npx @buildinternet/releases get turborepo-releasesTasks can now be tagged with configuration inheritance, and the query command and CLI can filter tasks and packages by those tags. Also fixed inconsistent task-input normalization for affected detection and hashing, Yarn patch resolutions lost during prune, and SDKROOT not passed through to repository tasks.
SDKROOT is now passed through to repository tasks, and Vercel OIDC token rotation in .env.local no longer busts cache inputs. Also refreshed the with-vite-module-federation example.
Added task tags with configuration inheritance, exposed task and package tags in the query command, and enabled filtering query tasks and packages by tags from the CLI. Also fixed Yarn patch resolutions being dropped with npm protocol selectors in prune, normalized task inputs for affected detection and hashing, made query commands infer single-package mode, and completed task query metadata for non-script entrypoints.
Updated js-yaml to address CVE-2026-84375 and upgraded Next.js in docs and factory builds for CVE-2026-94545. Also backs off remote artifact requests during outages, stabilizes pnpm per-workspace lockfile hashes, signs complete on-disk artifacts after local cache writes, and bundles docs in the turbo npm package.
Standalone installer URLs for curl | bash are now published. Installer test environments are also isolated.
Turborepo now publishes versioned standalone turbo archives, and the standalone archive job runs on manual releases. Also updated the schema URL example in the docs.
Updated js-yaml to address CVE-2026-84375 and stabilized pnpm per-workspace lockfile hashes. Also added version-matched agent guidance, signed complete on-disk artifacts after local cache writes, and shipped performance work including parsing character classes without compiling regex and a static GraphiQL page.
The turbo npm package now bundles documentation. The rest of the release consists of test infrastructure changes.
Fixes include disabling the remote cache after unrecoverable forbidden responses, sharing concurrent remote-cache token recovery, coordinating artifact requests after rate limiting, and stopping tasks when the parent process exits. Affected detection now respects negated global dependencies, and turbo query embeds the version in its JSON output instead of a separate banner.
Affected detection now respects negated global dependencies, secondary go.work files Go only reads for workspace members are no longer rejected, and remote cache disables itself after unrecoverable forbidden responses. Also shares concurrent remote-cache token recovery, batches dry-run cache existence checks, and moves the version into turbo query JSON output.
Fixed affected task input globs being normalized incorrectly, gitignored files not being ignored in boundaries, and root internal dependency changes not being treated as global. Also reuses the parsed lockfile during lazy graph loading and stops tasks when the parent process exits.
Fixed affected detection so root internal dependency changes are treated as global, and lockfile parsing is now reused during lazy graph loading. The rest of the release is internal refactoring that splits run orchestration, task graph, and run options into dedicated crates and renames turborepo-lib to turborepo-cli.
Turborepo now ignores gitignored files in boundaries, stabilizes boundaries tag order in prune, and normalizes affected task input globs. The release is otherwise dominated by internal refactors extracting task filtering, task access, and watcher logic into dedicated crates.
Fixed spurious microfrontend polyrepo warnings, and refactored the run and execution selector DTOs.
Fixed repeatable CLI flags and allowed esbuild builds for pnpm generators, plus a Windows cache restore test fix. The release also includes internal refactors removing the experimental Cargo compile cache and reorganizing Turborepo crates.
Fixed repeatable CLI flags that had stopped accepting repeated values.
Fixed an issue preventing esbuild builds for pnpm generators. Also adds the Turborepo 2.11 release blog post.
Turborepo can now infer Cargo and uv affectedness from static package inputs. Also hardened cache archive restoration, deferred dependency output validation for lazy scopes, and cached the Windows archive anchor.
Adds static repository discovery with safe affected candidates and derives short names for Go workspace packages. Also preserves task env mode when pruning.
