Skip to content

chore: Upgrade Turborepo from 2.5.0 to 2.9.0#874

Merged
kingston merged 2 commits into
mainfrom
kingston/eng-1147-upgrade-turborepo-to-29
Apr 1, 2026
Merged

chore: Upgrade Turborepo from 2.5.0 to 2.9.0#874
kingston merged 2 commits into
mainfrom
kingston/eng-1147-upgrade-turborepo-to-29

Conversation

@kingston
Copy link
Copy Markdown
Collaborator

@kingston kingston commented Apr 1, 2026

Summary by CodeRabbit

  • Chores
    • Updated Turborepo from 2.5.0 to 2.9.0 across the monorepo.
  • Bug Fixes
    • Improved example-run scripts to avoid leaking tool-specific environment variables into example processes, making example execution more reliable.

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 1, 2026

🦋 Changeset detected

Latest commit: 934e750

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 24 packages
Name Type
@baseplate-dev/core-generators Patch
@baseplate-dev/fastify-generators Patch
@baseplate-dev/project-builder-server Patch
@baseplate-dev/react-generators Patch
@baseplate-dev/plugin-ai Patch
@baseplate-dev/plugin-auth Patch
@baseplate-dev/plugin-email Patch
@baseplate-dev/plugin-observability Patch
@baseplate-dev/plugin-payments Patch
@baseplate-dev/plugin-queue Patch
@baseplate-dev/plugin-rate-limit Patch
@baseplate-dev/plugin-storage Patch
@baseplate-dev/create-project Patch
@baseplate-dev/project-builder-cli Patch
@baseplate-dev/project-builder-common Patch
@baseplate-dev/project-builder-dev Patch
@baseplate-dev/project-builder-web Patch
@baseplate-dev/project-builder-test Patch
@baseplate-dev/code-morph Patch
@baseplate-dev/project-builder-lib Patch
@baseplate-dev/sync Patch
@baseplate-dev/tools Patch
@baseplate-dev/ui-components Patch
@baseplate-dev/utils Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 1, 2026

📝 Walkthrough

Walkthrough

Upgraded Turborepo from 2.5.0 to 2.9.0 across the monorepo (root, examples, and CORE_PACKAGES) and added a changeset documenting the patch-level bump. Also modified example-run scripts to unset npm_/pnpm_ environment variables when running example commands.

Changes

Cohort / File(s) Summary
Changeset Entry
.changeset/upgrade-turborepo.md
Added a changeset for @baseplate-dev/core-generators recording Turborepo upgrade 2.5.0 → 2.9.0.
Package Configuration
package.json, examples/blog-with-auth/package.json, examples/todo-with-better-auth/package.json
Bumped devDependencies.turbo from 2.5.0 to 2.9.0 in root and example project package.json files.
Core Package Constants
packages/core-generators/src/constants/core-packages.ts
Updated exported CORE_PACKAGES.turbo value from 2.5.0 → 2.9.0.
Example-run Scripts
scripts/run-all.sh, scripts/run-example.sh, scripts/run-examples.sh
Scripts now scan the environment for npm_/pnpm_ variables, build env -u/-u <VAR> arguments, and run example commands with those variables unset for the child process instead of executing commands directly.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: upgrading Turborepo from version 2.5.0 to 2.9.0, which is reflected across all modified files.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch kingston/eng-1147-upgrade-turborepo-to-29

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 86: The example projects' lockfiles are still pinned to turbo@2.5.0 while
the root package.json was bumped to turbo@2.9.0; regenerate the two example pnpm
lockfiles so they match the manifest bump by running pnpm install
--lockfile-only (or pnpm install) inside examples/blog-with-auth and
examples/todo-with-better-auth and commit the updated pnpm-lock.yaml files
(examples/blog-with-auth/pnpm-lock.yaml and
examples/todo-with-better-auth/pnpm-lock.yaml) so pnpm install --frozen-lockfile
succeeds.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 18a0a1e0-4327-409b-8f3e-59bb629b2079

📥 Commits

Reviewing files that changed from the base of the PR and between 2d39358 and 1ae3b22.

⛔ Files ignored due to path filters (3)
  • examples/blog-with-auth/baseplate/generated/package.json is excluded by !**/generated/**, !**/generated/**
  • examples/todo-with-better-auth/baseplate/generated/package.json is excluded by !**/generated/**, !**/generated/**
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (5)
  • .changeset/upgrade-turborepo.md
  • examples/blog-with-auth/package.json
  • examples/todo-with-better-auth/package.json
  • package.json
  • packages/core-generators/src/constants/core-packages.ts

Comment thread package.json
@socket-security
Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedturbo@​2.5.0 ⏵ 2.9.0100 +110085 -197 +1100

View full report

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/run-all.sh`:
- Line 37: After shifting past the `--` separator you must validate that at
least one argument remains to avoid silent failures; add a check right after the
shift in scripts/run-all.sh to test the positional parameter count ($#) and, if
zero, print an error like "Error: no command provided after --" to stderr and
exit non‑zero. Place this check before the loop that uses UNSET_ARGS and before
the line invoking env "${UNSET_ARGS[@]}" "$@" so callers invoking the script
with only `--` fail early and clearly.

In `@scripts/run-example.sh`:
- Line 46: The current invocation (cd "$EXAMPLE_DIR" && env "${UNSET_ARGS[@]}"
"$@") can call env with no command when "${UNSET_ARGS[@]}" and "$@" are both
empty; add a guard before that line to detect an empty command (check that
either UNSET_ARGS or "$@" contains at least one token) and fail with a non-zero
exit and explanatory message if none exist. Locate the run-example.sh snippet
using the EXAMPLE_DIR, UNSET_ARGS, and "$@" variables and implement the
pre-check to ensure we never run env with no command (returning an error/usage
message instead).

In `@scripts/run-examples.sh`:
- Line 34: The script currently runs (cd "$dir" && env "${UNSET_ARGS[@]}" "$@")
which will silently succeed if the caller passed only the `--` separator because
the initial pre-shift check sees one arg, then the `shift` removes it and "$@"
becomes empty; add a post-shift validation immediately after the code that
removes `--` to check that "$@" is non-empty and exit with a non-zero status
(and an error message) if it is empty so that env is never invoked without a
command; reference the removal/shift logic and the invocation line using
UNSET_ARGS, dir and the env "${UNSET_ARGS[@]}" "$@" call when making this
change.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c08405b0-0bff-4e37-873c-26127d6af4a0

📥 Commits

Reviewing files that changed from the base of the PR and between 1ae3b22 and 934e750.

⛔ Files ignored due to path filters (2)
  • examples/blog-with-auth/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
  • examples/todo-with-better-auth/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (3)
  • scripts/run-all.sh
  • scripts/run-example.sh
  • scripts/run-examples.sh

Comment thread scripts/run-all.sh
fi
echo ">>> Running in $name: $*"
(cd "$dir" && "$@")
(cd "$dir" && env "${UNSET_ARGS[@]}" "$@")
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n scripts/run-all.sh

Repository: halfdomelabs/baseplate

Length of output: 1184


🏁 Script executed:

cat -n scripts/run-examples.sh

Repository: halfdomelabs/baseplate

Length of output: 1105


Add post--- validation to prevent silent failures when no command is provided.

After shifting out the -- separator (line 12-13), the script should validate that at least one argument remains. Currently, callers can invoke pnpm run:all -- with no command, which passes the initial check and only fails when env is executed at line 37, resulting in unclear error messages. Add a check immediately after the shift:

if [ $# -eq 0 ]; then
  echo "Error: no command provided after --" >&2
  exit 1
fi

This pattern should match the explicit validation expected in scripts/run-examples.sh as well.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@scripts/run-all.sh` at line 37, After shifting past the `--` separator you
must validate that at least one argument remains to avoid silent failures; add a
check right after the shift in scripts/run-all.sh to test the positional
parameter count ($#) and, if zero, print an error like "Error: no command
provided after --" to stderr and exit non‑zero. Place this check before the loop
that uses UNSET_ARGS and before the line invoking env "${UNSET_ARGS[@]}" "$@" so
callers invoking the script with only `--` fail early and clearly.

Comment thread scripts/run-example.sh

echo ">>> Running in examples/$EXAMPLE_NAME: $*"
(cd "$EXAMPLE_DIR" && "$@")
(cd "$EXAMPLE_DIR" && env "${UNSET_ARGS[@]}" "$@")
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat scripts/run-example.sh

Repository: halfdomelabs/baseplate

Length of output: 1280


🏁 Script executed:

# Test env behavior with only -u flags and no command
env -u TEST_VAR 2>&1 | head -20
echo "Exit code: $?"

Repository: halfdomelabs/baseplate

Length of output: 664


Guard against empty command after parsing arguments.

At Line 46, this can execute env with no command when called as run:example <name> --, which exits successfully and masks invalid usage.

Suggested fix
 # Skip the -- separator if present
 if [ "${1:-}" = "--" ]; then
   shift
 fi
+
+if [ $# -eq 0 ]; then
+  echo "Usage: pnpm run:example <example-name> -- <command...>"
+  echo "Example: pnpm run:example todo-with-better-auth -- pnpm install"
+  exit 1
+fi
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@scripts/run-example.sh` at line 46, The current invocation (cd "$EXAMPLE_DIR"
&& env "${UNSET_ARGS[@]}" "$@") can call env with no command when
"${UNSET_ARGS[@]}" and "$@" are both empty; add a guard before that line to
detect an empty command (check that either UNSET_ARGS or "$@" contains at least
one token) and fail with a non-zero exit and explanatory message if none exist.
Locate the run-example.sh snippet using the EXAMPLE_DIR, UNSET_ARGS, and "$@"
variables and implement the pre-check to ensure we never run env with no command
(returning an error/usage message instead).

Comment thread scripts/run-examples.sh
name="${dir#"$ROOT_DIR"/}"
echo ">>> Running in $name: $*"
(cd "$dir" && "$@")
(cd "$dir" && env "${UNSET_ARGS[@]}" "$@")
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat scripts/run-examples.sh

Repository: halfdomelabs/baseplate

Length of output: 860


🏁 Script executed:

# Test env behavior with no command
env | head -1 && echo "exit code: $?"

Repository: halfdomelabs/baseplate

Length of output: 88


Add a post--- command check to prevent silent success on empty arguments.

The script includes a pre-shift validation at line 4, but it only ensures at least one argument is provided before the -- separator. When invoked as pnpm run:examples -- (with no command after --), the check passes (since $# = 1), but after line 12 removes the --, $@ becomes empty. Line 34 then runs env without a command argument, which prints environment variables and exits 0 instead of failing.

The validation must occur after the shift to catch this case:

Suggested fix
 # Skip the -- separator if present
 if [ "$1" = "--" ]; then
   shift
 fi
+
+if [ $# -eq 0 ]; then
+  echo "Usage: pnpm run:examples -- <command...>"
+  echo "Example: pnpm run:examples -- pnpm install"
+  exit 1
+fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
(cd "$dir" && env "${UNSET_ARGS[@]}" "$@")
# Skip the -- separator if present
if [ "$1" = "--" ]; then
shift
fi
if [ $# -eq 0 ]; then
echo "Usage: pnpm run:examples -- <command...>"
echo "Example: pnpm run:examples -- pnpm install"
exit 1
fi
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@scripts/run-examples.sh` at line 34, The script currently runs (cd "$dir" &&
env "${UNSET_ARGS[@]}" "$@") which will silently succeed if the caller passed
only the `--` separator because the initial pre-shift check sees one arg, then
the `shift` removes it and "$@" becomes empty; add a post-shift validation
immediately after the code that removes `--` to check that "$@" is non-empty and
exit with a non-zero status (and an error message) if it is empty so that env is
never invoked without a command; reference the removal/shift logic and the
invocation line using UNSET_ARGS, dir and the env "${UNSET_ARGS[@]}" "$@" call
when making this change.

@kingston kingston merged commit 7031c74 into main Apr 1, 2026
13 checks passed
@kingston kingston deleted the kingston/eng-1147-upgrade-turborepo-to-29 branch April 1, 2026 10:20
@github-actions github-actions Bot mentioned this pull request Apr 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant