Turborepo

<!-- Release notes generated using configuration in .github/release.yml at v2.8.7 -->

What's Changed

Changelog

• fix: Keep stdin alive for persistent tasks in stream mode by @anthonyshew in https://github.com/vercel/turborepo/pull/11793
• feat: Add internal agents app for repo automation by @anthonyshew in https://github.com/vercel/turborepo/pull/11799
• chore: Add env vars by @anthonyshew in https://github.com/vercel/turborepo/pull/11800
• fix: Handle subpath package imports in turbo boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/11798
• feat: Add dashboard with run tracking and live logs for agent sandboxes by @anthonyshew in https://github.com/vercel/turborepo/pull/11802
• fix: Normalize bare LF to CRLF in TUI output to prevent garbled logs by @anthonyshew in https://github.com/vercel/turborepo/pull/11804

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.6...v2.8.7

<!-- Release notes generated using configuration in .github/release.yml at v2.8.7-canary.3 -->

What's Changed

Changelog

• feat: Add internal agents app for repo automation by @anthonyshew in https://github.com/vercel/turborepo/pull/11799
• chore: Add env vars by @anthonyshew in https://github.com/vercel/turborepo/pull/11800
• fix: Handle subpath package imports in turbo boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/11798

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.7-canary.2...v2.8.7-canary.3

<!-- Release notes generated using configuration in .github/release.yml at v2.8.7-canary.2 -->

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.2-canary.6...v2.8.7-canary.2

<!-- Release notes generated using configuration in .github/release.yml at main -->

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.2-canary.5...v2.8.2-canary.6

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

Changelog

• chore: Upgrade reqwest toward addressing RUSTSEC-2025-0134 by @anthonyshew in https://github.com/vercel/turborepo/pull/11718
• fix(docs): Fix code syntax highlighting by using correct Shiki CSS variable names by @anthonyshew in https://github.com/vercel/turborepo/pull/11726
• fix: Upgrade async-io to 2.x to drop unmaintained instant crate by @anthonyshew in https://github.com/vercel/turborepo/pull/11719

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.3-canary.11...v2.8.3-canary.12

<!-- Release notes generated using configuration in .github/release.yml at v2.8.7-canary.1 -->

What's Changed

Changelog

• fix: Keep stdin alive for persistent tasks in stream mode by @anthonyshew in https://github.com/vercel/turborepo/pull/11793

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.6...v2.8.7-canary.1

<!-- Release notes generated using configuration in .github/release.yml at v2.8.6 -->

What's Changed

Changelog

• chore: Add internal agents app for repo automation by @anthonyshew in https://github.com/vercel/turborepo/pull/11781
• feat: Add internal agents app for repo automation by @anthonyshew in https://github.com/vercel/turborepo/pull/11783
• chore: Manual audits by @anthonyshew in https://github.com/vercel/turborepo/pull/11785
• chore: Fixing audit agent by @anthonyshew in https://github.com/vercel/turborepo/pull/11786
• chore: Still iterating on sec audit fixer by @anthonyshew in https://github.com/vercel/turborepo/pull/11787
• fix: Emit space for empty vt100 cells to fix TUI repaint on task switch by @anthonyshew in https://github.com/vercel/turborepo/pull/11789

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.5...v2.8.6

<!-- Release notes generated using configuration in .github/release.yml at v2.8.6-canary.1 -->

What's Changed

Changelog

• chore: Add internal agents app for repo automation by @anthonyshew in https://github.com/vercel/turborepo/pull/11781
• feat: Add internal agents app for repo automation by @anthonyshew in https://github.com/vercel/turborepo/pull/11783
• chore: Manual audits by @anthonyshew in https://github.com/vercel/turborepo/pull/11785
• chore: Fixing audit agent by @anthonyshew in https://github.com/vercel/turborepo/pull/11786
• chore: Still iterating on sec audit fixer by @anthonyshew in https://github.com/vercel/turborepo/pull/11787
• fix: Emit space for empty vt100 cells to fix TUI repaint on task switch by @anthonyshew in https://github.com/vercel/turborepo/pull/11789

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.5...v2.8.6-canary.1

<!-- Release notes generated using configuration in .github/release.yml at v2.8.5 -->

What's Changed

@turbo/codemod

• fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11766
• fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11765

@turbo/repository

• fix: Rename cli workspace package to avoid false audit match by @anthonyshew in https://github.com/vercel/turborepo/pull/11767

Changelog

• fix: Add Vary: Accept header to docs markdown endpoint by @molebox in https://github.com/vercel/turborepo/pull/11759
• chore: Agentic workflows app by @anthonyshew in https://github.com/vercel/turborepo/pull/11773
• chore: Add internal agents app for repo automation by @anthonyshew in https://github.com/vercel/turborepo/pull/11776
• chore: Update reproduction request message by @anthonyshew in https://github.com/vercel/turborepo/pull/11778
• Revert "fix: Upgrade node-plop to 0.32.3" by @anthonyshew in https://github.com/vercel/turborepo/pull/11780

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.4...v2.8.5

<!-- Release notes generated using configuration in .github/release.yml at v2.8.5-canary.1 -->

What's Changed

@turbo/codemod

• fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11766
• fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11765

@turbo/repository

• fix: Rename cli workspace package to avoid false audit match by @anthonyshew in https://github.com/vercel/turborepo/pull/11767

Changelog

• fix: Add Vary: Accept header to docs markdown endpoint by @molebox in https://github.com/vercel/turborepo/pull/11759

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.4...v2.8.5-canary.1

<!-- Release notes generated using configuration in .github/release.yml at v2.8.4 -->

What's Changed

create-turbo

• fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11683
• fix: Upgrade inquirer to remove lodash dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/11709
• fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11702
• fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11706

eslint

• fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11681
• fix: Upgrade eslint to v10 to resolve @eslint/plugin-kit ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11705

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in https://github.com/vercel/turborepo/pull/11679

Changelog

• fix: Upgrade tar to 7.5.7 to address security vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11680
• fix: Upgrade ts-json-schema-generator to fix glob command injection vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11684
• fix: Upgrade fumadocs and shiki in docs to resolve mdast-util-to-hast vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11704
• fix: Replace ts-node with tsx to resolve diff DoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11708
• fix: Upgrade bytes to >=1.11.1 to fix RUSTSEC-2026-0007 by @anthonyshew in https://github.com/vercel/turborepo/pull/11715
• chore: Update ratatui dependencies (paste blocked upstream) by @anthonyshew in https://github.com/vercel/turborepo/pull/11717
• Revert "chore: Update ratatui dependencies (paste blocked upstream)" by @anthonyshew in https://github.com/vercel/turborepo/pull/11722
• fix: Upgrade ratatui to 0.30.0 to drop unmaintained paste crate by @anthonyshew in https://github.com/vercel/turborepo/pull/11723
• chore: Upgrade reqwest toward addressing RUSTSEC-2025-0134 by @anthonyshew in https://github.com/vercel/turborepo/pull/11718
• fix(docs): Fix code syntax highlighting by using correct Shiki CSS variable names by @anthonyshew in https://github.com/vercel/turborepo/pull/11726
• fix: Upgrade async-io to 2.x to drop unmaintained instant crate by @anthonyshew in https://github.com/vercel/turborepo/pull/11719
• fix: Migrate from unmaintained serde_yaml to serde_yml by @anthonyshew in https://github.com/vercel/turborepo/pull/11720
• fix: Upgrade test-case and merge to drop unmaintained proc-macro-error by @anthonyshew in https://github.com/vercel/turborepo/pull/11721
• fix: Upgrade indicatif to 0.18.3 to drop unmaintained number_prefix by @anthonyshew in https://github.com/vercel/turborepo/pull/11716
• refactor: Centralize configuration resolution funnel by @anthonyshew in https://github.com/vercel/turborepo/pull/11727
• fix: Upgrade rustls chain to resolve RUSTSEC-2025-0134 by @anthonyshew in https://github.com/vercel/turborepo/pull/11739
• fix: Upgrade test-case to resolve transitive proc-macro-error by @anthonyshew in https://github.com/vercel/turborepo/pull/11737
• fix: Upgrade pest/pest_derive to resolve yanked version by @anthonyshew in https://github.com/vercel/turborepo/pull/11734
• fix: Upgrade git2 to fix RUSTSEC-2026-0008 by @anthonyshew in https://github.com/vercel/turborepo/pull/11729
• fix: Upgrade pprof to fix RUSTSEC-2024-0408 by @anthonyshew in https://github.com/vercel/turborepo/pull/11730
• fix: Upgrade portable-pty to resolve RUSTSEC-2017-0008 by @anthonyshew in https://github.com/vercel/turborepo/pull/11732
• fix: Upgrade oxc_resolver to resolve yanked papaya dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/11733
• fix: Upgrade futures/futures-util to resolve yanked futures-util 0.3.30 by @anthonyshew in https://github.com/vercel/turborepo/pull/11735
• fix: Replace unic-segment with unicode-segmentation in globwatch by @anthonyshew in https://github.com/vercel/turborepo/pull/11736
• fix: Replace serde_yml with serde_yaml_ng to fix RUSTSEC-2025-0067/0068 by @anthonyshew in https://github.com/vercel/turborepo/pull/11755
• fix: Replace oxc_resolver with unrs_resolver to fix yanked papaya dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/11754
• fix: Upgrade node-plop to 0.32.3 by @anthonyshew in https://github.com/vercel/turborepo/pull/11756
• docs: Capitalizaiton in update github-actions.mdx by @anthonyshew in https://github.com/vercel/turborepo/pull/11762

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.3...v2.8.4

<!-- Release notes generated using configuration in .github/release.yml at v2.8.3-canary.11 -->

What's Changed

Changelog

• chore: Update ratatui dependencies (paste blocked upstream) by @anthonyshew in https://github.com/vercel/turborepo/pull/11717
• Revert "chore: Update ratatui dependencies (paste blocked upstream)" by @anthonyshew in https://github.com/vercel/turborepo/pull/11722
• fix: Upgrade ratatui to 0.30.0 to drop unmaintained paste crate by @anthonyshew in https://github.com/vercel/turborepo/pull/11723

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.3-canary.10...v2.8.3-canary.11

<!-- Release notes generated using configuration in .github/release.yml at v2.8.3-canary.10 -->

What's Changed

Changelog

• fix: Replace ts-node with tsx to resolve diff DoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11708
• fix: Upgrade bytes to >=1.11.1 to fix RUSTSEC-2026-0007 by @anthonyshew in https://github.com/vercel/turborepo/pull/11715

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.3-canary.9...v2.8.3-canary.10

<!-- Release notes generated using configuration in .github/release.yml at v2.8.3-canary.9 -->

What's Changed

create-turbo

• fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11702
• fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11706

eslint

• fix: Upgrade eslint to v10 to resolve @eslint/plugin-kit ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11705

Changelog

• fix: Upgrade fumadocs and shiki in docs to resolve mdast-util-to-hast vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11704

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.3-canary.8...v2.8.3-canary.9

<!-- Release notes generated using configuration in .github/release.yml at v2.8.3-canary.8 -->

What's Changed

create-turbo

• fix: Upgrade inquirer to remove lodash dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/11709

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.3-canary.7...v2.8.3-canary.8

<!-- Release notes generated using configuration in .github/release.yml at v2.8.3-canary.7 -->

What's Changed

create-turbo

• fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11683

Changelog

• fix: Upgrade ts-json-schema-generator to fix glob command injection vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11684

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.3-canary.6...v2.8.3-canary.7

<!-- Release notes generated using configuration in .github/release.yml at v2.8.3-canary.6 -->

What's Changed

eslint

• fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11681

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.3-canary.5...v2.8.3-canary.6

<!-- Release notes generated using configuration in .github/release.yml at v2.8.3-canary.5 -->

What's Changed

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in https://github.com/vercel/turborepo/pull/11679

Changelog

• fix: Upgrade tar to 7.5.7 to address security vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11680

Full Changelog: https://github.com/vercel/turborepo/compare/v2.8.3...v2.8.3-canary.5