/11872
• perf: Replace twox-hash with xxhash-rust and optimize file hashing by @anthonyshew in https://github.com/vercel/turborepo/pull/11874
• fix: Restrict credential file permissions to owner-only by @anthonyshew in https://github.com/vercel/turborepo/pull/11870
• perf: Reduce allocations in globwalk by @anthonyshew in https://github.com/vercel/turborepo/pull/11528
• perf: Replace O(V³) Floyd-Warshall with O(V+E) DFS in watch mode subgraph creation by @anthonyshew in https://github.com/vercel/turborepo/pull/11878
• feat: Generate LLM-friendly markdown alongside --profile trace output by @anthonyshew in https://github.com/vercel/turborepo/pull/11880
• feat: Make --profile and --anon-profile filename optional by @anthonyshew in https://github.com/vercel/turborepo/pull/11883
• perf: Batch per-package git subprocess calls into repo-wide index by @anthonyshew in https://github.com/vercel/turborepo/pull/11887
• perf: Parallelize and pre-build RepoGitIndex by @anthonyshew in https://github.com/vercel/turborepo/pull/11889
• perf: Pre-compile glob exclusion filter and cache path prefix in file hashing by @anthonyshew in https://github.com/vercel/turborepo/pull/11891
• fix: Get all pnpm lockfile pruning tests passing by @anthonyshew in https://github.com/vercel/turborepo/pull/11897
• perf: Optimize pnpm lockfile transitive closure resolution by @anthonyshew in https://github.com/vercel/turborepo/pull/11898
• fix: Resolve npm packages in @turbo/gen compiled binary by @anthonyshew in https://github.com/vercel/turborepo/pull/11900
• perf: Deduplicate file hashing and parallelize globwalks by @anthonyshew in https://github.com/vercel/turborepo/pull/11902
• perf: Improve transitive dependency resolution cache sharing across workspaces by @anthonyshew in https://github.com/vercel/turborepo/pull/11903
• perf: Reduce filesystem syscalls in globwalk, SCM hashing, and task scheduling by @anthonyshew in https://github.com/vercel/turborepo/pull/11907
• feat: Remove daemon from turbo run, deprecate daemon flags and config by @anthonyshew in https://github.com/vercel/turborepo/pull/11910
• test: Replace help text integration tests with insta snapshots by @anthonyshew in https://github.com/vercel/turborepo/pull/11911
• perf: Reduce allocations in SCM hashing, glob preprocessing, and cache lookups by @anthonyshew in https://github.com/vercel/turborepo/pull/11916
• perf: Parallelize package.json loading and reduce builder allocations by @anthonyshew in https://github.com/vercel/turborepo/pull/11918
• perf: Cache compiled env wildcard regexes for builtin pass-through patterns by @anthonyshew in https://github.com/vercel/turborepo/pull/11920
• perf: Replace O(N) workspace path lookup with HashMap index in DependencySplitter by @anthonyshew in https://github.com/vercel/turborepo/pull/11922
• perf: Parallelize lockfile parsing with workspace discovery by @anthonyshew in https://github.com/vercel/turborepo/pull/11927
• perf: Optimize turbo run hotpath with parallelization and reduced allocations by @anthonyshew in https://github.com/vercel/turborepo/pull/11928
• perf: Share HTTP client and improve profile instrumentation by @anthonyshew in https://github.com/vercel/turborepo/pull/11929
• perf: Share HTTP client and improve profile instrumentation by @anthonyshew in https://github.com/vercel/turborepo/pull/11932
• perf: Reduce git subprocess calls on startup by @anthonyshew in https://github.com/vercel/turborepo/pull/11934
• chore: Upgrade zstd 0.12.3 to 0.13.3 by @anthonyshew in https://github.com/vercel/turborepo/pull/11936
• perf: Replace git subprocesses with libgit2 and skip unnecessary summary work by @anthonyshew in https://github.com/vercel/turborepo/pull/11938
• perf: Reduce per-package hashing overhead and eliminate SCM subprocesses by @anthonyshew in https://github.com/vercel/turborepo/pull/11942
• perf: Reduce CPU overhead in turbo run hot path by @anthonyshew in https://github.com/vercel/turborepo/pull/11947
• perf: Replace libgit2 git status with gix-index for faster file hashing by @anthonyshew in https://github.com/vercel/turborepo/pull/11950
• perf: Resolve literal input paths via stat instead of glob walk by @anthonyshew in https://github.com/vercel/turborepo/pull/11955
• perf: Optimize engine builder, task visitor, and untracked file discovery by @anthonyshew in https://github.com/vercel/turborepo/pull/11956
• perf: Parallelize turbo run pre-execution hot path by @anthonyshew in https://github.com/vercel/turborepo/pull/11958
• chore: Add tracing spans to uninstrumented hot path functions by @anthonyshew in https://github.com/vercel/turborepo/pull/11959
• perf: Use Arc<str> for task dependency hashes to avoid heap clones by @anthonyshew in https://github.com/vercel/turborepo/pull/11962
• perf: Add more tracing spans into startup path by @anthonyshew in https://github.com/vercel/turborepo/pull/11965
• perf: Parallelize task hash computation across topological waves by @anthonyshew in https://github.com/vercel/turborepo/pull/11969
• perf: Send engine callback before tracker bookkeeping and add tracing spans by @anthonyshew in https://github.com/vercel/turborepo/pull/11970
• fix: Resolve git_root to worktree root in linked worktrees by @anthonyshew in https://github.com/vercel/turborepo/pull/11974
• perf: Fast path for shallow wildcard glob patterns in workspace discovery by @anthonyshew in https://github.com/vercel/turborepo/pull/11972
• chore: Move git hooks from pre-commit to pre-push and match CI lint checks by @anthonyshew in https://github.com/vercel/turborepo/pull/11977
• chore: Update AGENTS.md by @anthonyshew in https://github.com/vercel/turborepo/pull/11978
• perf: Replace heap-allocated String with stack-allocated OidHash for git OIDs by @anthonyshew in https://github.com/vercel/turborepo/pull/11984
• perf: Eliminate redundant syscalls in FSCache fetch and exists by @anthonyshew in https://github.com/vercel/turborepo/pull/11985
• perf: Reduce per-task allocations in visitor dispatch loop by @anthonyshew in https://github.com/vercel/turborepo/pull/11986
• docs: Fix same-page anchor links that don't scroll to target by @anthonyshew in https://github.com/vercel/turborepo/pull/11989
• docs: Mention inputs key in package hash inputs table by @anthonyshew in https://github.com/vercel/turborepo/pull/11990
• fix(docs): update sitemap.md to single-line pipe-delimited format by @molebox in https://github.com/vercel/turborepo/pull/11976
• fix: Disable husky pre-push hook during release staging by @anthonyshew in https://github.com/vercel/turborepo/pull/11991
• fix: Use versioned schema URLs in Turborepo skill files by @anthonyshew in https://github.com/vercel/turborepo/pull/11994
• fix: Restore daemon client in RunCache for turbo watch by @anthonyshew in https://github.com/vercel/turborepo/pull/11995
• chore: Reduce compile times by deduplicating thiserror and itertools by @anthonyshew in https://github.com/vercel/turborepo/pull/12000
• chore: Upgrade axum 0.7 to 0.8, deduplicate tower/tower-http by @anthonyshew in https://github.com/vercel/turborepo/pull/12003
• fix: Prevent peerDependencies from overwriting concrete dependency specifiers by @anthonyshew in https://github.com/vercel/turborepo/pull/12004
• fix: Resolve correct nested package version in bun lockfile pruning by @anthonyshew in https://github.com/vercel/turborepo/pull/12008
• fix: Resolve all lockfile pruning test failures by @anthonyshew in https://github.com/vercel/turborepo/pull/12009
• perf: Extract query module into turborepo-query crate by @anthonyshew in https://github.com/vercel/turborepo/pull/12007
• refactor: Migrate dry-json prysk tests to Rust + insta snapshots by @anthonyshew in https://github.com/vercel/turborepo/pull/12010
• perf: Deduplicate petgraph, fixedbitset, and dashmap by @anthonyshew in https://github.com/vercel/turborepo/pull/12011
• refactor: Migrate persistent-dependencies and task-dependencies to Rust + insta by @anthonyshew in https://github.com/vercel/turborepo/pull/12012
• test: Add lockfile-tests fixture for issue #12013 by @anthonyshew in https://github.com/vercel/turborepo/pull/12014
• perf: Remove libgit2/git2 dependency, replace with gix-object by @anthonyshew in https://github.com/vercel/turborepo/pull/12015
• refactor: Migrate daemon, jsonc, query, edit-turbo-json tests to Rust by @anthonyshew in https://github.com/vercel/turborepo/pull/12016
• perf: Remove async-graphql from turborepo-lib by @anthonyshew in https://github.com/vercel/turborepo/pull/12017
• refactor: Migrate inference and run-logging tests to Rust by @anthonyshew in https://github.com/vercel/turborepo/pull/12018
• refactor: Migrate run-caching and strict-env-vars tests to Rust by @anthonyshew in https://github.com/vercel/turborepo/pull/12020
• fix: Mark lockfile-aware-caching/bun prysk test as flaky by @anthonyshew in https://github.com/vercel/turborepo/pull/12021
• fix: Add nextest retries for flaky tests by @anthonyshew in https://github.com/vercel/turborepo/pull/12027
• refactor: Migrate prune and run-summary tests to Rust by @anthonyshew in https://github.com/vercel/turborepo/pull/12022
• fix: Add nextest retries for flaky prysk tests by @anthonyshew in https://github.com/vercel/turborepo/pull/12030
• fix: Add nextest retries for flaky prune_test::test_prune_composable_config by @anthonyshew in https://github.com/vercel/turborepo/pull/12032
• fix: Suppress npm upgrade notices in Rust integration tests by @anthonyshew in https://github.com/vercel/turborepo/pull/12033
• fix: Suppress npm upgrade notices in integration tests and consolidate test helpers by @anthonyshew in https://github.com/vercel/turborepo/pull/12036
• fix: Replace flaky pnpx symlink-dir with native NTFS junctions in find-turbo test by @anthonyshew in https://github.com/vercel/turborepo/pull/12039
• fix: Prevent corepack download prompt from hanging prysk tests on Windows by @anthonyshew in https://github.com/vercel/turborepo/pull/12041
• fix: Send OTEL metrics without requiring --summarize flag by @anthonyshew in https://github.com/vercel/turborepo/pull/12042
• docs: Fix incorrect otel future flag bypass claim by @anthonyshew in https://github.com/vercel/turborepo/pull/12047
• fix: Address root causes of 9 flaky tests and remove retry workarounds by @anthonyshew in https://github.com/vercel/turborepo/pull/12045
• test: Port 6 prysk CLI tests to pure Rust by @anthonyshew in https://github.com/vercel/turborepo/pull/12048
• docs: Fix experimentalObservability config reference by @bkonkle in https://github.com/vercel/turborepo/pull/12052
• test: Port 10 more prysk tests to pure Rust by @anthonyshew in https://github.com/vercel/turborepo/pull/12051
• test: Port 14 more prysk tests to Rust (single-package + commands) by @anthonyshew in https://github.com/vercel/turborepo/pull/12054
• test: Port 13 more prysk tests to Rust by @anthonyshew in https://github.com/vercel/turborepo/pull/12057
• fix: Exclude peer dependencies from workspace external dep resolution by @anthonyshew in https://github.com/vercel/turborepo/pull/12050
• test: Port all 15 workspace-configs prysk tests to Rust by @anthonyshew in https://github.com/vercel/turborepo/pull/12058
• perf: Stream file contents during hashing to lower memory usage by @anthonyshew in https://github.com/vercel/turborepo/pull/12059
• fix: Treat npm: alias dependencies as external, not workspace references by @anthonyshew in https://github.com/vercel/turborepo/pull/12061
• test: Port 18 more prysk tests to Rust (other/ + lockfile-aware-caching/) by @anthonyshew in https://github.com/vercel/turborepo/pull/12062
• fix: Preserve file: protocol entries in pruned yarn v1 lockfile by @anthonyshew in https://github.com/vercel/turborepo/pull/12064
• perf: Use stack-allocated OidHash in FileHashes and skip expanded hashes on normal runs by @anthonyshew in https://github.com/vercel/turborepo/pull/12065
• test: Port all 8 find-turbo prysk tests to Rust by @anthonyshew in https://github.com/vercel/turborepo/pull/12066
• fix: Support pnpm per-workspace lockfiles in turbo prune by @anthonyshew in https://github.com/vercel/turborepo/pull/12067
• test: Port final 2 prysk tests to Rust (100% complete) by @anthonyshew in https://github.com/vercel/turborepo/pull/12068
• fix: Resolve Berry prune failure when resolutions contain patch overrides by @anthonyshew in https://github.com/vercel/turborepo/pull/12069
• test: Add lockfile fixture for yarn berry resolution pruning (issue #2791) by @anthonyshew in https://github.com/vercel/turborepo/pull/12071
• refactor: Clean up test infrastructure and eliminate duplication by @anthonyshew in https://github.com/vercel/turborepo/pull/12072
• fix: Retain injected workspace package entries during pnpm lockfile pruning by @anthonyshew in https://github.com/vercel/turborepo/pull/12073
• refactor: Clean up test infrastructure + improve test quality by @anthonyshew in https://github.com/vercel/turborepo/pull/12074
• perf: Speed up lockfile test suite by @anthonyshew in https://github.com/vercel/turborepo/pull/12078
• fix: Preserve file: and link: protocol entries in pruned bun lockfile by @anthonyshew in https://github.com/vercel/turborepo/pull/12076
• fix: Stop running unnecessary npm install in engines tests by @anthonyshew in https://github.com/vercel/turborepo/pull/12081
• test: Add lockfile fixture for pnpm v9 injected workspace deps (issue #8243) by @anthonyshew in https://github.com/vercel/turborepo/pull/12082
• fix: Filter orphaned Yarn packageExtensions entries during lockfile pruning by @anthonyshew in https://github.com/vercel/turborepo/pull/12084
• fix: Align experimentalObservability on object maps rather than arrays by @bkonkle in https://github.com/vercel/turborepo/pull/12089
• fix: Prevent yarn integration tests from hanging on corepack prompts by @anthonyshew in https://github.com/vercel/turborepo/pull/12090
• fix: Prevent turbo dev from hanging when daemon file watching fails by @anthonyshew in https://github.com/vercel/turborepo/pull/12091
• perf: Optimize npm lockfile parser by @anthonyshew in https://github.com/vercel/turborepo/pull/12093
• chore: Trim unused dependency features for faster compilation by @anthonyshew in https://github.com/vercel/turborepo/pull/12094
• fix: Prevent lockfile-aware yarn test from hanging on corepack downloads by @anthonyshew in https://github.com/vercel/turborepo/pull/12095
• perf: Eliminate per-directory stat syscalls in untracked file detection by @anthonyshew in https://github.com/vercel/turborepo/pull/12096
• perf: Reduce allocations in file hash computation by @anthonyshew in https://github.com/vercel/turborepo/pull/12102
• perf: Replace SWC with oxc for JS/TS parsing by @anthonyshew in https://github.com/vercel/turborepo/pull/12098
• fix: Pre-warm corepack cache to prevent yarn/pnpm tests from hanging by @anthonyshew in https://github.com/vercel/turborepo/pull/12099
• perf: Disable unused zstd default features to reduce C compilation by @anthonyshew in https://github.com/vercel/turborepo/pull/12107
• perf: Replace git subprocess in worktree detection with Rust by @anthonyshew in https://github.com/vercel/turborepo/pull/12106
• test: Add turbo watch tests and refactor file change classification by @anthonyshew in https://github.com/vercel/turborepo/pull/12119
• fix(frameworks): Also check devDependencies when inferring framework in single-package mode by @sleitor in https://github.com/vercel/turborepo/pull/12056
• test: Add boundary tests for framework inference devDependencies support by @anthonyshew in https://github.com/vercel/turborepo/pull/12122
• fix: Stabilize flaky watch_file_change_reruns_affected_package test by @anthonyshew in https://github.com/vercel/turborepo/pull/12123
• fix: Microfrontends merges with into root config instead of replacing it by @anthonyshew in https://github.com/vercel/turborepo/pull/12125
• fix: Omit None otel fields during turbo prune serialization by @bkonkle in https://github.com/vercel/turborepo/pull/12126
• fix: Correct dependency iteration order so dependencies takes precedence over devDependencies by @anthonyshew in https://github.com/vercel/turborepo/pull/12129
• perf: Skip irrelevant packages when using package#task syntax by @anthonyshew in https://github.com/vercel/turborepo/pull/12135
• fix: Use delta temporality for OTel metrics export by @bkonkle in https://github.com/vercel/turborepo/pull/12136
• fix: Wait for dependsOn on first run of turbo watch by @MrNaif2018 in https://github.com/vercel/turborepo/pull/11953
• fix: Treat Bun runtime modules as builtins in Boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/12141
• feat: Add futureFlags.longerSignatureKey to enforce minimum HMAC key length by @anthonyshew in https://github.com/vercel/turborepo/pull/12142
• feat: Add runAttributes config to OTel metrics for cardinality control by @bkonkle in https://github.com/vercel/turborepo/pull/12144
• fix: Preserve deeply nested workspace deps during npm lockfile pruning by @anthonyshew in https://github.com/vercel/turborepo/pull/12146
• fix: Ensure noUpdateNotifier from turbo.json is respected by @sleitor in https://github.com/vercel/turborepo/pull/11925
• docs: Document Yarn v1 pass-through args workaround by @anthonyshew in https://github.com/vercel/turborepo/pull/12150
• fix: Add FORCE_COLOR and NO_COLOR to builtin passthrough env vars by @anthonyshew in https://github.com/vercel/turborepo/pull/12158
• test: Add integration test coverage for --anon-profile markdown generation by @anthonyshew in https://github.com/vercel/turborepo/pull/12157
• feat: Add AI coding agent detection telemetry by @anthonyshew in https://github.com/vercel/turborepo/pull/12159
• feat: Instrument post-hashing setup phase for trace visibility by @anthonyshew in https://github.com/vercel/turborepo/pull/12160
• perf: Fire-and-forget telemetry and analytics HTTP flushes on shutdown by @anthonyshew in https://github.com/vercel/turborepo/pull/12162
• perf: Defer lockfile await until after internal dependency resolution by @anthonyshew in https://github.com/vercel/turborepo/pull/12164
• refactor: Extract turborepo-query-api trait crate for compile-time decoupling by @anthonyshew in https://github.com/vercel/turborepo/pull/12165
• feat: Include version, platform, and CPU count in Chrome trace profiles by @anthonyshew in https://github.com/vercel/turborepo/pull/12166
• docs: Remove bespoke AI prompts from documentation pages by @anthonyshew in https://github.com/vercel/turborepo/pull/12167
• test: Add comprehensive path traversal tests for cache archive by @anthonyshew in https://github.com/vercel/turborepo/pull/12169
• test: Add regression tests and OutputWatcher trait to prepare for daemon removal from turbo watch by @anthonyshew in https://github.com/vercel/turborepo/pull/12171
• feat: Remove daemon from watch mode by @anthonyshew in https://github.com/vercel/turborepo/pull/12175
• perf: Defer SCM task await to overlap with setup work by @anthonyshew in https://github.com/vercel/turborepo/pull/12177
• perf: Defer cache save to after callback to unblock dependents sooner by @anthonyshew in https://github.com/vercel/turborepo/pull/12178
• chore: Add oxfmt check to pre-push hook by @anthonyshew in https://github.com/vercel/turborepo/pull/12187
• fix: Resolve pnpm catalog: specifiers to workspace dependencies in task graph by @anthonyshew in https://github.com/vercel/turborepo/pull/12185
• perf: Avoid Unconditional HTTP Client Warmup by @anthonyshew in https://github.com/vercel/turborepo/pull/12189
• perf: Scope Repo Index Untracked Discovery by @anthonyshew in https://github.com/vercel/turborepo/pull/12195
• perf: Reuse input hashes and trim pnpm lockfile allocations by @anthonyshew in https://github.com/vercel/turborepo/pull/12199
• docs: Improve Oxc tooling guide for type-aware linting and fix race conditions by @anthonyshew in https://github.com/vercel/turborepo/pull/12200
• perf: Overlap untracked file walk with builder setup by @anthonyshew in https://github.com/vercel/turborepo/pull/12201
• perf: Decouple filesystem walk from git index construction by @anthonyshew in https://github.com/vercel/turborepo/pull/12204
• perf: Race parallel git subprocesses against filesystem walk for optimal index construction by @anthonyshew in https://github.com/vercel/turborepo/pull/12206
• perf: Two-phase HTTP client init to avoid macOS Keychain blocking by @anthonyshew in https://github.com/vercel/turborepo/pull/12208
• perf: Skip redundant file writes during cache restore using manifests by @anthonyshew in https://github.com/vercel/turborepo/pull/12209
• perf: Generate cache restore manifest at save time to eliminate first-hit penalty by @anthonyshew in https://github.com/vercel/turborepo/pull/12213
• docs: Clarification in oxc guide by @anthonyshew in https://github.com/vercel/turborepo/pull/12207
• feat: Add affectedTasks query for task-level change detection by @anthonyshew in https://github.com/vercel/turborepo/pull/12215
• docs: Replace mermaid with reactflow-based diagram components by @anthonyshew in https://github.com/vercel/turborepo/pull/11770
• fix: Remove unnecessary dependency overrides and bump quinn-proto by @anthonyshew in https://github.com/vercel/turborepo/pull/12226
• fix: Remove all remaining pnpm dependency overrides by @anthonyshew in https://github.com/vercel/turborepo/pull/12227
• fix: Promote nested bun lockfile entries when hoisted version is pruned by @anthonyshew in https://github.com/vercel/turborepo/pull/12228
• fix: Honor --output-logs errors-only for non-cached tasks by @veeceey in https://github.com/vercel/turborepo/pull/11926
• docs: Remove CONSOLE DO NOT TRACK link by @anthonyshew in https://github.com/vercel/turborepo/pull/12232
• docs: missing migrate word by @anthonyshew in https://github.com/vercel/turborepo/pull/12234
• fix: Resolve root-level tasks not executing with //# CLI syntax by @anthonyshew in https://github.com/vercel/turborepo/pull/12242
• fix: Prevent run summary SendError panic on shutdown by @anthonyshew in https://github.com/vercel/turborepo/pull/12244
• fix: Deflake watch_rapid_edits_produce_single_rebuild test by @anthonyshew in https://github.com/vercel/turborepo/pull/12245
• fix: Use FilterMode enum for root task scoping with exclude-only filters by @Jaredw2289-svg in https://github.com/vercel/turborepo/pull/12212
• fix: Resolve package-name-shaped tsconfig path aliases by @sleitor in https://github.com/vercel/turborepo/pull/11998
• fix: Use BTreeMap for deterministic lockfile dependency ordering by @anthonyshew in https://github.com/vercel/turborepo/pull/12254
• fix: Cap rayon thread pool and block_in_place in tokio to prevent deadlock potential by @anthonyshew in https://github.com/vercel/turborepo/pull/12253
• feat: Add Node.js version to turbo info output by @anthonyshew in https://github.com/vercel/turborepo/pull/12260
• feat: Send x-ai-agent header on all Vercel API requests by @anthonyshew in https://github.com/vercel/turborepo/pull/12261
• fix: Deflake watch_edit_during_build_triggers_rebuild test by @anthonyshew in https://github.com/vercel/turborepo/pull/12263
• fix: Validate task names when --affected yields empty package scope by @anthonyshew in https://github.com/vercel/turborepo/pull/12268
• feat: Deprecate --scope flag for turbo prune by @anthonyshew in https://github.com/vercel/turborepo/pull/12269
• docs: Note that future flags affect global hash by @anthonyshew in https://github.com/vercel/turborepo/pull/12271
• fix: Align query affectedTasks with run --affected for $TURBO_ROOT$ inputs by @anthonyshew in https://github.com/vercel/turborepo/pull/12270
• fix: Initialize TUI terminal in watch mode even when all tasks hit cache by @anthonyshew in https://github.com/vercel/turborepo/pull/12273
• feat: Use task graph for watch by @anthonyshew in https://github.com/vercel/turborepo/pull/12275
• fix: Use BTreeMap for bundled_deps in bun PackageIndex by @anthonyshew in https://github.com/vercel/turborepo/pull/12266
• fix: Fix non-deterministic hashOfExternalDependencies with Bun lockfiles by @anthonyshew in https://github.com/vercel/turborepo/pull/12279
• feat: Add turbo query affected CLI shorthand by @anthonyshew in https://github.com/vercel/turborepo/pull/12283
• chore: Add turborepo-log crate to improve our logging situation by @anthonyshew in https://github.com/vercel/turborepo/pull/12285
• fix: Ensure pkg#task CLI args are always included in filtered packages by @anthonyshew in https://github.com/vercel/turborepo/pull/12287
• feat: Wire up turborepo-log with TerminalSink and convert first warning by @anthonyshew in https://github.com/vercel/turborepo/pull/12289
• feat: Add git SHA and dirty hash to cache metadata by @mehulkar in https://github.com/vercel/turborepo/pull/12288
• feat: Surface cache SCM metadata in Run Summary by @mehulkar in https://github.com/vercel/turborepo/pull/12291
• fix: Inline PlopTypes in @turbo/gen to fix implicit any for consumers by @anthonyshew in https://github.com/vercel/turborepo/pull/12292
• chore: Disable update notifier for this repo by @anthonyshew in https://github.com/vercel/turborepo/pull/12293
• feat: Add TuiSink to route log events into the TUI by @anthonyshew in https://github.com/vercel/turborepo/pull/12294
• feat: Publish platform binaries under @turbo/ scoped packages by @anthonyshew in https://github.com/vercel/turborepo/pull/12296
• feat: Initialize turborepo-log in turbo watch by @anthonyshew in https://github.com/vercel/turborepo/pull/12298
• fix: Resolve git diff warning in fresh repos and make SCM state lazy by @anthonyshew in https://github.com/vercel/turborepo/pull/12300
• docs: Add VS Code Jest extension workaround to Jest guide by @anthonyshew in https://github.com/vercel/turborepo/pull/12303
• feat: Route user-facing warnings through turborepo-log and suppress tracing stderr in TUI mode by @anthonyshew in https://github.com/vercel/turborepo/pull/12299
• fix: Handle parent directory inputs in non-git repos by @anthonyshew in https://github.com/vercel/turborepo/pull/12304
• fix: Source cargo env in pre-push hook for Rust toolchain resolution by @anthonyshew in https://github.com/vercel/turborepo/pull/12306
• refactor: Convert task-access warnings to turborepo_log by @anthonyshew in https://github.com/vercel/turborepo/pull/12307
• chore: Remove internal .vscode directory by @anthonyshew in https://github.com/vercel/turborepo/pull/12309
• fix: Expand directory inputs to dir/** in manual SCM and git literal-path optimization by @anthonyshew in https://github.com/vercel/turborepo/pull/12305
• fix: Infer monorepo root in LSP instead of trusting editor root_uri by @anthonyshew in https://github.com/vercel/turborepo/pull/12308
• fix: Flush stale mouse tracking events from stdin during TUI cleanup by @anthonyshew in https://github.com/vercel/turborepo/pull/12311
• refactor: Route run prelude through turborepo_log, add StdoutSink by @anthonyshew in https://github.com/vercel/turborepo/pull/12310
• feat: Show richer remote cache status in run prelude by @anthonyshew in https://github.com/vercel/turborepo/pull/12314
• chore: Remove deprecated Spaces feature remnants by @anthonyshew in https://github.com/vercel/turborepo/pull/12316
• refactor: Route run/watch output through unified TerminalSink by @anthonyshew in https://github.com/vercel/turborepo/pull/12315
• refactor: Replace tracing::log:: bridge imports with tracing:: directly by @anthonyshew in https://github.com/vercel/turborepo/pull/12320
• refactor: Replace Source::turbo string literals with Subsystem enum by @anthonyshew in https://github.com/vercel/turborepo/pull/12321
• fix: Add check:toml to pre-push hook by @anthonyshew in https://github.com/vercel/turborepo/pull/12322
• fix: Filter phantom tasks from affectedTasks query results by @anthonyshew in https://github.com/vercel/turborepo/pull/12324
• refactor: Route 'no tasks executed' warning through turborepo-log and add task prefix to TerminalSink by @anthonyshew in https://github.com/vercel/turborepo/pull/12326
• feat: Allow cyclic package graphs, validate only at task graph level by @anthonyshew in https://github.com/vercel/turborepo/pull/12327
• fix: Detect affected tasks with $TURBO_ROOT$ inputs when using affectedUsingTaskInputs by @anthonyshew in https://github.com/vercel/turborepo/pull/12331
• feat: Extend LogSink with task output and grouping support by @anthonyshew in https://github.com/vercel/turborepo/pull/12328
• fix: Support private GitHub repos in turbo gen workspace --copy by @anthonyshew in https://github.com/vercel/turborepo/pull/12333
• feat: Add GroupingLayer for per-task output buffering by @anthonyshew in https://github.com/vercel/turborepo/pull/12334
• fix: Hardening for supporting private GitHub repos in turbo gen workspace --copy by @anthonyshew in https://github.com/vercel/turborepo/pull/12336
• refactor: Wire GroupingLayer into Visitor and migrate task error/warn to turborepo-log by @anthonyshew in https://github.com/vercel/turborepo/pull/12337
• perf: Replace subprocess repo index with in-process gix-index by @anthonyshew in https://github.com/vercel/turborepo/pull/12339
• fix: Prevent $TURBO_DEFAULT$ from matching unrelated root files in affected detection by @anthonyshew in https://github.com/vercel/turborepo/pull/12341
• feat: Route child process bytes through TaskHandle with sink-owned prefix rendering by @anthonyshew in https://github.com/vercel/turborepo/pull/12343
• feat: Deprecate graphviz-dependent --graph formats, add native SVG rendering by @anthonyshew in https://github.com/vercel/turborepo/pull/12344
• refactor: Migrate cache replay and status messages to TaskHandle, remove CacheOutput trait by @anthonyshew in https://github.com/vercel/turborepo/pull/12345
• refactor: Remove old output pipeline and document logging architecture by @anthonyshew in https://github.com/vercel/turborepo/pull/12348
• chore: Move section in CONTRIBUTING.md by @anthonyshew in https://github.com/vercel/turborepo/pull/12350
• chore: Update undici dependency version to 6.24.0 by @hack-313-ip in https://github.com/vercel/turborepo/pull/12352
• docs: Clean up futureFlags description by @anthonyshew in https://github.com/vercel/turborepo/pull/12355
• feat: Deprecate --parallel flag by @anthonyshew in https://github.com/vercel/turborepo/pull/12357
• fix: Resolve $turbo-get-mfe-port by packageName when application key differs by @prudentbird in https://github.com/vercel/turborepo/pull/12149
• fix: Preserve all bun lockfile overrides during prune by @anthonyshew in https://github.com/vercel/turborepo/pull/12362
• feat: Include globalDependencies in prune behind Future Flag by @anthonyshew in https://github.com/vercel/turborepo/pull/12360
• feat: Add filterUsingTasks future flag for task-level --filter resolution by @anthonyshew in https://github.com/vercel/turborepo/pull/12363
• fix: Suppress noisy rustls TLS warning on stderr by @anthonyshew in https://github.com/vercel/turborepo/pull/12365
• docs: Fix typo in Turbo 2.7 blog post by @Rohan5commit in https://github.com/vercel/turborepo/pull/12367
• fix: Fall back to bundled certificates when system cert store is inaccessible by @anthonyshew in https://github.com/vercel/turborepo/pull/12371
• fix: Pass TURBO_* env vars through to child processes in Strict Mode by @anthonyshew in https://github.com/vercel/turborepo/pull/12372
• fix: Improve accessibility for docs by @anthonyshew in https://github.com/vercel/turborepo/pull/12375
• fix: Preserve package.json key order during turbo prune with pnpm patches by @anthonyshew in https://github.com/vercel/turborepo/pull/12376
• fix: Detect scoped @turbo/{platform} packages in local binary resolution by @EmojiPati in https://github.com/vercel/turborepo/pull/12386
• fix: Support legacy unscoped binary package names in Node.js shim by @anthonyshew in https://github.com/vercel/turborepo/pull/12391
• fix: Prevent stdin from being dropped for persistent tasks in stream mode by @anthonyshew in https://github.com/vercel/turborepo/pull/12394
• docs: Add link to Docker guide in prune --docker flag section by @styfle in https://github.com/vercel/turborepo/pull/12401
• feat: Add global configuration key behind futureFlags.globalConfiguration by @anthonyshew in https://github.com/vercel/turborepo/pull/12399
• chore: Update CODEOWNERS to remove /docs owner by @anthonyshew in https://github.com/vercel/turborepo/pull/12402
• fix: Move docs app icons into app/ directory by @anthonyshew in https://github.com/vercel/turborepo/pull/12403
• feat: Add experimental structured logging with --json and --log-file flags by @anthonyshew in https://github.com/vercel/turborepo/pull/12405
• docs: Downgrade Next.js by @anthonyshew in https://github.com/vercel/turborepo/pull/12408
• chore: Deprecate the turbo scan command by @anthonyshew in https://github.com/vercel/turborepo/pull/12406
• chore: Upgrade Next.js by @anthonyshew in https://github.com/vercel/turborepo/pull/12415
• Revert "fix: Flush stale mouse tracking events from stdin during TUI cleanup" by @anthonyshew in https://github.com/vercel/turborepo/pull/12416
• fix: Add NixOS environment variables to default passthroughs by @anthonyshew in https://github.com/vercel/turborepo/pull/12417
• fix: Resolve security vulnerabilities in tar and rustls-webpki by @anthonyshew in https://github.com/vercel/turborepo/pull/12418
• docs: Promote turbo query from experimental to stable by @anthonyshew in https://github.com/vercel/turborepo/pull/12421
• docs: Clarify turbo-ignore's future by @anthonyshew in https://github.com/vercel/turborepo/pull/12422
• feat: Rework turbo ls to use query internals and add turbo query ls shorthand by @anthonyshew in https://github.com/vercel/turborepo/pull/12424
• docs: Clarify environment variables across packages dependency behavior by @ramanverse in https://github.com/vercel/turborepo/pull/12390
• docs: Expand subpath imports example by @lilianakatrina684-a11y in https://github.com/vercel/turborepo/pull/12412
• fix: Preserve source dependencies when adding workspace deps in turbo-gen by @sleitor in https://github.com/vercel/turborepo/pull/11935
• docs: Add Git history requirements to turbo query affected docs by @anthonyshew in https://github.com/vercel/turborepo/pull/12426
• fix: Prevent horizontal overflow from long inline code on narrow viewports by @anthonyshew in https://github.com/vercel/turborepo/pull/12428
• feat: Send git SHA and dirty hash to remote cache by @mehulkar in https://github.com/vercel/turborepo/pull/12427
• fix: Upgrade tokio to 1.47.1+ to fix pidfd_reaper panic by @anthonyshew in https://github.com/vercel/turborepo/pull/12431
• docs: Add AI guide to sidebar navigation by @anthonyshew in https://github.com/vercel/turborepo/pull/12438
• docs: Move experimentalObservability into futureFlags section by @anthonyshew in https://github.com/vercel/turborepo/pull/12439
• fix: Skip Unix domain sockets and other special files during file hashing by @anthonyshew in https://github.com/vercel/turborepo/pull/12445
• fix: Preserve dedupePeers and unknown pnpm lockfile settings by @attehuhtakangas in https://github.com/vercel/turborepo/pull/12443
• fix: Align dry run cache status with normal run by checking caching guards by @anthonyshew in https://github.com/vercel/turborepo/pull/12448
• fix: Resolve turbo watch hang with mixed interruptible persistent tasks by @anthonyshew in https://github.com/vercel/turborepo/pull/12449
• fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes by @anthonyshew in https://github.com/vercel/turborepo/pull/12452
• refactor: Move cache hit SHA context to verbose logging by @mehulkar in https://github.com/vercel/turborepo/pull/12435
• docs: Add missing --force flag documentation by @Goldyvaiiii in https://github.com/vercel/turborepo/pull/12440
• fix: Prevent panic in turbo watch with persistent tasks by @anthonyshew in https://github.com/vercel/turborepo/pull/12459
• fix: Support turbo watch in single-package workspaces by @anthonyshew in https://github.com/vercel/turborepo/pull/12460
• fix: Missing deps after npm lockfile parsing by @anthonyshew in https://github.com/vercel/turborepo/pull/12464
• docs: Add AI agent detection and automatic markdown rewrites by @molebox in https://github.com/vercel/turborepo/pull/12462
• fix: Resolve generator name conflicts across workspaces by @anthonyshew in https://github.com/vercel/turborepo/pull/12467
• fix: Remove root package.json from --affected global triggers by @anthonyshew in https://github.com/vercel/turborepo/pull/12469
• fix: Show run summary after TUI exits by @anthonyshew in https://github.com/vercel/turborepo/pull/12471
• fix: Avoid panic for unanchorable/non-UTF8 git paths by @biru-codeastromer in https://github.com/vercel/turborepo/pull/11106
• feat: Accept experimentalCI key in turbo.json task config by @anthonyshew in https://github.com/vercel/turborepo/pull/12480
• fix: Prevent pnpm overrides from corrupting resolved peer-dep variants by @frankeld in https://github.com/vercel/turborepo/pull/12482
• fix: Skip writing unchanged files during slow-path cache restore by @anthonyshew in https://github.com/vercel/turborepo/pull/12484
• fix: Replace pre-existing symlinks with directories during cache restore by @anthonyshew in https://github.com/vercel/turborepo/pull/12488
• fix: Follow symlinks during workspace package discovery by @anthonyshew in https://github.com/vercel/turborepo/pull/12489
• fix: Reduce inotify watch count via gitignore-aware directory walking on Linux by @antoinelyset in https://github.com/vercel/turborepo/pull/12398

New Contributors

• @bestickley made their first contribution in https://github.com/vercel/turborepo/pull/11571
• @marko-hologram made their first contribution in https://github.com/vercel/turborepo/pull/11580
• @ddmoney420 made their first contribution in https://github.com/vercel/turborepo/pull/11579
• @i5d6 made their first contribution in https://github.com/vercel/turborepo/pull/11591
• @Netail made their first contribution in https://github.com/vercel/turborepo/pull/11630
• @alexmkio made their first contribution in https://github.com/vercel/turborepo/pull/11650
• @haydenbleasel made their first contribution in https://github.com/vercel/turborepo/pull/11807
• @kyedavey made their first contribution in https://github.com/vercel/turborepo/pull/11827
• @PeterPCW made their first contribution in https://github.com/vercel/turborepo/pull/11760
• @bkonkle made their first contribution in https://github.com/vercel/turborepo/pull/11130
• @serjooo made their first contribution in https://github.com/vercel/turborepo/pull/12085
• @04cb made their first contribution in https://github.com/vercel/turborepo/pull/12088
• @sleitor made their first contribution in https://github.com/vercel/turborepo/pull/11946
• @MrNaif2018 made their first contribution in https://github.com/vercel/turborepo/pull/11953
• @veeceey made their first contribution in https://github.com/vercel/turborepo/pull/11926
• @GabrielBB made their first contribution in https://github.com/vercel/turborepo/pull/12193
• @Jaredw2289-svg made their first contribution in https://github.com/vercel/turborepo/pull/12212
• @hack-313-ip made their first contribution in https://github.com/vercel/turborepo/pull/12352
• @prudentbird made their first contribution in https://github.com/vercel/turborepo/pull/12149
• @Rohan5commit made their first contribution in https://github.com/vercel/turborepo/pull/12367
• @EmojiPati made their first contribution in https://github.com/vercel/turborepo/pull/12386
• @ramanverse made their first contribution in https://github.com/vercel/turborepo/pull/12390
• @lilianakatrina684-a11y made their first contribution in https://github.com/vercel/turborepo/pull/12412
• @floriansalihovic made their first contribution in https://github.com/vercel/turborepo/pull/11952
• @Goldyvaiiii made their first contribution in https://github.com/vercel/turborepo/pull/12436
• @attehuhtakangas made their first contribution in https://github.com/vercel/turborepo/pull/12443
• @frankeld made their first contribution in https://github.com/vercel/turborepo/pull/12482
• @antoinelyset made their first contribution in https://github.com/vercel/turborepo/pull/12398

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.0...v2.9.0

<!-- Release notes generated using configuration in .github/release.yml at v2.8.21 -->

What's Changed

Docs

• fix: Strip JSX components from heading anchors and TOC entries by @anthonyshew in https://github.com/vercel/turborepo/pull/12404

eslint

• fix(eslint-plugin-turbo): Guard against missing tasks/pipeline in forEachTaskDef by @sleitor in https://github.com/vercel/turborepo/pull/12411

@turbo/repository

• feat: Add packagesFromLockfile() NAPI binding to @turbo/repository by @anthonyshew in https://github.com/vercel/turborepo/pull/12454
• release(library): 0.0.1-canary.21 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12455

Examples

• fix(examples): Update of with-svelte example by @floriansalihovic in https://github.com/vercel/turborepo/pull/11952
• fix: Use script-shell=bash for cross-platform with-shell-commands example by @Goldyvaiiii in https://github.com/vercel/turborepo/pull/12436

Changelog

• docs: Add link to Docker guide in prune --docker flag section by @styfle in https://github.com/vercel/turborepo/pull/12401
• feat: Add global configuration key behind futureFlags.globalConfiguration by @anthonyshew in https://github.com/vercel/turborepo/pull/12399
• chore: Update CODEOWNERS to remove /docs owner by @anthonyshew in https://github.com/vercel/turborepo/pull/12402
• fix: Move docs app icons into app/ directory by @anthonyshew in https://github.com/vercel/turborepo/pull/12403
• feat: Add experimental structured logging with --json and --log-file flags by @anthonyshew in https://github.com/vercel/turborepo/pull/12405
• docs: Downgrade Next.js by @anthonyshew in https://github.com/vercel/turborepo/pull/12408
• chore: Deprecate the turbo scan command by @anthonyshew in https://github.com/vercel/turborepo/pull/12406
• chore: Upgrade Next.js by @anthonyshew in https://github.com/vercel/turborepo/pull/12415
• Revert "fix: Flush stale mouse tracking events from stdin during TUI cleanup" by @anthonyshew in https://github.com/vercel/turborepo/pull/12416
• fix: Add NixOS environment variables to default passthroughs by @anthonyshew in https://github.com/vercel/turborepo/pull/12417
• fix: Resolve security vulnerabilities in tar and rustls-webpki by @anthonyshew in https://github.com/vercel/turborepo/pull/12418
• docs: Promote turbo query from experimental to stable by @anthonyshew in https://github.com/vercel/turborepo/pull/12421
• docs: Clarify turbo-ignore's future by @anthonyshew in https://github.com/vercel/turborepo/pull/12422
• feat: Rework turbo ls to use query internals and add turbo query ls shorthand by @anthonyshew in https://github.com/vercel/turborepo/pull/12424
• docs: Clarify environment variables across packages dependency behavior by @ramanverse in https://github.com/vercel/turborepo/pull/12390
• docs: Expand subpath imports example by @lilianakatrina684-a11y in https://github.com/vercel/turborepo/pull/12412
• fix: Preserve source dependencies when adding workspace deps in turbo-gen by @sleitor in https://github.com/vercel/turborepo/pull/11935
• docs: Add Git history requirements to turbo query affected docs by @anthonyshew in https://github.com/vercel/turborepo/pull/12426
• fix: Prevent horizontal overflow from long inline code on narrow viewports by @anthonyshew in https://github.com/vercel/turborepo/pull/12428
• feat: Send git SHA and dirty hash to remote cache by @mehulkar in https://github.com/vercel/turborepo/pull/12427
• fix: Upgrade tokio to 1.47.1+ to fix pidfd_reaper panic by @anthonyshew in https://github.com/vercel/turborepo/pull/12431
• docs: Add AI guide to sidebar navigation by @anthonyshew in https://github.com/vercel/turborepo/pull/12438
• docs: Move experimentalObservability into futureFlags section by @anthonyshew in https://github.com/vercel/turborepo/pull/12439
• fix: Skip Unix domain sockets and other special files during file hashing by @anthonyshew in https://github.com/vercel/turborepo/pull/12445
• fix: Preserve dedupePeers and unknown pnpm lockfile settings by @attehuhtakangas in https://github.com/vercel/turborepo/pull/12443
• fix: Align dry run cache status with normal run by checking caching guards by @anthonyshew in https://github.com/vercel/turborepo/pull/12448
• fix: Resolve turbo watch hang with mixed interruptible persistent tasks by @anthonyshew in https://github.com/vercel/turborepo/pull/12449
• fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes by @anthonyshew in https://github.com/vercel/turborepo/pull/12452
• refactor: Move cache hit SHA context to verbose logging by @mehulkar in https://github.com/vercel/turborepo/pull/12435
• docs: Add missing --force flag documentation by @Goldyvaiiii in https://github.com/vercel/turborepo/pull/12440
• fix: Prevent panic in turbo watch with persistent tasks by @anthonyshew in https://github.com/vercel/turborepo/pull/12459
• fix: Support turbo watch in single-package workspaces by @anthonyshew in https://github.com/vercel/turborepo/pull/12460
• fix: Missing deps after npm lockfile parsing by @anthonyshew in https://github.com/vercel/turborepo/pull/12464
• docs: Add AI agent detection and automatic markdown rewrites by @molebox in https://github.com/vercel/turborepo/pull/12462
• fix: Resolve generator name conflicts across workspaces by @anthonyshew in https://github.com/vercel/turborepo/pull/12467
• fix: Remove root package.json from --affected global triggers by @anthonyshew in https://github.com/vercel/turborepo/pull/12469
• fix: Show run summary after TUI exits by @anthonyshew in https://github.com/vercel/turborepo/pull/12471

New Contributors

• @ramanverse made their first contribution in https://github.com/vercel/turborepo/pull/12390
• @lilianakatrina684-a11y made their first contribution in https://github.com/vercel/turborepo/pull/12412
• @floriansalihovic made their first contribution in https://github.com/vercel/turborepo/pull/11952
• @Goldyvaiiii made their first contribution in https://github.com/vercel/turborepo/pull/12436
• @attehuhtakangas made their first contribution in https://github.com/vercel/turborepo/pull/12443

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.20...v2.8.21

<!-- Release notes generated using configuration in .github/release.yml at v2.8.20 -->

What's Changed

Changelog

• fix: Prevent stdin from being dropped for persistent tasks in stream mode by @anthonyshew in https://github.com/vercel/turborepo/pull/12394

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.19...v2.8.20

<!-- Release notes generated using configuration in .github/release.yml at v2.8.19 -->

What's Changed

turbo-ignore

• feat: Deprecate turbo-ignore in favor of turbo query affected by @anthonyshew in https://github.com/vercel/turborepo/pull/12382
• fix: Tailored turbo-ignore deprecation notice for Vercel users by @anthonyshew in https://github.com/vercel/turborepo/pull/12385

Examples

• chore: Upgrade Next.js to 16.2.0 in examples and apps by @anthonyshew in https://github.com/vercel/turborepo/pull/12389

Changelog

• fix: Detect scoped @turbo/{platform} packages in local binary resolution by @EmojiPati in https://github.com/vercel/turborepo/pull/12386
• fix: Support legacy unscoped binary package names in Node.js shim by @anthonyshew in https://github.com/vercel/turborepo/pull/12391

New Contributors

• @EmojiPati made their first contribution in https://github.com/vercel/turborepo/pull/12386

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.18...v2.8.19

<!-- Release notes generated using configuration in .github/release.yml at v2.8.18 -->

What's Changed

create-turbo

• fix: Sort uninstalled package managers to bottom of create-turbo selection by @anthonyshew in https://github.com/vercel/turborepo/pull/12353

@turbo/codemod

• fix: Stop add-package-names codemod from silently renaming existing packages by @anthonyshew in https://github.com/vercel/turborepo/pull/12332

Examples

• fix: Sync yarn lockfile before upgrading turbo in examples updater by @anthonyshew in https://github.com/vercel/turborepo/pull/12286

Changelog

• feat: Add turbo query affected CLI shorthand by @anthonyshew in https://github.com/vercel/turborepo/pull/12283
• chore: Add turborepo-log crate to improve our logging situation by @anthonyshew in https://github.com/vercel/turborepo/pull/12285
• fix: Ensure pkg#task CLI args are always included in filtered packages by @anthonyshew in https://github.com/vercel/turborepo/pull/12287
• feat: Wire up turborepo-log with TerminalSink and convert first warning by @anthonyshew in https://github.com/vercel/turborepo/pull/12289
• feat: Add git SHA and dirty hash to cache metadata by @mehulkar in https://github.com/vercel/turborepo/pull/12288
• feat: Surface cache SCM metadata in Run Summary by @mehulkar in https://github.com/vercel/turborepo/pull/12291
• fix: Inline PlopTypes in @turbo/gen to fix implicit any for consumers by @anthonyshew in https://github.com/vercel/turborepo/pull/12292
• chore: Disable update notifier for this repo by @anthonyshew in https://github.com/vercel/turborepo/pull/12293
• feat: Add TuiSink to route log events into the TUI by @anthonyshew in https://github.com/vercel/turborepo/pull/12294
• feat: Publish platform binaries under @turbo/ scoped packages by @anthonyshew in https://github.com/vercel/turborepo/pull/12296
• feat: Initialize turborepo-log in turbo watch by @anthonyshew in https://github.com/vercel/turborepo/pull/12298
• fix: Resolve git diff warning in fresh repos and make SCM state lazy by @anthonyshew in https://github.com/vercel/turborepo/pull/12300
• docs: Add VS Code Jest extension workaround to Jest guide by @anthonyshew in https://github.com/vercel/turborepo/pull/12303
• feat: Route user-facing warnings through turborepo-log and suppress tracing stderr in TUI mode by @anthonyshew in https://github.com/vercel/turborepo/pull/12299
• fix: Handle parent directory inputs in non-git repos by @anthonyshew in https://github.com/vercel/turborepo/pull/12304
• fix: Source cargo env in pre-push hook for Rust toolchain resolution by @anthonyshew in https://github.com/vercel/turborepo/pull/12306
• refactor: Convert task-access warnings to turborepo_log by @anthonyshew in https://github.com/vercel/turborepo/pull/12307
• chore: Remove internal .vscode directory by @anthonyshew in https://github.com/vercel/turborepo/pull/12309
• fix: Expand directory inputs to dir/** in manual SCM and git literal-path optimization by @anthonyshew in https://github.com/vercel/turborepo/pull/12305
• fix: Infer monorepo root in LSP instead of trusting editor root_uri by @anthonyshew in https://github.com/vercel/turborepo/pull/12308
• fix: Flush stale mouse tracking events from stdin during TUI cleanup by @anthonyshew in https://github.com/vercel/turborepo/pull/12311
• refactor: Route run prelude through turborepo_log, add StdoutSink by @anthonyshew in https://github.com/vercel/turborepo/pull/12310
• feat: Show richer remote cache status in run prelude by @anthonyshew in https://github.com/vercel/turborepo/pull/12314
• chore: Remove deprecated Spaces feature remnants by @anthonyshew in https://github.com/vercel/turborepo/pull/12316
• refactor: Route run/watch output through unified TerminalSink by @anthonyshew in https://github.com/vercel/turborepo/pull/12315
• refactor: Replace tracing::log:: bridge imports with tracing:: directly by @anthonyshew in https://github.com/vercel/turborepo/pull/12320
• refactor: Replace Source::turbo string literals with Subsystem enum by @anthonyshew in https://github.com/vercel/turborepo/pull/12321
• fix: Add check:toml to pre-push hook by @anthonyshew in https://github.com/vercel/turborepo/pull/12322
• fix: Filter phantom tasks from affectedTasks query results by @anthonyshew in https://github.com/vercel/turborepo/pull/12324
• refactor: Route 'no tasks executed' warning through turborepo-log and add task prefix to TerminalSink by @anthonyshew in https://github.com/vercel/turborepo/pull/12326
• feat: Allow cyclic package graphs, validate only at task graph level by @anthonyshew in https://github.com/vercel/turborepo/pull/12327
• fix: Detect affected tasks with $TURBO_ROOT$ inputs when using affectedUsingTaskInputs by @anthonyshew in https://github.com/vercel/turborepo/pull/12331
• feat: Extend LogSink with task output and grouping support by @anthonyshew in https://github.com/vercel/turborepo/pull/12328
• fix: Support private GitHub repos in turbo gen workspace --copy by @anthonyshew in https://github.com/vercel/turborepo/pull/12333
• feat: Add GroupingLayer for per-task output buffering by @anthonyshew in https://github.com/vercel/turborepo/pull/12334
• fix: Hardening for supporting private GitHub repos in turbo gen workspace --copy by @anthonyshew in https://github.com/vercel/turborepo/pull/12336
• refactor: Wire GroupingLayer into Visitor and migrate task error/warn to turborepo-log by @anthonyshew in https://github.com/vercel/turborepo/pull/12337
• perf: Replace subprocess repo index with in-process gix-index by @anthonyshew in https://github.com/vercel/turborepo/pull/12339
• fix: Prevent $TURBO_DEFAULT$ from matching unrelated root files in affected detection by @anthonyshew in https://github.com/vercel/turborepo/pull/12341
• feat: Route child process bytes through TaskHandle with sink-owned prefix rendering by @anthonyshew in https://github.com/vercel/turborepo/pull/12343
• feat: Deprecate graphviz-dependent --graph formats, add native SVG rendering by @anthonyshew in https://github.com/vercel/turborepo/pull/12344
• refactor: Migrate cache replay and status messages to TaskHandle, remove CacheOutput trait by @anthonyshew in https://github.com/vercel/turborepo/pull/12345
• refactor: Remove old output pipeline and document logging architecture by @anthonyshew in https://github.com/vercel/turborepo/pull/12348
• chore: Move section in CONTRIBUTING.md by @anthonyshew in https://github.com/vercel/turborepo/pull/12350
• chore: Update undici dependency version to 6.24.0 by @hack-313-ip in https://github.com/vercel/turborepo/pull/12352
• docs: Clean up futureFlags description by @anthonyshew in https://github.com/vercel/turborepo/pull/12355
• feat: Deprecate --parallel flag by @anthonyshew in https://github.com/vercel/turborepo/pull/12357
• fix: Resolve $turbo-get-mfe-port by packageName when application key differs by @prudentbird in https://github.com/vercel/turborepo/pull/12149
• fix: Preserve all bun lockfile overrides during prune by @anthonyshew in https://github.com/vercel/turborepo/pull/12362
• feat: Include globalDependencies in prune behind Future Flag by @anthonyshew in https://github.com/vercel/turborepo/pull/12360
• feat: Add filterUsingTasks future flag for task-level --filter resolution by @anthonyshew in https://github.com/vercel/turborepo/pull/12363
• fix: Suppress noisy rustls TLS warning on stderr by @anthonyshew in https://github.com/vercel/turborepo/pull/12365
• docs: Fix typo in Turbo 2.7 blog post by @Rohan5commit in https://github.com/vercel/turborepo/pull/12367
• fix: Fall back to bundled certificates when system cert store is inaccessible by @anthonyshew in https://github.com/vercel/turborepo/pull/12371
• fix: Pass TURBO_* env vars through to child processes in Strict Mode by @anthonyshew in https://github.com/vercel/turborepo/pull/12372
• fix: Improve accessibility for docs by @anthonyshew in https://github.com/vercel/turborepo/pull/12375
• fix: Preserve package.json key order during turbo prune with pnpm patches by @anthonyshew in https://github.com/vercel/turborepo/pull/12376

New Contributors

• @hack-313-ip made their first contribution in https://github.com/vercel/turborepo/pull/12352
• @prudentbird made their first contribution in https://github.com/vercel/turborepo/pull/12149
• @Rohan5commit made their first contribution in https://github.com/vercel/turborepo/pull/12367

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.17...v2.8.18

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

create-turbo

• fix: Improve create-turbo connectivity check and offline error messages by @anthonyshew in https://github.com/vercel/turborepo/pull/12257
• feat: Add affectedUsingTaskInputs future flag for task-level --affected detection by @anthonyshew in https://github.com/vercel/turborepo/pull/12247
• fix: Replace dns.lookup with https.get for create-turbo online check by @anthonyshew in https://github.com/vercel/turborepo/pull/12277
• fix: Remove redundant online check from create-turbo by @anthonyshew in https://github.com/vercel/turborepo/pull/12281

Examples

• fix: Match vite and @vitejs/plugin-react versions on example by @GabrielBB in https://github.com/vercel/turborepo/pull/12193

Changelog

• fix: Resolve root-level tasks not executing with //# CLI syntax by @anthonyshew in https://github.com/vercel/turborepo/pull/12242
• fix: Prevent run summary SendError panic on shutdown by @anthonyshew in https://github.com/vercel/turborepo/pull/12244
• fix: Deflake watch_rapid_edits_produce_single_rebuild test by @anthonyshew in https://github.com/vercel/turborepo/pull/12245
• fix: Use FilterMode enum for root task scoping with exclude-only filters by @Jaredw2289-svg in https://github.com/vercel/turborepo/pull/12212
• fix: Resolve package-name-shaped tsconfig path aliases by @sleitor in https://github.com/vercel/turborepo/pull/11998
• fix: Use BTreeMap for deterministic lockfile dependency ordering by @anthonyshew in https://github.com/vercel/turborepo/pull/12254
• fix: Cap rayon thread pool and block_in_place in tokio to prevent deadlock potential by @anthonyshew in https://github.com/vercel/turborepo/pull/12253
• feat: Add Node.js version to turbo info output by @anthonyshew in https://github.com/vercel/turborepo/pull/12260
• feat: Send x-ai-agent header on all Vercel API requests by @anthonyshew in https://github.com/vercel/turborepo/pull/12261
• fix: Deflake watch_edit_during_build_triggers_rebuild test by @anthonyshew in https://github.com/vercel/turborepo/pull/12263
• fix: Validate task names when --affected yields empty package scope by @anthonyshew in https://github.com/vercel/turborepo/pull/12268
• feat: Deprecate --scope flag for turbo prune by @anthonyshew in https://github.com/vercel/turborepo/pull/12269
• docs: Note that future flags affect global hash by @anthonyshew in https://github.com/vercel/turborepo/pull/12271
• fix: Align query affectedTasks with run --affected for $TURBO_ROOT$ inputs by @anthonyshew in https://github.com/vercel/turborepo/pull/12270
• fix: Initialize TUI terminal in watch mode even when all tasks hit cache by @anthonyshew in https://github.com/vercel/turborepo/pull/12273
• feat: Use task graph for watch by @anthonyshew in https://github.com/vercel/turborepo/pull/12275
• fix: Use BTreeMap for bundled_deps in bun PackageIndex by @anthonyshew in https://github.com/vercel/turborepo/pull/12266
• fix: Fix non-deterministic hashOfExternalDependencies with Bun lockfiles by @anthonyshew in https://github.com/vercel/turborepo/pull/12279

New Contributors

• @GabrielBB made their first contribution in https://github.com/vercel/turborepo/pull/12193
• @Jaredw2289-svg made their first contribution in https://github.com/vercel/turborepo/pull/12212

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.16...v2.8.17