Turborepo Updates & Release Notes

What's Changed

Changelog

• chore: Release Turborepo 2.11.11-canary.1 by @github-actions[bot] in #14907
• feat: Add canary version to standalone installers by @anthonyshew in #14908
• chore: Update with-tailwind example by @vercel-gh-bot-4[bot] in #14904
• perf: Speed up prefix environment matching by @vercel-gh-bot-3[bot] in #14867
• ci: Move GitHub Actions off Node 20 action runtimes by @swarnava in #14930
• docs: Add Vercel CI pointers to the Vercel guide by @anthonyshew in #14929
• fix: Restore shell completion by @sahyl in #14915
• perf: Verify managed tools at setup instead of every run by @anthonyshew in #14911
• refactor: Render managed launchers and runtime variables from export data by @anthonyshew in #14919
• refactor: Keep per-repository setup state in the user store by @anthonyshew in #14920
• feat: Install managed tools into a shared content-addressed store by @anthonyshew in #14921
• feat: Collect unused managed tools across repositories by @anthonyshew in #14922
• chore: Remove the setup artifact cache by @anthonyshew in #14923
• docs: Document the shared managed tool store by @anthonyshew in #14924
• test: Restore store coverage for unsafe trees, permissions, and crashes by @anthonyshew in #14926
• perf: Make turbo setup faster on cold and reused runs by @anthonyshew in #14942
• chore: Update with-vitest example by @vercel-gh-bot-5[bot] in #14945
• fix: Respect head refs when comparing lockfiles by @sahyl in #14918
• docs: Use latest shadcn CLI in Turborepo guide by @jianyunyi in #14941
• chore(deps): Update dependency @vercel/geistdocs to v2.14.4 by @vercel-gh-bot-5[bot] in #14912
• chore: Update with-ultracite example by @vercel-gh-bot-4[bot] in #14917
• docs: Fix the Prisma guide link and the with-prisma seed script by @ankur-arch in #14944
• chore: Update with-vite-module-federation example by @vercel-gh-bot-3[bot] in #14933
• docs: Drop invalid --depth=0 from clone examples by @Manishram-ai in #14931
• feat: Show turbo.lock progress in turbo setup by @anthonyshew in #14949
• chore: Remove automatic tool store cleanup by @anthonyshew in #14951
• feat: Store managed tools under ~/.local/share on macOS by @anthonyshew in #14952
• feat: Make turbo setup --plan output easier to read by @anthonyshew in #14953
• fix: Repair tool trees with a missing executable in plain turbo setup by @anthonyshew in #14954
• test: Speed up root inspection recursion test by @anthonyshew in #14956
• perf: Make creating turbo.lock about 10x faster by @anthonyshew in #14958
• feat: Make turbo setup output consistent by @anthonyshew in #14957
• chore: Update with-yarn example by @vercel-gh-bot-2[bot] in #14961
• fix: Scope pnpm overrides changes to affected packages by @mehulkar in #14959

New Contributors

• @jianyunyi made their first contribution in #14941
• @Manishram-ai made their first contribution in #14931

Full Changelog: v2.11.11-canary.1...v2.11.11-canary.2

Original source

What's Changed

Changelog

• chore: Release Turborepo 2.11.9-canary.1 by @github-actions[bot] in #14817
• fix: Allow native package manager configuration during setup by @anthonyshew in #14816
• refactor: Remove setup lifecycle script controls by @anthonyshew in #14818
• docs: Use .NET in the multi-language guide by @sahyl in #14793
• fix(cache): Parallelize dry-run HEAD fallback by @FOWEPJF255 in #14801
• fix: Allow non-recursive Turbo commands in root tasks by @sahyl in #14814
• chore: Release Turborepo 2.11.9 by @github-actions[bot] in #14824
• chore(deps): Update dependency @vercel/geistdocs to v2 by @vercel-gh-bot-4[bot] in #14417
• chore: Update with-gatsby example by @vercel-gh-bot-3[bot] in #14796
• fix: Avoid pnpm batch-shim shutdown hangs on Windows by @sahyl in #14819
• chore(deps): Update dependency @vercel/geistdocs to v2.11.0 by @vercel-gh-bot-3[bot] in #14832
• fix: Exclude tool-managed directories from local dependency inputs by @PedroRosalba in #14696
• fix: Match git's text=auto binary detection in file hashing by @PedroRosalba in #14697
• fix: Drop @react-router/dev from Remix match list by @Pcmhacker-piro in #14800
• fix: Match package configuration files and directory inputs in task-level affected detection by @PedroRosalba in #14804
• fix: Parse pnpm 8 single-project lockfiles by @PedroRosalba in #14806
• fix: Keep task env vars in the hash when globalEnv excludes inferred vars by @PedroRosalba in #14805
• docs: Generate the sitemap from Geistdocs sources by @molebox in #14865
• fix: Restore cached symlinks when outputs are already on disk by @PedroRosalba in #14807
• chore: Remove CODEOWNERS file by @anthonyshew with @Copilot in #14810
• feat: Enable WebMCP for Turborepo docs by @anthonyshew in #14828
• fix: Exit quietly when turbo ls output is piped to a closed reader by @drakeo338 in #14868
• fix: Distrust compromised eMudhra intermediate certificates by @anthonyshew in #14876
• chore: Release Turborepo 2.11.10 by @github-actions[bot] in #14877
• fix: Remove redundant task disclaimers from setup output by @anthonyshew in #14870
• fix: Report declared package manager versions in turbo info by @anthonyshew in #14830
• feat: Stop requiring .turbo/ to be Git-ignored in turbo setup by @anthonyshew in #14822
• fix: Isolate JS test fixture cleanup between suites by @anthonyshew in #14864
• fix: Remove Linux host version fingerprints from Python caching by @anthonyshew in #14861
• fix: Write the restore manifest before a local cache restore returns by @PedroRosalba in #14872
• fix: Handle SIGHUP in the npm wrapper by @anthonyshew in #14856
• fix: Keep remote cache reads when uploads are forbidden or the token is read-only by @anthonyshew in #14797
• fix: Discover new workspace packages in watch mode by @anthonyshew in #14858
• refactor: Remove verify-system from turbo setup by @anthonyshew in #14821
• fix: Hash executable permissions behind a future flag by @anthonyshew in #14859
• fix: Hash tracked outputs as task inputs by @anthonyshew in #14831
• fix: Hash Bun patch contents for cache invalidation by @anthonyshew in #14853
• fix: Debounce watch rebuilds for bursts of edits by @anthonyshew in #14857
• fix: Hash symlink input contents within repository boundaries by @anthonyshew in #14825
• fix: Include both paths of staged renames in affected runs by @sahyl in #14855
• fix: Restrict saved Vercel credentials to Vercel endpoints by @vercel-security-reviewer-slack[bot] in #14878
• chore(deps): Update dependency @vercel/geistdocs to v2.12.3 by @vercel-gh-bot-5[bot] in #14869
• chore: Update with-prisma example by @vercel-gh-bot-2[bot] in #14879
• examples: Update Node.js version in Dockerfile to v24.22.1 by @swarnava in #14881
• ci: Update setup-uv to v10.3.2 and uv to 0.13.5 by @swarnava in #14882
• chore(deps): Update dependency @vercel/geistdocs to v2.13.1 by @vercel-gh-bot-4[bot] in #14883
• chore(deps): Update dependency @vercel/geistdocs to v2.13.2 by @vercel-gh-bot-5[bot] in #14892
• chore: Update with-rsbuild-module-federation example by @vercel-gh-bot-4[bot] in #14889
• ci: Move macOS release builds off retiring macos-14 runners by @schrockn in #14886
• chore: Update with-nestjs example by @vercel-gh-bot-2[bot] in #14834
• chore: Update with-npm example by @vercel-gh-bot-4[bot] in #14863
• examples: Upgrade with-react-native-web to Expo SDK 58 by @Gourav224 in #14884
• fix: Keep uv members nested under excluded directories by @anthonyshew in #14894
• chore: Update with-solid example by @vercel-gh-bot-4[bot] in #14895
• fix: Remove setup storage summaries by @anthonyshew in #14893
• fix: Harmonize homepage metric letter spacing by @christopherkindl in #14897
• fix: Scope pnpm lockfile v9 patchedDependencies changes to consuming packages by @mehulkar in #14899
• chore(deps): Update dependency @vercel/geistdocs to v2.14.0 by @vercel-gh-bot-4[bot] in #14900
• chore: Remove unncessary version key from docker compose yaml file by @yousefdawood7 in #14862
• chore(deps): Update dependency @vercel/geistdocs to v2.14.1 by @vercel-gh-bot-5[bot] in #14905
• fix: Restore cache files without temporary names by @anthonyshew in #14898
• feat: Redesign turbo setup terminal output by @anthonyshew in #14906

New Contributors

• @FOWEPJF255 made their first contribution in #14801
• @vercel-security-reviewer-slack[bot] made their first contribution in #14878
• @schrockn made their first contribution in #14886
• @Gourav224 made their first contribution in #14884

Full Changelog: v2.11.9-canary.1...v2.11.11-canary.1

Original source

What's Changed

Changelog

• fix: Allow non-recursive Turbo commands in root tasks by @sahyl in #14814
• chore: Release Turborepo 2.11.9 by @github-actions[bot] in #14824
• chore(deps): Update dependency @vercel/geistdocs to v2 by @vercel-gh-bot-4[bot] in #14417
• chore: Update with-gatsby example by @vercel-gh-bot-3[bot] in #14796
• fix: Avoid pnpm batch-shim shutdown hangs on Windows by @sahyl in #14819
• chore(deps): Update dependency @vercel/geistdocs to v2.11.0 by @vercel-gh-bot-3[bot] in #14832
• fix: Exclude tool-managed directories from local dependency inputs by @PedroRosalba in #14696
• fix: Match git's text=auto binary detection in file hashing by @PedroRosalba in #14697
• fix: Drop @react-router/dev from Remix match list by @Pcmhacker-piro in #14800
• fix: Match package configuration files and directory inputs in task-level affected detection by @PedroRosalba in #14804
• fix: Parse pnpm 8 single-project lockfiles by @PedroRosalba in #14806
• fix: Keep task env vars in the hash when globalEnv excludes inferred vars by @PedroRosalba in #14805
• docs: Generate the sitemap from Geistdocs sources by @molebox in #14865
• fix: Restore cached symlinks when outputs are already on disk by @PedroRosalba in #14807
• chore: Remove CODEOWNERS file by @anthonyshew with @Copilot in #14810
• feat: Enable WebMCP for Turborepo docs by @anthonyshew in #14828
• fix: Exit quietly when turbo ls output is piped to a closed reader by @drakeo338 in #14868
• fix: Distrust compromised eMudhra intermediate certificates by @anthonyshew in #14876

Full Changelog: v2.11.9...v2.11.10

Original source

What's Changed

Changelog

• test: Add owned setup policy fixtures for CLI tests by @anthonyshew in #14456
• feat: Represent matching Node-bundled npm ownership by @anthonyshew in #14457
• feat: Preserve setup lock declarations during prune by @anthonyshew in #14459
• refactor: Add guarded setup publication primitives by @anthonyshew in #14460
• chore: Release Turborepo 2.11.8-canary.2 by @github-actions[bot] in #14458
• chore: Update non-monorepo example by @vercel-gh-bot-4[bot] in #14452
• feat: Provision frozen Node and pnpm through setup by @anthonyshew in #14462
• fix: Exclude optional npm peers from pruned lockfiles by @anthonyshew in #14470
• feat: Validate managed Node and pnpm readiness by @anthonyshew in #14464
• feat: Resolve exact verified registry artifacts for setup locks by @anthonyshew in #14465
• feat: Check installed setup tools without mutation by @anthonyshew in #14467
• feat: Resolve captured Node and pnpm lock cohorts by @anthonyshew in #14466
• fix: Guard setup publication plans and discovery indirections by @anthonyshew in #14468
• fix: Release setup locks in their acquiring process by @anthonyshew in #14472
• feat: Create and reconcile local setup locks by @anthonyshew in #14473
• feat: Refresh managed setup locks explicitly by @anthonyshew in #14474
• feat: Force reinstall locked setup tools by @anthonyshew in #14475
• feat: Bind setup records to installation generations by @anthonyshew in #14476
• chore: Update with-berry example by @vercel-gh-bot-3[bot] in #14487
• fix: Generalize repository bootstrap across toolchains by @PedroRosalba in #14444
• fix: Keep Go discovery stable when the repository is reached through a symlink by @PedroRosalba in #14445
• fix: Reject non-member local sources in the uv manifest fallback by @PedroRosalba in #14446
• fix: Hash ruff and pytest configuration between the root and uv members by @PedroRosalba in #14447
• fix: Hash Clippy configuration for Cargo lint tasks by @PedroRosalba in #14448
• fix: Carry uv tool configuration into pruned workspaces by @PedroRosalba in #14449
• fix: Report inferred framework env vars for deferred tasks in dry runs by @PedroRosalba in #14478
• docs: Explain declaring Cargo sources read from outside the crate by @PedroRosalba in #14480
• fix: Upgrade turbo-gen Handlebars to 4.7.10 by @anthonyshew in #14471
• chore: Add copyable Factory snapshot command by @anthonyshew in #14481
• feat: Validate sealed native setup baselines by @anthonyshew in #14482
• fix: Prevent Git index refresh during dirty hash collection by @anthonyshew in #14489
• fix: Disable agent guidance by default by @anthonyshew in #14490
• chore: Release Turborepo 2.11.8 by @github-actions[bot] in #14789
• perf: Prefetch Cargo metadata during lazy graph construction by @anthonyshew in #14497
• perf: Compute Berry lockfile closures once across workspaces by @anthonyshew in #14499
• perf: Check cache hit outputs in place instead of on the blocking pool by @anthonyshew in #14524
• perf: Speed up Berry lockfile loading by @anthonyshew in #14500
• perf: Parse bun.lock without building a JSON syntax tree by @anthonyshew in #14502
• perf: Skip the dry run cache batch window when there is no remote cache by @anthonyshew in #14505
• perf: Emit lockfile closures pre-sorted and cheapen closure interning by @anthonyshew in #14525
• perf: Reuse configuration derived from turbo.json between the shim and the CLI by @anthonyshew in #14521
• feat: Report locked tools-only setup plans by @anthonyshew in #14483
• perf: Compute Bun lockfile closures once across workspaces by @anthonyshew in #14501
• perf: Reuse open parent directories when restoring cache archives by @anthonyshew in #14506
• perf: Skip dropping the run right before turbo run exits by @anthonyshew in #14507
• perf: Match literal input exclusions without compiling globs by @anthonyshew in #14510
• perf: Copy pruned package files in parallel by @anthonyshew in #14512
• feat: Report proposed first-lock and refresh setup plans by @anthonyshew in #14571
• perf: Compress large cache archives with multithreaded zstd by @anthonyshew in #14698
• perf: Read tracked file stats from directory listings on Windows by @anthonyshew in #14633
• perf: Diff changed lockfile resolutions with a merge instead of ordered sets by @anthonyshew in #14630
• perf: Write dry run text output through one buffered stdout handle by @anthonyshew in #14625
• perf: Parse pnpm-workspace.yaml once per command by @anthonyshew in #14620
• perf: Write each file trace error to stderr in a single call by @anthonyshew in #14618
• perf: Reuse glob validation results when re-validating turbo.json in the language server by @anthonyshew in #14615
• perf: Keep git subprocesses off the critical path of dry runs by @anthonyshew in #14610
• perf: Classify watch file changes when they arrive instead of on a 100ms poll by @anthonyshew in #14600
• perf: Buffer TUI raw-output spool writes by @anthonyshew in #14597
• perf: Add the turbo query version key without re-parsing the response by @anthonyshew in #14592
• perf: Replay cached task logs in whole-line chunks by @anthonyshew in #14590
• perf: Write each boundaries diagnostic to stderr in a single call by @anthonyshew in #14587
• perf: Walk leading-globstar input trees in parallel without wax by @anthonyshew in #14511
• perf: Reuse open parent directories when writing cache archives by @anthonyshew in #14513
• perf: Index Bun lockfile subgraph lookups instead of rescanning all packages by @anthonyshew in #14514
• perf: Render the pruned lockfile while package files are copied by @anthonyshew in #14515
• feat: Resolve exact native npm lock cohorts by @anthonyshew in #14484
• perf: Batch prefixed task output into one write per chunk by @anthonyshew in #14588
• perf: Share one allocation per external package identity by @anthonyshew in #14528
• perf: Remove quadratic package-name scan from microfrontends discovery by @anthonyshew in #14527
• perf: Render file trace errors on several threads by @anthonyshew in #14623
• perf: Check boundaries packages in parallel again by @anthonyshew in #14598
• perf: Read PTY child output in 8 KiB chunks by @anthonyshew in #14594
• perf: Load each package's tsconfig once when checking boundaries by @anthonyshew in #14589
• perf: Skip the file watcher round trip when checking outputs for new task hashes by @anthonyshew in #14626
• perf: Refresh only memory stats in turbo info by @anthonyshew in #14593
• perf: Walk and record prune copy plans in parallel by @anthonyshew in #14522
• feat: Reconcile sealed clone-local setup selections by @anthonyshew in #14485
• test: Add macOS ACL safety prerequisite for setup state by @anthonyshew in #14493
• fix: Accept Homebrew's bundled npm prefix in setup source preflight by @anthonyshew in #14566
• feat: Report ignored version manager declarations during setup by @anthonyshew in #14531
• feat: Provision clone-local setup without lock writes by @anthonyshew in #14486
• feat: Integrate native npm provisioning into setup by @anthonyshew in #14491
• test: Check pruned setup outputs through the real CLI by @anthonyshew in #14529
• feat: Parse Go toolchain declarations for setup by @anthonyshew in #14530
• feat: Parse root uv version requests for setup by @anthonyshew in #14533
• test: Prove Unix process parity for native and npm-wrapped turbo run by @anthonyshew in #14539
• feat: Add root-only turbo setup policy to turbo.json by @anthonyshew in #14541
• test: Interrupt Unix turbo setup through both entrypoints by @anthonyshew in #14542
• feat: Bootstrap a verified repository-scoped rustup by @anthonyshew in #14543
• feat: Follow approved release CDN redirects in verified downloads by @anthonyshew in #14557
• test: Prove native Windows process parity for standalone and npm-wrapped turbo run by @anthonyshew in #14565
• fix: Explain missing Git and non-repository setup roots by @anthonyshew in #14567
• fix: Keep non-UTF-8 arguments from crashing the turbo shim by @anthonyshew in #14570
• feat: Install managed tool generations on native Windows by @anthonyshew in #14582
• feat: Add the shell hook by default from the POSIX installer by @anthonyshew in #14608
• feat: Accept Corepack SHA-224 package manager pins by @anthonyshew in #14640
• fix: Accept official Bun ZIP metadata in verified archives by @anthonyshew in #14657
• fix: Write turbo.lock as indented JSON by @anthonyshew in #14738
• fix: Accept project .npmrc files with only install-layout settings by @anthonyshew in #14740
• feat: Define native lifecycle-script policy for dependency setup by @anthonyshew in #14661
• feat: Resolve uv requests to official locked releases by @anthonyshew in #14537
• feat: Install locked uv with repo-scoped launchers by @anthonyshew in #14538
• feat: Record official Go release artifacts in turbo.lock by @anthonyshew in #14532
• feat: Create, refresh, and freeze uv selections in turbo setup by @anthonyshew in #14547
• feat: Resolve root Python requests through managed uv by @anthonyshew in #14552
• fix: Lock managed Python for every supported architecture by @anthonyshew in #14691
• feat: Select Linux setup artifacts by detecting the host libc at runtime by @anthonyshew in #14637
• feat: Provision verified Go toolchain archives by @anthonyshew in #14544
• feat: Provision locked rustup from turbo setup by @anthonyshew in #14548
• fix: Keep managed setup working under Ubuntu's default 0002 umask by @anthonyshew in #14666
• feat: Provision pnpm 11 releases with their module entry points by @anthonyshew in #14742
• fix: Accept npm and pnpm wrapper environments in setup source policy by @anthonyshew in #14643
• feat: Extract official python-build-standalone archives by @anthonyshew in #14669
• feat: Declare additional repository tools in root setup policy by @anthonyshew in #14574
• fix: Parse JSX in JavaScript files by @sahyl in #14794
• fix: Complete CI frozen setup behavior by @anthonyshew in #14492
• feat: Provision tools with plain turbo setup and report skipped dependencies by @anthonyshew in #14650
• feat: Record trusted setup installations outside the repository by @anthonyshew in #14494
• feat: Provision pnpm 12 native binaries from verified platform packages by @anthonyshew in #14743
• feat: Parse root rust-toolchain files into portable requests by @anthonyshew in #14550
• feat: Provision locked Python interpreters through managed uv by @anthonyshew in #14559
• feat: Sync uv workspaces from the committed uv.lock by @anthonyshew in #14561
• feat: Resolve Rust toolchain requests to exact locked channels by @anthonyshew in #14551
• feat: Authorize prepared tools from private setup evidence by @anthonyshew in #14495
• feat: Install locked Rust toolchains through private rustup by @anthonyshew in #14562
• feat: Create and update Rust selections in turbo.lock by @anthonyshew in #14563
• feat: Prefetch locked Cargo dependencies with managed cargo by @anthonyshew in #14564
• feat: Activate trusted Node and pnpm for task execution by @anthonyshew in #14508
• feat: Enforce managed run compatibility before CLI handoff by @anthonyshew in #14509
• fix: Close managed execution authorization gaps by @anthonyshew in #14516
• fix: Preserve informational exits in managed repositories by @anthonyshew in #14519
• feat: Reuse trusted installations for offline setup by @anthonyshew in #14518
• feat: Add experimental managed Node and pnpm peer capabilities by @anthonyshew in #14517
• feat: Lock additional tool artifacts and detect declaration drift by @anthonyshew in #14575
• feat: Install additional tools through a generic verified artifact backend by @anthonyshew in #14577
• feat: Activate locked uv and Python and check their readiness by @anthonyshew in #14649
• fix: Precompile managed Python bytecode while staging by @anthonyshew in #14670
• feat: Prune setup records for deleted, moved, or re-cloned roots by @anthonyshew in #14655
• feat: Activate locked Rust toolchains and check their readiness by @anthonyshew in #14651
• feat: Provision locked additional tools from turbo setup by @anthonyshew in #14581
• feat: Create and refresh Go entries in turbo.lock during local setup by @anthonyshew in #14553
• feat: Prefetch Go modules without changing go.mod or go.sum by @anthonyshew in #14554
• feat: Advertise the managed Node/pnpm peer contract on GNU Linux x64 by @anthonyshew in #14641
• feat: Provision locked Yarn classic binaries by @anthonyshew in #14555
• feat: Add repository and CLI controls for skipping lifecycle scripts by @anthonyshew in #14662
• feat: Explain whether turbo setup repairs tools or updates the lock by @anthonyshew in #14654
• feat: Reuse verified tool downloads across repositories by @anthonyshew in #14535
• perf: Cache installed tool tree hashes per generation by @anthonyshew in #14653
• test: Exercise global setup then plain turbo run end to end by @anthonyshew in #14642
• feat: Apply root setup policy and CLI overrides in turbo setup by @anthonyshew in #14663
• feat: Pin and verify the xz Rust tarballs rustup downloads by @anthonyshew in #14771
• feat: Hash locked additional-tool artifact identity portably by @anthonyshew in #14583
• feat: Provision locked modern Yarn bundles by @anthonyshew in #14556
• feat: Provision locked Bun binaries without global Bun by @anthonyshew in #14558
• feat: Provision offline setup from verified cached artifacts by @anthonyshew in #14540
• feat: Measure and remove inactive managed tool storage by @anthonyshew in #14549
• feat: Create and update turbo.lock for Yarn and Bun during local setup by @anthonyshew in #14560
• feat: Validate installed Yarn and Bun activation plans and checks by @anthonyshew in #14648
• feat: Set up Bun-only repositories without a Node declaration by @anthonyshew in #14658
• feat: Add a shell hook that activates managed tools in bash and zsh by @anthonyshew in #14603
• feat: Add an uninstall mode to the POSIX installer by @anthonyshew in #14636
• test: Recover setup killed mid-download and mid-unpack by @anthonyshew in #14569
• feat: Route setup downloads through credential-free mirror overrides by @anthonyshew in #14545
• test: Race concurrent setup writers over one shared cache by @anthonyshew in #14573
• feat: Clean up replaced managed tools automatically during setup by @anthonyshew in #14652
• feat: Add the turbo exec command surface by @anthonyshew in #14536
• feat: Run turbo exec commands with the managed environment by @anthonyshew in #14568
• feat: Activate locked Go and check its readiness in turbo setup --check by @anthonyshew in #14644
• feat: Name the missing Node declaration when --no-lock setup cannot start by @anthonyshew in #14701
• feat: Add shell hook support for fish and PowerShell by @anthonyshew in #14606
• fix: Run turbo setup in pruned output without a Git repository by @anthonyshew in #14639
• fix: Accept umask 0002 ancestors of trusted setup records by @anthonyshew in #14702
• fix: Guard managed turbo exec local CLI handoff by @anthonyshew in #14572
• feat: Lock and verify system Node.js and pnpm under verify-system policy by @anthonyshew in #14664
• feat: Record and authorize trusted setup roots on native Windows by @anthonyshew in #14659
• test: Verify turbo exec end to end from nested paths by @anthonyshew in #14578
• test: Prove Unix turbo exec parity for standalone and npm wrapper by @anthonyshew in #14580
• feat: Provision managed Node and pnpm on native Windows by @anthonyshew in #14584
• fix: Preserve turbo exec behavior for Windows .cmd launchers and Ctrl+C by @anthonyshew in #14646
• test: Prove native Windows turbo exec entrypoint parity without managed tools by @anthonyshew in #14660
• fix: Stop native Windows turbo setup on Ctrl+C from either entrypoint by @anthonyshew in #14591
• fix: Refuse managed setup on Windows arm64 hosts, including x64 turbo under emulation by @anthonyshew in #14672
• fix: Propose setup plans with every ecosystem's lock resolver by @anthonyshew in #14744
• fix: Detect the host libc for managed turbo run by @anthonyshew in #14710
• feat: Add a frozen npm install adapter for setup dependencies by @anthonyshew in #14718
• feat: Activate additional tool binaries in managed run and exec by @anthonyshew in #14706
• feat: Install locked npm dependencies during turbo setup by @anthonyshew in #14721
• feat: Follow HTTPS redirects for additional-tool artifacts by @anthonyshew in #14707
• feat: Configure setup mirrors in the root setup policy by @anthonyshew in #14700
• feat: Record trusted setup roots for --no-lock installs by @anthonyshew in #14727
• feat: Activate and hash --no-lock selections in plain turbo run by @anthonyshew in #14729
• feat: Install additional-tool archives without a top-level folder by @anthonyshew in #14708
• feat: Mirror Bun, uv, and Python release downloads by @anthonyshew in #14714
• feat: Mirror Go and Rust release downloads by @anthonyshew in #14739
• feat: Provision declared npm without lock writes by @anthonyshew in #14730
• feat: Activate every managed ecosystem in turbo run, including its own probes by @anthonyshew in #14711
• feat: Download additional tools through the shared cache, offline mode, and a mirror by @anthonyshew in #14709
• feat: Resolve native task commands through managed binaries by @anthonyshew in #14712
• test: Cover the Unix additional-tool setup, run, and recovery matrix by @anthonyshew in #14717
• feat: Qualify additional tools on native Windows x64 by @anthonyshew in #14731
• feat: Use verified system tools in managed turbo run by @anthonyshew in #14713
• test: Exercise managed Go setup then plain turbo run without host Go by @anthonyshew in #14719
• test: Exercise managed Rust setup then plain turbo run without host Rust by @anthonyshew in #14720
• test: Exercise managed uv and Python setup then plain turbo run without host Python by @anthonyshew in #14722
• test: Exercise managed Yarn and Bun setup then plain turbo run without host tools by @anthonyshew in #14723
• fix: Let turbo run and turbo exec use verify-system tools on musl hosts by @anthonyshew in #14751
• test: Qualify Yarn classic and modern Yarn setup on native Windows x64 by @anthonyshew in #14746
• feat: Provision managed uv on native Windows x64 by @anthonyshew in #14749
• feat: Provision locked Rust toolchains on native Windows x64 by @anthonyshew in #14752
• fix: Kill the command when turbo exec is killed by @anthonyshew in #14757
• feat: Provision managed Go from the official Windows x64 zip by @anthonyshew in #14748
• feat: Provision managed Python on native Windows x64 by @anthonyshew in #14756
• feat: Activate managed tools from the PowerShell hook on native Windows x64 by @anthonyshew in #14747
• feat: Activate managed Go with a plain GOROOT on native Windows by @anthonyshew in #14754
• feat: Provision locked Bun on native Windows x64 by @anthonyshew in #14750
• fix: Keep PowerShell hook output ASCII so console code pages cannot corrupt PATH by @anthonyshew in #14755
• feat: Provision pnpm 12 native binaries on native Windows x64 by @anthonyshew in #14753
• fix: Kill the local turbo when the global turbo that handed off is killed by @anthonyshew in #14785
• feat: Activate managed Rust on native Windows x64 by @anthonyshew in #14758
• feat: Activate managed Go from the shell hook on native Windows x64 by @anthonyshew in #14764
• fix: Block cache restoration writes to Git metadata by @anthonyshew in #14808
• feat: Report locked dependency actions in turbo setup plans and checks by @anthonyshew in #14724
• feat: Advertise the managed-run peer contract on every claimed platform by @anthonyshew in #14780
• fix: Activate managed tools in turbo watch by @anthonyshew in #14779
• perf: Stamp installed tool trees on native Windows by @anthonyshew in #14774
• feat: Install pnpm dependencies in frozen mode during setup by @anthonyshew in #14726
• feat: Measure setup outcomes through standard telemetry by @anthonyshew in #14546
• feat: Install Yarn dependencies immutably during setup by @anthonyshew in #14733
• fix: Activate managed tools in commands that discover the repository by @anthonyshew in #14784
• feat: Install Bun dependencies from a frozen lock during setup by @anthonyshew in #14734
• feat: Sync locked uv workspaces during turbo setup by @anthonyshew in #14735
• fix: Reject Windows prefixed paths during cache restore by @anthonyshew in #14809
• feat: Prefetch locked Cargo dependencies during turbo setup by @anthonyshew in #14736
• feat: Prefetch Go modules during turbo setup by @anthonyshew in #14737
• test: Cover managed uv and Python setup on native Windows x64 by @anthonyshew in #14761
• feat: Prefetch Cargo dependencies and report the MSVC linker on Windows by @anthonyshew in #14760
• feat: Install locked dependencies offline from native caches by @anthonyshew in #14759
• feat: Prefetch Go modules with managed Go on native Windows by @anthonyshew in #14762
• feat: Install locked JavaScript dependencies on native Windows x64 by @anthonyshew in #14763
• feat: Probe repository-local turbo on Windows and cover pins on every platform by @anthonyshew in #14781
• feat: Export managed runtime variables from the shell hook on every platform by @anthonyshew in #14802
• refactor: Route setup's Git queries through an injectable boundary by @anthonyshew in #14811
• perf: Load each tsconfig once per file trace by @anthonyshew in #14627
• perf: Overlap reading and compression when writing large cache archives by @anthonyshew in #14604
• perf: Speed up pnpm lockfile pruning and encoding in turbo prune by @anthonyshew in #14520
• perf: Prefetch remote cache artifacts as soon as task hashes are known by @anthonyshew in #14585
• perf: Remove the remaining quadratic passes from the Bun prune subgraph by @anthonyshew in #14523
• perf: Memoize Cargo.lock closures and share resolution identities by @anthonyshew in #14498
• perf: Match node_modules-style exclusions by path segment instead of compiling globs by @anthonyshew in #14634
• perf: Avoid waking the rayon pool for small workspaces by @anthonyshew in #14602
• perf: Overlap affected change detection with package graph construction by @anthonyshew in #14496
• perf: Find line breaks in task output a block at a time by @anthonyshew in #14601
• perf: Buffer task log file writes in 64 KiB blocks by @anthonyshew in #14607
• perf: Hand lockfile closures to JavaScript resolution as indices by @anthonyshew in #14596
• perf: Share each file's text across its trace errors by @anthonyshew in #14632
• fix: Preserve task output after non-zero exits by @vercel-gh-bot-3[bot] in #14373
• perf: Overlap reading and compression when building cache archives for upload by @anthonyshew in #14617
• perf: Install cache archives locally while they upload by @anthonyshew in #14622
• perf: Skip newline normalization copies for already-normalized TUI output by @anthonyshew in #14595
• chore: Update with-changesets example by @vercel-gh-bot-3[bot] in #14638
• fix: Attribute Cargo.lock changes to the crates whose dependencies changed by @PedroRosalba in #14656
• fix: Stop installing the Unix shell hook automatically by @anthonyshew in #14813

New Contributors

• @PedroRosalba made their first contribution in #14444

Full Changelog: v2.11.8-canary.2...v2.11.9-canary.1

Original source

What's Changed

Changelog

• chore: Release Turborepo 2.11.7 by @github-actions[bot] in #14357
• chore: Update with-vitest example by @vercel-gh-bot-3[bot] in #14355
• feat: Add experimental setup future flag by @anthonyshew in #14361
• fix: Remove Bash dependency from strict environment tests by @vercel-gh-bot-3[bot] in #14362
• fix: Use repository package manager for automatic Turbo downloads by @vercel-gh-bot-3[bot] in #14360
• chore: Improve Factory chat and model controls by @vercel-gh-bot-3[bot] in #14368
• chore: Add Linear connector to Factory by @vercel-gh-bot-3[bot] in #14369
• chore: Remove HarnessAgent from Factory by @vercel-gh-bot-3[bot] in #14370
• chore: Remove Factory UI clutter by @vercel-gh-bot-2[bot] in #14371
• feat: Add shared platform primitives for setup and shim by @anthonyshew in #14363
• fix: Populate task graphs for affected and filtered listings by @sahyl in #14366
• feat: Add bounded checksum-verifying downloads by @anthonyshew in #14374
• feat: Validate setup npm version requests by @anthonyshew in #14375
• fix: Prune unused pnpm catalog snapshots by @vercel-gh-bot-3[bot] in #14376
• feat: Resolve Node versions from native declarations by @anthonyshew in #14378
• feat: Honor tool-download proxy and certificate settings by @anthonyshew in #14379
• feat: Check bounded setup version-request overlap by @anthonyshew in #14381
• feat: Discover setup JavaScript package-manager declarations by @anthonyshew in #14382
• feat: Verify local artifact bytes without HTTP by @anthonyshew in #14383
• fix: Deflake concurrent agent guidance updates by @anthonyshew in #14388
• chore: Remove Linear from factory by @anthonyshew in #14389
• feat: Extract verified TAR archives into private staging by @anthonyshew in #14384
• feat: Add experimental setup command surface by @anthonyshew in #14385
• chore: Remove Factory branch naming restrictions by @vercel-gh-bot-4[bot] in #14391
• chore: Consolidate CI into one required summary by @anthonyshew in #14390
• docs: Clarify task graph filter traversal by @vercel-gh-bot-2[bot] in #14392
• feat: Extract safe Node TAR symlinks by @anthonyshew in #14393
• feat: Infer setup roots without package managers by @anthonyshew in #14395
• feat: Add atomic managed tool installation inventory by @anthonyshew in #14398
• fix: Invalidate managed repositories when turbo.lock changes by @anthonyshew in #14396
• feat: Safely extract verified ZIP archives by @anthonyshew in #14394
• test: Add installed-wrapper process launcher by @anthonyshew in #14401
• fix: Avoid duplicate code CI on pull request reviews by @anthonyshew in #14414
• chore(deps): Update dependency @vercel/geistdocs to v1.28.1 by @vercel-gh-bot-4[bot] in #14416
• docs: Remove premature setup guidance by @anthonyshew in #14409
• feat: Validate portable setup tool resolutions by @anthonyshew in #14400
• fix: Preserve scoped tool paths and owner-executable exports by @anthonyshew in #14403
• fix: Preserve Node runtime failure policy provenance by @anthonyshew in #14406
• feat: Add an internal managed-run capability query by @anthonyshew in #14408
• feat: Verify bounded SHA-512 tool artifacts by @anthonyshew in #14411
• test: Stabilize lockfile closure parity coverage by @anthonyshew in #14420
• fix: Repair missing install generations and share tool readiness by @anthonyshew in #14404
• feat: Add secure ignored setup writer storage by @anthonyshew in #14407
• feat: Parse bounded Node release metadata by @anthonyshew in #14410
• feat: Write setup locks atomically by @anthonyshew in #14399
• feat: Parse bounded npm registry release metadata by @anthonyshew in #14412
• chore: Update with-yarn example by @vercel-gh-bot-2[bot] in #14364
• fix: Preserve unknown pnpm lockfile settings through prune by @dnalborczyk in #14423
• fix: Preserve symlinked AGENTS.md when updating agent guidance by @drakeo338 in #14418
• feat: Compare setup source snapshots before lock publication by @anthonyshew in #14428
• refactor: Add fail-closed managed CLI selection by @anthonyshew in #14413
• test: Isolate optional root initialization from watcher services by @anthonyshew in #14427
• feat: Provision locked pnpm with managed Node launchers by @anthonyshew in #14431
• feat: Resolve native Node.js declarations into lock selections by @anthonyshew in #14432
• fix: Reuse healthy Node.js across managed inventory changes by @anthonyshew in #14429
• fix: Support npm patches in pruned workspaces by @vercel-gh-bot-3[bot] in #14434
• feat: Project selected managed execution identity by @anthonyshew in #14430
• perf: Skip ignored directories when discovering nested .gitignore files by @withkarann in #14442
• test: Avoid Windows CLI teardown deadlocks by @anthonyshew in #14435
• test: Cover pnpm release-age exclusions during prune by @anthonyshew in #14440
• feat: Provision independently pinned npm with managed Node by @anthonyshew in #14437
• fix: Capture setup discovery context for revalidation by @anthonyshew in #14439
• chore: Upgrade Ghostty for Zig 0.17 by @Mearman in #14419
• fix: Stop add-package-names codemod from generating duplicate names by @irontaek in #14433
• feat: Reconcile captured JavaScript tool selections by @anthonyshew in #14436
• chore: Release Turborepo 2.11.8-canary.1 by @github-actions[bot] in #14453
• fix: Share setup TLS and guard official source policy by @anthonyshew in #14438
• chore: Upgrade Next.js to 16.3.8 repo-wide for CVE-2026-94483 by @anthonyshew in #14451
• chore: Release Turbo repository packages 0.0.1-canary.31 by @github-actions[bot] in #14455
• ci: Use GitHub OIDC for versioned docs aliases by @anthonyshew in #14454
• test: Add owned setup policy fixtures for CLI tests by @anthonyshew in #14456
• feat: Represent matching Node-bundled npm ownership by @anthonyshew in #14457
• feat: Preserve setup lock declarations during prune by @anthonyshew in #14459
• refactor: Add guarded setup publication primitives by @anthonyshew in #14460
• chore: Release Turborepo 2.11.8-canary.2 by @github-actions[bot] in #14458
• chore: Update non-monorepo example by @vercel-gh-bot-4[bot] in #14452
• feat: Provision frozen Node and pnpm through setup by @anthonyshew in #14462
• fix: Exclude optional npm peers from pruned lockfiles by @anthonyshew in #14470
• feat: Validate managed Node and pnpm readiness by @anthonyshew in #14464
• feat: Resolve exact verified registry artifacts for setup locks by @anthonyshew in #14465
• feat: Check installed setup tools without mutation by @anthonyshew in #14467
• feat: Resolve captured Node and pnpm lock cohorts by @anthonyshew in #14466
• fix: Guard setup publication plans and discovery indirections by @anthonyshew in #14468
• fix: Release setup locks in their acquiring process by @anthonyshew in #14472
• feat: Create and reconcile local setup locks by @anthonyshew in #14473
• feat: Refresh managed setup locks explicitly by @anthonyshew in #14474
• feat: Force reinstall locked setup tools by @anthonyshew in #14475
• feat: Bind setup records to installation generations by @anthonyshew in #14476
• chore: Update with-berry example by @vercel-gh-bot-3[bot] in #14487
• fix: Generalize repository bootstrap across toolchains by @PedroRosalba in #14444
• fix: Keep Go discovery stable when the repository is reached through a symlink by @PedroRosalba in #14445
• fix: Reject non-member local sources in the uv manifest fallback by @PedroRosalba in #14446
• fix: Hash ruff and pytest configuration between the root and uv members by @PedroRosalba in #14447
• fix: Hash Clippy configuration for Cargo lint tasks by @PedroRosalba in #14448
• fix: Carry uv tool configuration into pruned workspaces by @PedroRosalba in #14449
• fix: Report inferred framework env vars for deferred tasks in dry runs by @PedroRosalba in #14478
• docs: Explain declaring Cargo sources read from outside the crate by @PedroRosalba in #14480
• fix: Upgrade turbo-gen Handlebars to 4.7.10 by @anthonyshew in #14471
• chore: Add copyable Factory snapshot command by @anthonyshew in #14481
• feat: Validate sealed native setup baselines by @anthonyshew in #14482
• fix: Prevent Git index refresh during dirty hash collection by @anthonyshew in #14489
• fix: Disable agent guidance by default by @anthonyshew in #14490

New Contributors

• @dnalborczyk made their first contribution in #14423
• @drakeo338 made their first contribution in #14418
• @withkarann made their first contribution in #14442
• @Mearman made their first contribution in #14419
• @irontaek made their first contribution in #14433
• @PedroRosalba made their first contribution in #14444

Full Changelog: v2.11.7...v2.11.8

Original source

What's Changed

Changelog

• fix: Stop add-package-names codemod from generating duplicate names by @irontaek in #14433
• feat: Reconcile captured JavaScript tool selections by @anthonyshew in #14436
• chore: Release Turborepo 2.11.8-canary.1 by @github-actions[bot] in #14453
• fix: Share setup TLS and guard official source policy by @anthonyshew in #14438
• chore: Upgrade Next.js to 16.3.8 repo-wide for CVE-2026-94483 by @anthonyshew in #14451
• chore: Release Turbo repository packages 0.0.1-canary.31 by @github-actions[bot] in #14455
• ci: Use GitHub OIDC for versioned docs aliases by @anthonyshew in #14454

New Contributors

• @irontaek made their first contribution in #14433

Full Changelog: v2.11.8-canary.1...v2.11.8-canary.2

Original source

What's Changed

Changelog

• fix: Pass repository to release asset commands by @anthonyshew in #14327
• chore: Release Turborepo 2.11.5-canary.5 by @anthonyshew in #14328
• chore: Release Turborepo 2.11.5 by @github-actions[bot] in #14329
• fix: Upgrade standalone turbo on installer reruns by @anthonyshew in #14330
• test: Deflake OpenTelemetry and PTY shutdown tests by @anthonyshew in #14331
• docs: Document standalone turbo installation by @anthonyshew in #14332
• ci: Install standalone turbo on Windows with PowerShell by @anthonyshew in #14334
• fix: Keep Yarn patch resolutions with npm protocol selectors in prune by @anthonyshew in #14337
• chore: Update with-tailwind example by @vercel-gh-bot-5[bot] in #14264
• ci: Resolve latest turbo release with workflow token by @anthonyshew in #14339
• chore: Update with-ultracite example by @vercel-gh-bot-5[bot] in #14335
• fix: Match production MFE negative lookaheads locally by @kitfoster in #13496
• docs: Add missing system environment variables and run flags by @BABTUNA in #13811
• fix: Normalize task inputs consistently for affected detection and hashing by @anthonyshew in #14341
• feat: Add task tags with configuration inheritance by @anthonyshew in #14342
• fix: Upgrade brace-expansion to latest compatible releases by @anthonyshew in #14347
• docs: Point security.txt to Vercel HackerOne program by @swarnava in #14346
• test: Deflake untracked scan-scope assertions by @anthonyshew in #14348
• feat: Expose task and package tags in query by @anthonyshew in #14343
• feat: Filter query tasks and packages by tags by @anthonyshew in #14344
• feat: Filter tasks by tags in the CLI by @anthonyshew in #14345
• fix: Complete task query metadata for non-script entrypoints by @anthonyshew in #14350
• fix: Infer single-package mode for query commands by @anthonyshew in #14351
• chore: Release Turborepo 2.11.6 by @github-actions[bot] in #14352
• fix: Pass SDKROOT through to repository tasks by @anthonyshew in #14353
• chore: Update with-vite-module-federation example by @vercel-gh-bot-5[bot] in #14349
• fix: Ignore Vercel OIDC token rotation in .env.local cache inputs by @anthonyshew in #14356
• chore: Release Turborepo 2.11.7 by @github-actions[bot] in #14357
• chore: Update with-vitest example by @vercel-gh-bot-3[bot] in #14355
• feat: Add experimental setup future flag by @anthonyshew in #14361
• fix: Remove Bash dependency from strict environment tests by @vercel-gh-bot-3[bot] in #14362
• fix: Use repository package manager for automatic Turbo downloads by @vercel-gh-bot-3[bot] in #14360
• chore: Improve Factory chat and model controls by @vercel-gh-bot-3[bot] in #14368
• chore: Add Linear connector to Factory by @vercel-gh-bot-3[bot] in #14369
• chore: Remove HarnessAgent from Factory by @vercel-gh-bot-3[bot] in #14370
• chore: Remove Factory UI clutter by @vercel-gh-bot-2[bot] in #14371
• feat: Add shared platform primitives for setup and shim by @anthonyshew in #14363
• fix: Populate task graphs for affected and filtered listings by @sahyl in #14366
• feat: Add bounded checksum-verifying downloads by @anthonyshew in #14374
• feat: Validate setup npm version requests by @anthonyshew in #14375
• fix: Prune unused pnpm catalog snapshots by @vercel-gh-bot-3[bot] in #14376
• feat: Resolve Node versions from native declarations by @anthonyshew in #14378
• feat: Honor tool-download proxy and certificate settings by @anthonyshew in #14379
• feat: Check bounded setup version-request overlap by @anthonyshew in #14381
• feat: Discover setup JavaScript package-manager declarations by @anthonyshew in #14382
• feat: Verify local artifact bytes without HTTP by @anthonyshew in #14383
• fix: Deflake concurrent agent guidance updates by @anthonyshew in #14388
• chore: Remove Linear from factory by @anthonyshew in #14389
• feat: Extract verified TAR archives into private staging by @anthonyshew in #14384
• feat: Add experimental setup command surface by @anthonyshew in #14385
• chore: Remove Factory branch naming restrictions by @vercel-gh-bot-4[bot] in #14391
• chore: Consolidate CI into one required summary by @anthonyshew in #14390
• docs: Clarify task graph filter traversal by @vercel-gh-bot-2[bot] in #14392
• feat: Extract safe Node TAR symlinks by @anthonyshew in #14393
• feat: Infer setup roots without package managers by @anthonyshew in #14395
• feat: Add atomic managed tool installation inventory by @anthonyshew in #14398
• fix: Invalidate managed repositories when turbo.lock changes by @anthonyshew in #14396
• feat: Safely extract verified ZIP archives by @anthonyshew in #14394
• test: Add installed-wrapper process launcher by @anthonyshew in #14401
• fix: Avoid duplicate code CI on pull request reviews by @anthonyshew in #14414
• chore(deps): Update dependency @vercel/geistdocs to v1.28.1 by @vercel-gh-bot-4[bot] in #14416
• docs: Remove premature setup guidance by @anthonyshew in #14409
• feat: Validate portable setup tool resolutions by @anthonyshew in #14400
• fix: Preserve scoped tool paths and owner-executable exports by @anthonyshew in #14403
• fix: Preserve Node runtime failure policy provenance by @anthonyshew in #14406
• feat: Add an internal managed-run capability query by @anthonyshew in #14408
• feat: Verify bounded SHA-512 tool artifacts by @anthonyshew in #14411
• test: Stabilize lockfile closure parity coverage by @anthonyshew in #14420
• fix: Repair missing install generations and share tool readiness by @anthonyshew in #14404
• feat: Add secure ignored setup writer storage by @anthonyshew in #14407
• feat: Parse bounded Node release metadata by @anthonyshew in #14410
• feat: Write setup locks atomically by @anthonyshew in #14399
• feat: Parse bounded npm registry release metadata by @anthonyshew in #14412
• chore: Update with-yarn example by @vercel-gh-bot-2[bot] in #14364
• fix: Preserve unknown pnpm lockfile settings through prune by @dnalborczyk in #14423
• fix: Preserve symlinked AGENTS.md when updating agent guidance by @drakeo338 in #14418
• feat: Compare setup source snapshots before lock publication by @anthonyshew in #14428
• refactor: Add fail-closed managed CLI selection by @anthonyshew in #14413
• test: Isolate optional root initialization from watcher services by @anthonyshew in #14427
• feat: Provision locked pnpm with managed Node launchers by @anthonyshew in #14431
• feat: Resolve native Node.js declarations into lock selections by @anthonyshew in #14432
• fix: Reuse healthy Node.js across managed inventory changes by @anthonyshew in #14429
• fix: Support npm patches in pruned workspaces by @vercel-gh-bot-3[bot] in #14434
• feat: Project selected managed execution identity by @anthonyshew in #14430
• perf: Skip ignored directories when discovering nested .gitignore files by @withkarann in #14442
• test: Avoid Windows CLI teardown deadlocks by @anthonyshew in #14435
• test: Cover pnpm release-age exclusions during prune by @anthonyshew in #14440
• feat: Provision independently pinned npm with managed Node by @anthonyshew in #14437
• fix: Capture setup discovery context for revalidation by @anthonyshew in #14439
• chore: Upgrade Ghostty for Zig 0.17 by @Mearman in #14419

New Contributors

• @swarnava made their first contribution in #14346
• @dnalborczyk made their first contribution in #14423
• @drakeo338 made their first contribution in #14418
• @withkarann made their first contribution in #14442
• @Mearman made their first contribution in #14419

Full Changelog: v2.11.5-canary.5...v2.11.8-canary.1

Original source

What's Changed

Changelog

chore: Release Turborepo 2.11.5 by @github-actions[bot] in #14329
fix: Upgrade standalone turbo on installer reruns by @anthonyshew in #14330
test: Deflake OpenTelemetry and PTY shutdown tests by @anthonyshew in #14331
docs: Document standalone turbo installation by @anthonyshew in #14332
ci: Install standalone turbo on Windows with PowerShell by @anthonyshew in #14334
fix: Keep Yarn patch resolutions with npm protocol selectors in prune by @anthonyshew in #14337
chore: Update with-tailwind example by @vercel-gh-bot-5[bot] in #14264
ci: Resolve latest turbo release with workflow token by @anthonyshew in #14339
chore: Update with-ultracite example by @vercel-gh-bot-5[bot] in #14335
fix: Match production MFE negative lookaheads locally by @kitfoster in #13496
docs: Add missing system environment variables and run flags by @BABTUNA in #13811
fix: Normalize task inputs consistently for affected detection and hashing by @anthonyshew in #14341
feat: Add task tags with configuration inheritance by @anthonyshew in #14342
fix: Upgrade brace-expansion to latest compatible releases by @anthonyshew in #14347
docs: Point security.txt to Vercel HackerOne program by @swarnava in #14346
test: Deflake untracked scan-scope assertions by @anthonyshew in #14348
feat: Expose task and package tags in query by @anthonyshew in #14343
feat: Filter query tasks and packages by tags by @anthonyshew in #14344
feat: Filter tasks by tags in the CLI by @anthonyshew in #14345
fix: Complete task query metadata for non-script entrypoints by @anthonyshew in #14350
fix: Infer single-package mode for query commands by @anthonyshew in #14351

New Contributors

@swarnava made their first contribution in #14346

Full Changelog: v2.11.5...v2.11.6

Original source

What's Changed

Changelog

chore: Release Turborepo 2.11.4 by @github-actions[bot] in #14231
test: Move Python opt-in hint into filter contracts by @anthonyshew in #14228
test: Move dependency-output summary assertion into contract by @anthonyshew in #14230
test: Move dependency-output selection and validation cases to engine contracts by @anthonyshew in #14232
test: Move Cargo exclude-only scope coverage by @anthonyshew in #14238
test: Move Cargo cache-authority cases to contracts by @anthonyshew in #14240
test: Move JIT dependency graph scenario into engine contract by @anthonyshew in #14235
test: Move dependency-output hash cases into task-hash contracts by @anthonyshew in #14233
test: Move Cargo task-filter cases into crate contracts by @anthonyshew in #14239
test: Move JIT input hash timing cases into task-hash contracts by @anthonyshew in #14234
test: Move package input normalization cases into engine contracts by @anthonyshew in #14236
test: Move structured startup and JIT input cases into contracts by @anthonyshew in #14237
fix: Back off remote artifact requests during outages by @anthonyshew in #14222
chore: Release Turborepo 2.11.5-canary.1 by @github-actions[bot] in #14245
test: Make new-package lockfile filter deterministic by @anthonyshew in #14241
test: Trim redundant Go cache builds by @anthonyshew in #14242
test: Reduce Go versioned-name test matrix by @anthonyshew in #14243
test: Move Go binary checks into contracts by @anthonyshew in #14246
test: Consolidate Go format smokes by @anthonyshew in #14244
test: Reuse Cargo build artifacts safely by @anthonyshew in #14247
test: Separate prune planning matrix from buildability smoke by @anthonyshew in #14248
feat: Bundle docs in turbo npm package by @anthonyshew in #14108
chore: Release Turborepo 2.11.5-canary.2 by @github-actions[bot] in #14249
fix: Stabilize pnpm per-workspace lockfile hashes by @anthonyshew in #14253
chore: Upgrade factory Next.js to 16.3.3 by @anthonyshew in #14254
fix: Update js-yaml to address CVE-2026-84375 by @anthonyshew in #14255
chore: Upgrade Next.js in docs and factory for CVE-2026-94545 by @anthonyshew in #14256
fix: Remove unmaintained proc-macro-error2 by @anthonyshew in #14257
refactor: Replace clap in production CLIs with usage-rs by @anthonyshew in #14259
chore: Remove tiny-gradient dependency by @anthonyshew in #14260
refactor: Replace human-panic with local crash reporting by @anthonyshew in #14261
chore: Remove unused struct_iterable dependency by @anthonyshew in #14258
fix: Sign complete on-disk artifacts after local cache writes by @anthonyshew in #14265
chore: Remove derive_setters dependency by @anthonyshew in #14266
chore: Remove port_scanner dependency by @anthonyshew in #14267
chore: Remove unused Rust dependency declarations by @anthonyshew in #14268
refactor: Remove unused public Rust APIs by @anthonyshew in #14269
refactor: Use workspace Rust edition across crates by @anthonyshew in #14270
chore: Clean up Rust Clippy exceptions by @anthonyshew in #14271
refactor: Group task-hash and uv generation context by @anthonyshew in #14279
refactor: Remove unused global hash wrapper by @anthonyshew in #14281
refactor: Remove unused file-hash telemetry argument by @anthonyshew in #14282
refactor: Remove dead CLI code and crate-wide allowance by @anthonyshew in #14283
refactor: Remove dead Microfrontends config code by @anthonyshew in #14284
refactor: Remove unused UI task types and dead-code allowance by @anthonyshew in #14286
refactor: Remove unused Cache archive test helper and dead code allowance by @anthonyshew in #14287
chore: Narrow Run dead-code allowances by @anthonyshew in #14285
chore: Remove resolved TODO markers by @anthonyshew in #14288
fix: Use map_while for invariant text prefixes by @anthonyshew in #14289
test: Cover globwalk parent traversal by @anthonyshew in #14290
fix: Wait for watcher setup with Tokio wait_for by @anthonyshew in #14292
test: Exercise SCM package hashing for symlinks by @anthonyshew in #14291
fix: Reject empty tokens when reading token files by @anthonyshew in #14293
test: Verify Yarn transparent workspace handling by @anthonyshew in #14294
fix: Format pnpm v5 package names by @anthonyshew in #14295
fix: Report package manager error source paths by @anthonyshew in #14296
fix: Resolve LSP task references with JSONC AST by @anthonyshew in #14298
chore: Remove stale package watcher TODO by @anthonyshew in #14299
fix: Validate scope selector glob bases by @anthonyshew in #14300
fix: Add path context to globwatch errors by @anthonyshew in #14301
docs: Document wax pattern and walk semantics by @anthonyshew in #14302
chore: Remove resolved filewatch input-set TODO by @anthonyshew in #14303
docs: Document FSEvents event translation by @anthonyshew in #14305
refactor: Group run-cache task context by @anthonyshew in #14304
chore: Document package watcher task-input filtering by @anthonyshew in #14306
chore: Remove stale const_format lint workaround by @anthonyshew in #14307
refactor: Route regex groups through Grouping by @anthonyshew in #14308
perf: Parse character classes without compiling regex by @anthonyshew in #14310
chore: Drop unused Biome dependencies from turbopath by @anthonyshew in #14311
chore: Unify jsonc-parser versions by @anthonyshew in #14312
chore: Remove error-only dependency edges by @anthonyshew in #14313
perf: Emit casing flags only when they change by @anthonyshew in #14309
perf: Avoid formatting Bun lockfiles during parsing by @anthonyshew in #14314
test: Assert process manager stop postconditions by @anthonyshew in #14297
perf: Serve a static GraphiQL page by @anthonyshew in #14315
perf: Upgrade serde_json to reduce CLI size by @anthonyshew in #14316
perf: Upgrade Ratatui to reduce TUI allocations by @anthonyshew in #14317
fix: Restore TUI log streaming after Ratatui upgrade by @anthonyshew in #14318
feat: Add version-matched agent guidance by @anthonyshew in #14250
fix: Restore Rust builds after agent guidance changes by @anthonyshew in #14319
chore: Release Turborepo 2.11.5-canary.3 by @github-actions[bot] in #14320
docs: Update Turborepo schema URL example by @yousefdawood7 in #14321
feat: Publish versioned standalone turbo archives by @anthonyshew in #14322
fix: Run standalone archive job on manual releases by @anthonyshew in #14323
chore: Release Turborepo 2.11.5-canary.4 by @github-actions[bot] in #14324
feat: Add standalone installers URLs for curl | bash by @anthonyshew in #14325
fix: Isolate installer test environment by @anthonyshew in #14326
fix: Pass repository to release asset commands by @anthonyshew in #14327
chore: Release Turborepo 2.11.5-canary.5 by @anthonyshew in #14328

New Contributors

@yousefdawood7 made their first contribution in #14321

Full Changelog: v2.11.4...v2.11.5

Original source

What's Changed

Changelog

chore: Release Turborepo 2.11.5-canary.2 by @github-actions[bot] in #14249
fix: Stabilize pnpm per-workspace lockfile hashes by @anthonyshew in #14253
chore: Upgrade factory Next.js to 16.3.3 by @anthonyshew in #14254
fix: Update js-yaml to address CVE-2026-84375 by @anthonyshew in #14255
chore: Upgrade Next.js in docs and factory for CVE-2026-94545 by @anthonyshew in #14256
fix: Remove unmaintained proc-macro-error2 by @anthonyshew in #14257
refactor: Replace clap in production CLIs with usage-rs by @anthonyshew in #14259
chore: Remove tiny-gradient dependency by @anthonyshew in #14260
refactor: Replace human-panic with local crash reporting by @anthonyshew in #14261
chore: Remove unused struct_iterable dependency by @anthonyshew in #14258
fix: Sign complete on-disk artifacts after local cache writes by @anthonyshew in #14265
chore: Remove derive_setters dependency by @anthonyshew in #14266
chore: Remove port_scanner dependency by @anthonyshew in #14267
chore: Remove unused Rust dependency declarations by @anthonyshew in #14268
refactor: Remove unused public Rust APIs by @anthonyshew in #14269
refactor: Use workspace Rust edition across crates by @anthonyshew in #14270
chore: Clean up Rust Clippy exceptions by @anthonyshew in #14271
refactor: Group task-hash and uv generation context by @anthonyshew in #14279
refactor: Remove unused global hash wrapper by @anthonyshew in #14281
refactor: Remove unused file-hash telemetry argument by @anthonyshew in #14282
refactor: Remove dead CLI code and crate-wide allowance by @anthonyshew in #14283
refactor: Remove dead Microfrontends config code by @anthonyshew in #14284
refactor: Remove unused UI task types and dead-code allowance by @anthonyshew in #14286
refactor: Remove unused Cache archive test helper and dead code allowance by @anthonyshew in #14287
chore: Narrow Run dead-code allowances by @anthonyshew in #14285
chore: Remove resolved TODO markers by @anthonyshew in #14288
fix: Use map_while for invariant text prefixes by @anthonyshew in #14289
test: Cover globwalk parent traversal by @anthonyshew in #14290
fix: Wait for watcher setup with Tokio wait_for by @anthonyshew in #14292
test: Exercise SCM package hashing for symlinks by @anthonyshew in #14291
fix: Reject empty tokens when reading token files by @anthonyshew in #14293
test: Verify Yarn transparent workspace handling by @anthonyshew in #14294
fix: Format pnpm v5 package names by @anthonyshew in #14295
fix: Report package manager error source paths by @anthonyshew in #14296
fix: Resolve LSP task references with JSONC AST by @anthonyshew in #14298
chore: Remove stale package watcher TODO by @anthonyshew in #14299
fix: Validate scope selector glob bases by @anthonyshew in #14300
fix: Add path context to globwatch errors by @anthonyshew in #14301
docs: Document wax pattern and walk semantics by @anthonyshew in #14302
chore: Remove resolved filewatch input-set TODO by @anthonyshew in #14303
docs: Document FSEvents event translation by @anthonyshew in #14305
refactor: Group run-cache task context by @anthonyshew in #14304
chore: Document package watcher task-input filtering by @anthonyshew in #14306
chore: Remove stale const_format lint workaround by @anthonyshew in #14307
refactor: Route regex groups through Grouping by @anthonyshew in #14308
perf: Parse character classes without compiling regex by @anthonyshew in #14310
chore: Drop unused Biome dependencies from turbopath by @anthonyshew in #14311
chore: Unify jsonc-parser versions by @anthonyshew in #14312
chore: Remove error-only dependency edges by @anthonyshew in #14313
perf: Emit casing flags only when they change by @anthonyshew in #14309
perf: Avoid formatting Bun lockfiles during parsing by @anthonyshew in #14314
test: Assert process manager stop postconditions by @anthonyshew in #14297
perf: Serve a static GraphiQL page by @anthonyshew in #14315
perf: Upgrade serde_json to reduce CLI size by @anthonyshew in #14316
perf: Upgrade Ratatui to reduce TUI allocations by @anthonyshew in #14317
fix: Restore TUI log streaming after Ratatui upgrade by @anthonyshew in #14318
feat: Add version-matched agent guidance by @anthonyshew in #14250
fix: Restore Rust builds after agent guidance changes by @anthonyshew in #14319

Full Changelog: v2.11.5-canary.2...v2.11.5-canary.3

Original source

What's Changed

Changelog

• chore: Release Turborepo 2.11.5-canary.1 by @github-actions[bot] in #14245
• test: Make new-package lockfile filter deterministic by @anthonyshew in #14241
• test: Trim redundant Go cache builds by @anthonyshew in #14242
• test: Reduce Go versioned-name test matrix by @anthonyshew in #14243
• test: Move Go binary checks into contracts by @anthonyshew in #14246
• test: Consolidate Go format smokes by @anthonyshew in #14244
• test: Reuse Cargo build artifacts safely by @anthonyshew in #14247
• test: Separate prune planning matrix from buildability smoke by @anthonyshew in #14248
• feat: Bundle docs in turbo npm package by @anthonyshew in #14108

Full Changelog: v2.11.5-canary.1...v2.11.5-canary.2

Original source

What's Changed

Changelog

chore: Release Turborepo 2.11.3-canary.4 by @github-actions[bot] in #14162

fix: Stop with tasks when parent exits by @anthonyshew in #14163

fix: Respect negated global dependencies in affected detection by @anthonyshew in #14164

chore: Release Turborepo 2.11.3 by @github-actions[bot] in #14165

test: Share Go compilation caches across integration tests by @anthonyshew in #14166

refactor: Add injectable manifest loading to repository graphs by @anthonyshew in #14167

test: Move Go and Cargo scope planning into crate tests by @anthonyshew in #14168

refactor: Extract subprocess-free Go observation assembly by @anthonyshew in #14169

test: Move Cargo environment hash contracts into crates by @anthonyshew in #14170

test: Move Cargo output layout matrices to repository contracts by @anthonyshew in #14171

test: Cover Go discovery identities in memory by @anthonyshew in #14172

test: Cover Go hash inputs in repository contracts by @anthonyshew in #14174

test: Move uv hash input contracts into crates by @anthonyshew in #14175

test: Cover Go task selection in the engine by @anthonyshew in #14173

test: Inject uv discovery for native task contracts by @anthonyshew in #14176

test: Inject query contracts over repository graphs by @anthonyshew in #14177

test: Inject dry-run task summary contracts by @anthonyshew in #14178

test: Expose prune workspace selection plan by @anthonyshew in #14179

test: Inject change detection at scope entry point by @anthonyshew in #14180

test: Move uv lock affectedness planning into repository contracts by @anthonyshew in #14184

test: Use virtual clock for package watcher events by @anthonyshew in #14181

test: Move Cargo task query and dry-run planning into contracts by @anthonyshew in #14185

test: Move uv quality query and dry-run projections into contracts by @anthonyshew in #14186

test: Move JavaScript hash and framework projections into contracts by @anthonyshew in #14188

test: Cover prune closure and native layout plans in process by @anthonyshew in #14189

test: Cover mixed-toolchain scope filters through injection by @anthonyshew in #14190

test: Make package watcher suppression and rediscovery deterministic by @anthonyshew in #14191

test: Inject watch run lifecycle and event collection by @anthonyshew in #14192

test: Move recursive root-script guard into process-free contract by @anthonyshew in #14193

test: Move Go query and summary parity into crate contracts by @anthonyshew in #14187

test: Remove duplicate CLI filter matrix cases by @anthonyshew in #14194

test: Trim duplicate prune materialization cases by @anthonyshew in #14195

test: Match Go library summary path on Windows by @anthonyshew in #14197

test: Cover mixed-toolchain watch task selection in process by @anthonyshew in #14196

test: Preserve Windows SystemRoot in strict-env fixture by @anthonyshew in #14198

test: Retain real watch smokes after selection migration by @anthonyshew in #14199

fix: Only reject secondary go.work files Go reads for workspace members by @voiys in #14183

test: Split Go north-star cache invalidation into hash contracts by @anthonyshew in #14201

test: Avoid deleting built prune output in cross-toolchain prune test by @anthonyshew in #14202

test: Move turbo.json validation cases into crate contracts by @anthonyshew in #14203

chore: Update with-solid example by @vercel-gh-bot-2[bot] in #14200

refactor: Split RunBuilder execution context construction into phases by @anthonyshew in #14204

refactor: Inject remote cache status probe by @anthonyshew in #14205

refactor: Inject inputs into config resolution by @anthonyshew in #14206

feat: Add affected query APIs to turborepo-query by @anthonyshew in #14207

refactor: Wire CLI through affected query APIs by @anthonyshew in #14208

feat: Add pure microfrontend port resolver by @anthonyshew in #14209

refactor: Inject change detection into affected run paths by @anthonyshew in #14210

test: Move affectedTasks planning cases into query contracts by @anthonyshew in #14214

refactor: Route get-mfe-port through the pure resolver by @anthonyshew in #14215

test: Count native discovery for JavaScript-only selections by @anthonyshew in #14216

fix: Disable remote cache after unrecoverable forbidden responses by @anthonyshew in #14218

perf: Send cache analytics in larger batches by @anthonyshew in #14219

perf: Batch dry-run remote cache existence checks by @anthonyshew in #14220

test: Move config precedence cases into funnel contracts by @anthonyshew in #14217

test: Move affected run planning into RunBuilder contracts by @anthonyshew in #14212

fix: Coordinate artifact requests after rate limiting by @anthonyshew in #14221

fix: Share concurrent remote-cache token recovery by @anthonyshew in #14223

refactor: Make repository context inputs injectable by @anthonyshew in #14224

refactor: Group Run state into execution and services contexts by @anthonyshew in #14225

test: Move Cargo prune layout checks into in-process plan contracts by @anthonyshew in #14226

test: Move Cargo and Go discovery cases into contracts by @anthonyshew in #14227

fix: Put version in turbo query JSON output instead of a separate banner by @anthonyshew in #14229

chore: Release Turborepo 2.11.4 by @github-actions[bot] in #14231

test: Move Python opt-in hint into filter contracts by @anthonyshew in #14228

test: Move dependency-output summary assertion into contract by @anthonyshew in #14230

test: Move dependency-output selection and validation cases to engine contracts by @anthonyshew in #14232

test: Move Cargo exclude-only scope coverage by @anthonyshew in #14238

test: Move Cargo cache-authority cases to contracts by @anthonyshew in #14240

test: Move JIT dependency graph scenario into engine contract by @anthonyshew in #14235

test: Move dependency-output hash cases into task-hash contracts by @anthonyshew in #14233

test: Move Cargo task-filter cases into crate contracts by @anthonyshew in #14239

test: Move JIT input hash timing cases into task-hash contracts by @anthonyshew in #14234

test: Move package input normalization cases into engine contracts by @anthonyshew in #14236

test: Move structured startup and JIT input cases into contracts by @anthonyshew in #14237

fix: Back off remote artifact requests during outages by @anthonyshew in #14222

New Contributors

@voiys made their first contribution in #14183

Full Changelog: v2.11.3-canary.4...v2.11.5-canary.1

Original source