Turborepo Updates & Release Notes

What's Changed

Changelog

release(turborepo): 2.9.15-canary.6 by @github-actions[bot] in #12925

fix: Restore release PR auto-merge by @anthonyshew in #12927

perf: Index repo gitignore matchers by @anthonyshew in #12928

ci: Disable incremental Rust test builds by @anthonyshew in #12929

perf: Trim OpenTelemetry crate features by @anthonyshew in #12930

perf: Trim microfrontends proxy HTTP features by @anthonyshew in #12931

fix: Accept experimentalCI object config by @anthonyshew in #12934

Full Changelog: v2.9.15-canary.6...v2.9.15-canary.7

What's Changed

Changelog

fix: Remove turborepo-wax's expect() usage by @anthonyshew in #12901

fix: Remove turborepo-filewatch's expect() usage by @anthonyshew in #12903

fix: Remove turborepo-cache's expect() usage by @anthonyshew in #12902

fix: Remove turborepo-daemon's expect() usage by @anthonyshew in #12904

fix: Remove turborepo-engine's unwrap() usage by @anthonyshew in #12906

fix: Remove filewatch unwrap usage by @anthonyshew in #12907

fix: Remove engine expect usage by @anthonyshew in #12908

fix: Remove cache unwrap usage by @anthonyshew in #12909

fix: Remove turborepo-lockfiles expect() usage by @anthonyshew in #12910

chore: Set pnpm minimum release age by @anthonyshew in #12912

fix: Remove turborepo-lockfiles's unwrap() usage by @anthonyshew in #12911

fix: Remove turborepo-vt100's unwrap() usage by @anthonyshew in #12913

release(turborepo): 2.9.15-canary.4 by @github-actions[bot] in #12905

fix: Remove turborepo-lib's unwrap() usage by @anthonyshew in #12915

fix: Remove turborepo-lib's expect() usage by @anthonyshew in #12914

fix: Remove shim test unwrap usage by @anthonyshew in #12917

fix: Remove turbo json test unwrap allowance by @anthonyshew in #12918

fix: Remove run summary test unwrap usage by @anthonyshew in #12916

Full Changelog: v2.9.15-canary.4...v2.9.15-canary.5

What's Changed

Changelog

release(turborepo): 2.9.15-canary.3 by @github-actions[bot] in #12814
fix: Avoid path-racy chmod during directory restore by @anthonyshew in #12815
fix: Prevent cache restore symlink race writes by @anthonyshew in #12817
chore: Deny Rust panic extraction by default by @anthonyshew in #12818
fix: Make structured log symlink defense race-safe by @anthonyshew in #12821
fix: Preserve Bun alias child packages by @anthonyshew in #12822
fix: Avoid UTF-8 panics at boundaries by @anthonyshew in #12823
fix: Preserve non-UTF-8 Git path boundaries by @anthonyshew in #12826
fix: Create daemon dirs with private permissions by @anthonyshew in #12827
fix: Return Berry lockfile errors instead of panicking by @anthonyshew in #12828
fix: Isolate Corepack state in integration tests by @anthonyshew in #12831
ci: Use larger Windows runners for Rust tests by @anthonyshew in #12832
docs: Add with-vite-module-federation example by @gioboa in #12794
test: Run Rust tests without partitioning by @anthonyshew in #12833
chore: Remove TaskHashTracker-based expect() calls by @anthonyshew in #12836
chore: Deduplicate hash canonicalization by @anthonyshew in #12837
fix: Prevent Windows process drain hangs by @anthonyshew in #12838
fix: Refactor execsync to execfilesync for Shell command built from environment values by @bjormgyg in #12829
test: Bound vt100 random quickcheck by @anthonyshew in #12839
fix: Validate daemon discovery responses by @anthonyshew in #12840
fix: Store PackageGraph root invariants by @anthonyshew in #12841
chore: Avoid engine graph node expects by @anthonyshew in #12842
test: Make Rust tests parallel-safe by @anthonyshew in #12843
fix: Avoid graph utility node lookup panics by @anthonyshew in #12844
fix: Avoid graph walker expect() calls by @anthonyshew in #12845
fix: Remove fs panic extraction lints by @anthonyshew in #12846
fix: Remove fixed map panic extraction calls by @anthonyshew in #12847
fix: Remove devtools WebSocket panics by @anthonyshew in #12850
fix: Remove json rewrite panic lint allow by @anthonyshew in #12848
fix: Remove turborepo-types panic lint allows by @anthonyshew in #12849
chore: Remove turborepo-hash build expect by @anthonyshew in #12851
fix: Remove napi panic lint allows by @anthonyshew in #12852
fix: Avoid globwatch expect calls by @anthonyshew in #12853
fix: Remove LSP expect callsites by @anthonyshew in #12854
fix: Remove scope panic lint allows by @anthonyshew in #12855
fix: Remove task hash panic lints by @anthonyshew in #12856
fix: Remove frameworks panic lint allows by @anthonyshew in #12857
fix: Remove microfrontends proxy expect lint allow by @anthonyshew in #12859
fix: Avoid API client expect calls by @anthonyshew in #12858
fix: Avoid task executor expect calls by @anthonyshew in #12860
fix: Remove turbo-trace unwrap callsite by @anthonyshew in #12863
fix: Remove Vercel API mock expect usage by @anthonyshew in #12862
fix: Remove vt100 expect lint allow by @anthonyshew in #12861
fix: Remove turborepo-shim expect callsites by @anthonyshew in #12864
test: Deflake daemon existing process test by @anthonyshew in #12865
fix: Avoid repository NAPI unwrap calls by @anthonyshew in #12866
fix: Remove pidlock panic callsites by @anthonyshew in #12867
fix: Remove telemetry panic callsites by @anthonyshew in #12868
chore: Remove Rust re-export shims by @anthonyshew in #12870
fix: Remove turbo-json panic lint allows by @anthonyshew in #12869
fix: Remove globwalk's expect() callsites by @anthonyshew in #12871
fix: Remove turbopath's expect() callsites by @anthonyshew in #12872
test: Deflake Corepack prepare lock on Windows by @anthonyshew in #12873
fix: Remove signals panic callsites by @anthonyshew in #12874
fix: Remove turbo-trace's expect() allow by @anthonyshew in #12876
fix: Remove Vercel API mock unwrap usage by @anthonyshew in #12877
fix: Remove task executor unwrap usage by @anthonyshew in #12878
fix: Remove run summary expect usage by @anthonyshew in #12879
fix: Remove microfrontends proxy unwrap usage by @anthonyshew in #12880
fix: Remove api client unwrap usage by @anthonyshew in #12881
fix: Remove globwalk unwrap usage by @anthonyshew in #12883
fix: Remove UI expect() usage by @anthonyshew in #12882
fix: Remove microfrontends expect usage by @anthonyshew in #12885
fix: Remove boundaries's expect() usage by @anthonyshew in #12887
fix: Remove turborepo-process's unwrap() usage by @anthonyshew in #12888
fix: Remove UI unwrap usage by @anthonyshew in #12889
fix: Remove microfrontends unwrap allow by @anthonyshew in #12890
fix: Remove turborepo-process's expect() usage by @anthonyshew in #12891
fix: Remove scm expect usage by @anthonyshew in #12893
fix: Remove auth unwrap usage by @anthonyshew in #12886
fix: Remove turbopath's unwrap() usage by @anthonyshew in #12884
fix: Remove auth's expect() usage by @anthonyshew in #12895
fix: Remove wax unwrap usage by @anthonyshew in #12899
fix: Remove scm unwrap usage by @anthonyshew in #12897
fix: Remove turborepo-boundaries's unwrap() usage by @anthonyshew in #12896
fix: Remove daemon unwrap usage by @anthonyshew in #12898
fix: Include lockfile-changed packages in affected tasks by @anthonyshew in #12900

New Contributors

@gioboa made their first contribution in #12794
@bjormgyg made their first contribution in #12829

Full Changelog: v2.9.15-canary.3...v2.9.15-canary.4

Note

This release contains important security fixes.

High:

GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection

Low:

GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation

GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection

What's Changed

Changelog

release(turborepo): 2.9.12 by @github-actions[bot] in #12774

fix: Restore docs mobile menu by @anthonyshew in #12782

ci: Use pull_request for PR title linting by @anthonyshew in #12787

ci: Scope GitHub Actions caches by branch by @anthonyshew in #12788

test: Validate lockfiles without dependency downloads by @anthonyshew in #12789

Removed unneeded import form hash creation script in docs by @dancrumb in #12799

fix: Validate auth callback state by @anthonyshew in #12802

fix: Harden VS Code extension command execution by @anthonyshew in #12800

fix: Avoid project-local Yarn during detection by @anthonyshew in #12801

chore: Release 2.9.13 by @anthonyshew in #12803

New Contributors

@dancrumb made their first contribution in #12799

Full Changelog: v2.9.12...v2.9.14

What's Changed

Changelog

release(turborepo): 2.9.11-canary.7 by @github-actions[bot] in #12768

fix: Allow $TURBO_EXTENDS$ in LSP diagnostics by @anthonyshew in #12770

release(turborepo): 2.9.11 by @github-actions[bot] in #12771

fix: Allow transit nodes in LSP diagnostics by @anthonyshew in #12773

release(turborepo): 2.9.12 by @github-actions[bot] in #12774

fix: Restore docs mobile menu by @anthonyshew in #12782

ci: Use pull_request for PR title linting by @anthonyshew in #12787

ci: Scope GitHub Actions caches by branch by @anthonyshew in #12788

test: Validate lockfiles without dependency downloads by @anthonyshew in #12789

Removed unneeded import form hash creation script in docs by @dancrumb in #12799

fix: Validate auth callback state by @anthonyshew in #12802

fix: Harden VS Code extension command execution by @anthonyshew in #12800

fix: Avoid project-local Yarn during detection by @anthonyshew in #12801

New Contributors

@dancrumb made their first contribution in #12799

Full Changelog: v2.9.11-canary.7...v2.9.13-canary.1

What's Changed

Changelog

release(turborepo): 2.9.10 by @github-actions[bot] in #12745

ci: Publish VS Code extension on release by @anthonyshew in #12747

fix: Start daemon for VSCode Extension from the extension itself by @anthonyshew in #12749

release(turborepo): 2.9.11-canary.1 by @github-actions[bot] in #12748

fix: Include file URIs in LSP lifecycle logs by @anthonyshew in #12751

fix: Handle JSON decoration visitor depth by @anthonyshew in #12752

fix: Resolve relative turbo path in VS Code extension by @anthonyshew in #12753

fix: Preserve Bun nested dependencies during prune by @anthonyshew in #12754

fix: Prefer installed Turbo for LSP by @anthonyshew in #12755

release(turborepo): 2.9.11-canary.2 by @github-actions[bot] in #12750

ci: Parallelize LSP release publishing by @anthonyshew in #12758

fix: Reduce VS Code extension startup popups by @anthonyshew in #12759

fix: Support turbo.jsonc in VS Code extension by @anthonyshew in #12760

fix: Remove VS Code task key gradient by @anthonyshew in #12761

release(turborepo): 2.9.11-canary.3 by @github-actions[bot] in #12756

chore: Release v2.9.11-canary.4 by @anthonyshew in #12762

ci: Stop VS Code publish from blocking release PR by @anthonyshew in #12763

release(turborepo): 2.9.11-canary.5 by @github-actions[bot] in #12764

fix: Publish VS Code extension from release tag by @anthonyshew in #12765

fix: Support shimmed VS Code LSP probes by @anthonyshew in #12767

release(turborepo): 2.9.11-canary.6 by @github-actions[bot] in #12766

release(turborepo): 2.9.11-canary.7 by @github-actions[bot] in #12768

fix: Allow $TURBO_EXTENDS$ in LSP diagnostics by @anthonyshew in #12770

Full Changelog: v2.9.10...v2.9.11

What's Changed

Changelog

• fix: Include file URIs in LSP lifecycle logs by @anthonyshew in #12751
• fix: Handle JSON decoration visitor depth by @anthonyshew in #12752
• fix: Resolve relative turbo path in VS Code extension by @anthonyshew in #12753
• fix: Preserve Bun nested dependencies during prune by @anthonyshew in #12754
• fix: Prefer installed Turbo for LSP by @anthonyshew in #12755
• release(turborepo): 2.9.11-canary.2 by @github-actions[bot] in #12750

Full Changelog: v2.9.11-canary.2...v2.9.11-canary.3