chore(deps): update dependency turbo to v2.9.9 by renovate[bot] · Pull Request #8550 · prisma/prisma-examples

fix: Align Markdown docs routing with docs/md endpoints by @molebox in #12596
fix: Support two-dot git ranges in filter selectors by @anthonyshew in #12599
feat: Graceful shutdown by @anthonyshew in #12607
test: Add stdin EOF startup regression coverage by @anthonyshew in #12609
fix: Ignore SIGINT in shim after spawning local turbo by @anthonyshew in #12612
fix: Support pnpm v11 multi-document lockfiles by @anthonyshew in #12616
fix: Preserve graceful shutdown exit code by @anthonyshew in #12620
fix: Keep Node wrapper alive during graceful shutdown by @anthonyshew in #12622
fix: Preserve PTY graceful shutdown semantics by @anthonyshew in #12624
feat: Move Vercel auth to standard OAuth/device flows by @markandrus in #12526
fix: Preserve legacy Vercel auth compatibility by @anthonyshew in #12629
fix: Recover Vercel auth tokens across login flows by @anthonyshew in #12631
docs: Fix TURBO_PLATFORM_ENV_DISABLED value in docs (true, not false) by @sleitor in #12633
chore: Update flags SDK by @AndyBitz in #12646
ci: Disable AWS-backed sccache by @anthonyshew in #12663
fix: Prevent prune from overmatching gitignore entries by @anthonyshew in #12662
ci: Harden release API commits by @anthonyshew in #12664
ci: Fix release API commit paths by @anthonyshew in #12665
release(turborepo): 2.9.7-canary.14 by @github-actions[bot] in #12666
chore: Add tbx sandbox helper by @anthonyshew in #12668
fix: Allow npm registry in tbx sandboxes by @anthonyshew in #12669
fix: Install turbo globally in tbx base by @anthonyshew in #12670
docs: Clarify package hash file inputs by @anthonyshew in #12671
fix: Allow tbx sandboxes to use stale bases by @anthonyshew in #12672
fix: Install dotfiles during tbx base refresh by @anthonyshew in #12673
fix: Improve tbx sandbox startup by @anthonyshew in #12674
fix: Improve tbx sandbox startup defaults by @anthonyshew in #12675
fix: Support pnpm 11 flat patch lockfiles by @anthonyshew in #12676
docs: Fix link to passthrough variables source code by @Wartijn in #12643
release(turborepo): 2.9.7-canary.15 by @github-actions[bot] in #12677
fix: Avoid rerunning non-cacheable watch dependencies by @anthonyshew in #12678

New Contributors

@marc-vercel made their first contribution in #12595
@cursor[bot] made their first contribution in #12600
@markandrus made their first contribution in #12526
@AndyBitz made their first contribution in #12646
@Wartijn made their first contribution in #12643

Full Changelog: vercel/turborepo@v2.9.6...v2.9.7

`v2.9.6`: Turborepo v2.9.6

Compare Source

What's Changed

create-turbo

chore: Update dependencies found in audits by @anthonyshew in #12586

Examples

fix: Add missing @types/node to with-svelte example apps by @anthonyshew in #12585

Changelog

docs: Add Bun equivalent for updating dependencies by @anthonyshew in #12580
fix: Mention turbo.json in concurrency error message by @anthonyshew in #12582
fix: Surface actionable message when remote cache is requested but not linked by @anthonyshew in #12584
chore: Delete agents app by @anthonyshew in #12587
fix: Load custom CA certificates in fast webpki-only HTTP client by @anthonyshew in #12591
docs: Remove pre-release badges by @anthonyshew in #12592

Full Changelog: vercel/turborepo@v2.9.5...v2.9.6

`v2.9.5`: Turborepo v2.9.5

Compare Source

What's Changed

create-turbo

feat: Replace package manager commands in scaffolded README files by @DependerKumarSoni in #6747

@turbo/telemetry

fix: Suppress telemetry alert when running on Vercel by @anthonyshew in #12576

Changelog

feat: Add circular package dependency detection to boundaries by @anthonyshew in #12567
perf: Increase remote cache upload chunk size from 8KB to 256KB by @anthonyshew in #12568
perf: Parallelize boundaries checking with Rayon and cache DFS traversals by @anthonyshew in #12569

New Contributors

@DependerKumarSoni made their first contribution in #6747

Full Changelog: vercel/turborepo@v2.9.4...v2.9.5

`v2.9.4`: Turborepo v2.9.4

Compare Source

What's Changed

@turbo/codemod

fix: Always update $schema URL to versioned format during migration by @anthonyshew in #12529
fix: Support turbo.jsonc in codemod transforms by @anthonyshew in #12532
fix: Preserve prerelease info in schema URL during codemod migration by @anthonyshew in #12542

Examples

build(deps): Bump @xmldom/xmldom from 0.8.11 to 0.8.12 in /examples/with-react-native-web by @dependabot[bot] in #12537

Changelog

feat: Add incremental task caching by @anthonyshew in #12531
docs: Send siteId as label on feedback GitHub issues by @molebox in #12527
Replace local ai-agent-detection with @vercel/agent-readability by @molebox in #12528
fix: Prevent filterUsingTasks --filter from pulling dependents into Task Graph by @anthonyshew in #12535
fix: Only enforce signature key length for keys that exist by @anthonyshew in #12538
fix: Validate engine concurrency after task-level filtering by @anthonyshew in #12540
feat: Allow --affected and --filter to be combined by @anthonyshew in #12543
fix(config): Deep-merge nested OTEL config across priority sources by @bitttttten in #12513
fix: Retain microfrontend proxy tasks when using filterUsingTasks by @anthonyshew in #12545
fix: Bun workspace lockfile pruning producing invalid output by @JRoy in #12548
fix: Respect dirty .gitignore patterns during task input hashing by @anthonyshew in #12557

New Contributors

@JRoy made their first contribution in #12548

Full Changelog: vercel/turborepo@v2.9.3...v2.9.4

`v2.9.3`: Turborepo v2.9.3

Compare Source

What's Changed

Changelog

fix: Preserve per-workspace lockfiles during pnpm pruning by @anthonyshew in #12519

Full Changelog: vercel/turborepo@v2.9.2...v2.9.3

`v2.9.2`: Turborepo v2.9.2

Compare Source

What's Changed

Examples

feat(examples): Add Next.js + Elysia full-stack starter template by @eastgold15 in #12414

Changelog

docs: Add documentation for cacheMaxAge and cacheMaxSize options by @anthonyshew in #12500
fix: Resolve correct nested bun lockfile versions during prune by @anthonyshew in #12506
Revert "fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes" by @anthonyshew in #12507
fix: Unblock watch loop so interruptible persistent tasks restart on file changes by @anthonyshew in #12509
fix(api-client): Treat * as wildcard in preflight Access-Control-Allow-Headers by @bitttttten in #12503
docs: Document turbo.* generator variables by @anthonyshew in #12511
fix: Backfill missing pnpm workspace importer entries during prune by @anthonyshew in #12514
fix: Include transitive dependencies in engine graph pruning for affected paths using Task Graph by @anthonyshew in #12516
fix: Update AI-generated response disclaimer to include human attribution by @Copilot in #12517
fix: Preserve shallow install strategy during npm lockfile pruning by @anthonyshew in #12520

New Contributors

@eastgold15 made their first contribution in #12414

Full Changelog: vercel/turborepo@v2.9.1...v2.9.2

`v2.9.1`: Turborepo v2.9.1

Compare Source

What's Changed

@turbo/codemod

feat: Handle package manager catalogs in migration codemod by @anthonyshew in #12496

@turbo/repository

feat: Add cacheMaxAge and cacheMaxSize for local cache eviction by @anthonyshew in #12487

Changelog

docs: Release post for 2.9 by @anthonyshew in #12441

Full Changelog: vercel/turborepo@v2.9.0...v2.9.1

`v2.9.0`: Turborepo v2.9.0

Compare Source

What's Changed

Docs

docs: Release post for 2.8 by @anthonyshew in #11559
docs: Update oxc.mdx to include cache false by @bestickley in #11571
docs: Fix curl markdown Accept header syntax in 2.8 release blog by @marko-hologram in #11580
docs: Fix worktree command in blog post by @anthonyshew in #11583
docs: Rename command → subcommand by @anthonyshew in #11584
feat: Add requestType tracking for header-negotiated markdown by @molebox in #11585
fix: Upgrade next to fix HTTP deserialization DoS by @anthonyshew in #11597
fix: Upgrade mermaid to fix lodash-es vulnerability by @anthonyshew in #11611
fix: Upgrade recharts to fix lodash vulnerability by @anthonyshew in #11606
chore: Move applications to apps/ directory by @anthonyshew in #11613
fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @anthonyshew in #11616
chore: Migrate to Ultracite by @haydenbleasel in #11948
fix: Strip JSX components from heading anchors and TOC entries by @anthonyshew in #12404

create-turbo

fix: Upgrade tsup to fix rollup and glob vulnerabilities by @anthonyshew in #11601
fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @anthonyshew in #11622
fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @anthonyshew in #11623
feat: Migrate from tsup to tsdown by @anthonyshew in #11649
fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11683
fix: Upgrade inquirer to remove lodash dependency by @anthonyshew in #11709
fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability by @anthonyshew in #11702
fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability by @anthonyshew in #11706
fix: Recover version numbering to 2.8.9-canary.0 by @anthonyshew in #11853
fix: Sanitize git command inputs in create-turbo by @anthonyshew in #11876
chore: Remove pnpm-eslint .vscode transform from create-turbo by @anthonyshew in #12186
fix: Improve create-turbo connectivity check and offline error messages by @anthonyshew in #12257
feat: Add affectedUsingTaskInputs future flag for task-level --affected detection by @anthonyshew in #12247
fix: Replace dns.lookup with https.get for create-turbo online check by @anthonyshew in #12277
fix: Remove redundant online check from create-turbo by @anthonyshew in #12281
fix: Sort uninstalled package managers to bottom of create-turbo selection by @anthonyshew in #12353

turbo-ignore

fix: Resolve pnpm audit vulnerabilities via dependency bumps by @anthonyshew in #12220
feat: Deprecate turbo-ignore in favor of turbo query affected by @anthonyshew in #12382
fix: Tailored turbo-ignore deprecation notice for Vercel users by @anthonyshew in #12385

@turbo/codemod

fix: Upgrade axios to fix SSRF vulnerability by @anthonyshew in #11599
fix: Replace axios with native fetch in turbo-codemod by @anthonyshew in #11600
fix: Upgrade diff to fix DoS vulnerabilities by @anthonyshew in #11621
fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @anthonyshew in #11766
fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11765
fix: Enhance path validation in assertSafeGitArgument by @odaysec in #11788
fix: Guard against missing pipeline key in clean-globs codemod by @anthonyshew in #12235
fix: Stop add-package-names codemod from silently renaming existing packages by @anthonyshew in #12332
fix: Handle Yarn 2+ in @turbo/codemod install commands by @anthonyshew in #12477

eslint

fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @anthonyshew in #11610
fix: Upgrade esbuild to fix arbitrary request vulnerability by @anthonyshew in #11615
fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities by @anthonyshew in #11681
fix: Upgrade eslint to v10 to resolve @eslint/plugin-kit ReDoS vulnerability by @anthonyshew in #11705
fix(eslint-plugin-turbo): Guard against missing tasks/pipeline in forEachTaskDef by @sleitor in #12411

@turbo/repository

fix: Rename cli workspace package to avoid false audit match by @anthonyshew in #11767
perf: Defer TLS initialization to a background thread by @anthonyshew in #11967
fix: Add repository field to @turbo/repository package.json by @anthonyshew in #11982
release(library): 0.0.1-canary.19 by @github-actions[bot] in #11983
feat: Add experimentalObservability with an OTel backend by @bkonkle in #11130
release(library): 0.0.1-canary.20 by @github-actions[bot] in #12116
chore: Update to Rust 1.94.0 by @ognevny in #12192
feat: Add packagesFromLockfile() NAPI binding to @turbo/repository by @anthonyshew in #12454
release(library): 0.0.1-canary.21 by @github-actions[bot] in #12455

Examples

examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in #11591
fix: escaping for link titles in LinksService by @odaysec in #11632
examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in #11679
docs: Replace mysql refs with postgres by @kyedavey in #11827
feat: Add with-otel example with pre-configured Grafana dashboard by @anthonyshew in #12043
examples: Upgrade with-react-native-web example to use latest versions by @serjooo in #12085
fix: Duplicate /signup? in Vercel URL by @04cb in #12088
examples: Fix markdown links inside code blocks in basic README by @sleitor in #11946
fix: Match vite and @vitejs/plugin-react versions on example by @GabrielBB in #12193
fix: Sync yarn lockfile before upgrading turbo in examples updater by @anthonyshew in #12286
chore: Upgrade Next.js to 16.2.0 in examples and apps by @anthonyshew in #12389
fix(examples): Update of with-svelte example by @floriansalihovic in #11952
fix: Use script-shell=bash for cross-platform with-shell-commands example by @Goldyvaiiii in #12436

Changelog

fix: Support trailing commas in microfrontends JSONC files by @anthonyshew in #11573
perf: Replace third-party crates with Rust std lib equivalents by @anthonyshew in #11569
perf: Reduce duplicate dependency versions by @anthonyshew in #11568
chore: Remove legacy Go/goreleaser buildcontainer directory by @anthonyshew in #11576
chore: Rename README.md to RULE.md in skills directory by @anthonyshew in #11582
fix: Validate turbo version from lockfile for all package managers by @anthonyshew in #11587
fix: Add allowComments and allowTrailingCommas to turbo.json schema by @ddmoney420 in #11579
chore: Eliminate ts-rs serde attribute parse warnings by @anthonyshew in #11589
fix: Extract git argument validation into reusable helper by @anthonyshew in #11593
fix: Upgrade fast-xml-parser to fix RangeError DoS by @anthonyshew in #11598
fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11596
fix: Upgrade tar to fix security vulnerabilities by @anthonyshew in #11602
fix: Upgrade @actions/github to fix @octokit vulnerabilities by @anthonyshew in #11607
fix: Upgrade @vercel/blob and @actions packages to fix undici vulnerability by @anthonyshew in #11608
docs: Running Root Tasks by @Netail in #11630
Update README.md title and remove features section by @anthonyshew in #11651
docs: Update using-environment-variables.mdx by @anthonyshew in #11652
fix: Upgrade js-yaml to address CVE-2025-64718 by @alexmkio in #11650
fix: Remove smooth scrolling from docs by @anthonyshew in #11654
fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @anthonyshew in #11655
fix: Upgrade capnp to 0.24 by @anthonyshew in #11656
fix: Upgrade h2 to fix CONTINUATION Flood by @anthonyshew in #11658
fix: Upgrade crossbeam-channel to 0.5.15 by @anthonyshew in #11657
chore: Remove abandoned turbo clone command by @anthonyshew in #11673
fix: Upgrade rustls and ring by @anthonyshew in #11659
fix: Upgrade openssl to 0.10.75 by @anthonyshew in #11660
fix: Replace unmaintained adler with adler2 by @anthonyshew in #11661
fix: Upgrade tar to 7.5.7 to address security vulnerabilities by @anthonyshew in #11680
fix: Upgrade ts-json-schema-generator to fix glob command injection vulnerability by @anthonyshew in #11684
fix: Upgrade fumadocs and shiki in docs to resolve mdast-util-to-hast vulnerability by @anthonyshew in #11704
fix: Replace ts-node with tsx to resolve diff DoS vulnerability by @anthonyshew in #11708
fix: Upgrade bytes to >=1.11.1 to fix RUSTSEC-2026-0007 by @anthonyshew in #11715
chore: Update ratatui dependencies (paste blocked upstream) by @anthonyshew in #11717
Revert "chore: Update ratatui dependencies (paste blocked upstream)" by @anthonyshew in #11722
fix: Upgrade ratatui to 0.30.0 to drop unmaintained paste crate by @anthonyshew in #11723
chore: Upgrade reqwest toward addressing RUSTSEC-2025-0134 by @anthonyshew in #11718
fix(docs): Fix code syntax highlighting by using correct Shiki CSS variable names by @anthonyshew in #11726
fix: Upgrade async-io to 2.x to drop unmaintained instant crate by @anthonyshew in #11719
fix: Migrate from unmaintained serde_yaml to serde_yml by @anthonyshew in #11720
fix: Upgrade test-case and merge to drop unmaintained proc-macro-error by @anthonyshew in #11721
fix: Upgrade indicatif to 0.18.3 to drop unmaintained number_prefix by @anthonyshew in #11716
refactor: Centralize configuration resolution funnel by @anthonyshew in #11727
fix: Upgrade rustls chain to resolve RUSTSEC-2025-0134 by @anthonyshew in #11739
fix: Upgrade test-case to resolve transitive proc-macro-error by @anthonyshew in #11737
fix: Upgrade pest/pest_derive to resolve yanked version by @anthonyshew in #11734
fix: Upgrade git2 to fix RUSTSEC-2026-0008 by @anthonyshew in #11729
fix: Upgrade pprof to fix RUSTSEC-2024-0408 by @anthonyshew in #11730
fix: Upgrade portable-pty to resolve RUSTSEC-2017-0008 by @anthonyshew in #11732
fix: Upgrade oxc_resolver to resolve yanked papaya dependency by @anthonyshew in #11733
fix: Upgrade futures/futures-util to resolve yanked futures-util 0.3.30 by @anthonyshew in #11735
fix: Replace unic-segment with unicode-segmentation in globwatch by @anthonyshew in #11736
fix: Replace serde_yml with serde_yaml_ng to fix RUSTSEC-2025-0067/0068 by @anthonyshew in #11755
fix: Replace oxc_resolver with unrs_resolver to fix yanked papaya dependency by @anthonyshew in #11754
fix: Upgrade node-plop to 0.32.3 by @anthonyshew in #11756
docs: Capitalizaiton in update github-actions.mdx by @anthonyshew in #11762
fix: Add Vary: Accept header to docs markdown endpoint by @molebox in #11759
chore: Agentic workflows app by @anthonyshew in #11773
chore: Add internal agents app for repo automation by @anthonyshew in #11776
chore: Update reproduction request message by @anthonyshew in #11778
Revert "fix: Upgrade node-plop to 0.32.3" by @anthonyshew in #11780
chore: Add internal agents app for repo automation by @anthonyshew in #11781
feat: Add internal agents app for repo automation by @anthonyshew in #11783
chore: Manual audits by @anthonyshew in #11785
chore: Fixing audit agent by @anthonyshew in #11786
chore: Still iterating on sec audit fixer by @anthonyshew in #11787
fix: Emit space for empty vt100 cells to fix TUI repaint on task switch by @anthonyshew in #11789
fix: Keep stdin alive for persistent tasks in stream mode by @anthonyshew in #11793
feat: Add internal agents app for repo automation by @anthonyshew in #11799
chore: Add env vars by @anthonyshew in #11800
fix: Handle subpath package imports in turbo boundaries by @anthonyshew in #11798
feat: Add dashboard with run tracking and live logs for agent sandboxes by @anthonyshew in #11802
fix: Normalize bare LF to CRLF in TUI output to prevent garbled logs by @anthonyshew in #11804
fix: Use private blob store access in agents app by @anthonyshew in #11811
fix: Pass non-empty body when initializing blob log files by @anthonyshew in [

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "before 8am every weekday,every weekend"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/turbo-monorepo branch from ef544b3 to 40243ee Compare May 1, 2026 14:48

renovate Bot changed the title ~~chore(deps): update dependency turbo to v2.9.6~~ chore(deps): update dependency turbo to v2.9.7 May 1, 2026

renovate Bot force-pushed the renovate/turbo-monorepo branch from 40243ee to 478ed3b Compare May 3, 2026 05:49

renovate Bot changed the title ~~chore(deps): update dependency turbo to v2.9.7~~ chore(deps): update dependency turbo to v2.9.8 May 3, 2026

chore(deps): update dependency turbo to v2.9.9

cf5be32

renovate Bot force-pushed the renovate/turbo-monorepo branch from 478ed3b to cf5be32 Compare May 4, 2026 22:47

renovate Bot changed the title ~~chore(deps): update dependency turbo to v2.9.8~~ chore(deps): update dependency turbo to v2.9.9 May 4, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency turbo to v2.9.9#8550

chore(deps): update dependency turbo to v2.9.9#8550
renovate[bot] wants to merge 1 commit intolatestfrom
renovate/turbo-monorepo

renovate Bot commented Apr 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.9.9: Turborepo v2.9.9

What's Changed

Changelog

New Contributors

v2.9.8: Turborepo v2.9.8

What's Changed

@​turbo/repository

Changelog

v2.9.7: Turborepo v2.9.7

What's Changed

eslint

Examples

Changelog

New Contributors

v2.9.6: Turborepo v2.9.6

What's Changed

create-turbo

Examples

Changelog

v2.9.5: Turborepo v2.9.5

What's Changed

create-turbo

@​turbo/telemetry

Changelog

New Contributors

v2.9.4: Turborepo v2.9.4

What's Changed

@​turbo/codemod

Examples

Changelog

New Contributors

v2.9.3: Turborepo v2.9.3

What's Changed

Changelog

v2.9.2: Turborepo v2.9.2

What's Changed

Examples

Changelog

New Contributors

v2.9.1: Turborepo v2.9.1

What's Changed

@​turbo/codemod

@​turbo/repository

Changelog

v2.9.0: Turborepo v2.9.0

What's Changed

Docs

create-turbo

turbo-ignore

@​turbo/codemod

eslint

@​turbo/repository

Examples

Changelog

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 17, 2026 •

edited

Loading

`v2.9.9`: Turborepo v2.9.9

`v2.9.8`: Turborepo v2.9.8

@turbo/repository

`v2.9.7`: Turborepo v2.9.7

`v2.9.6`: Turborepo v2.9.6

`v2.9.5`: Turborepo v2.9.5

@turbo/telemetry

`v2.9.4`: Turborepo v2.9.4

@turbo/codemod

`v2.9.3`: Turborepo v2.9.3

`v2.9.2`: Turborepo v2.9.2

`v2.9.1`: Turborepo v2.9.1

@turbo/codemod

@turbo/repository

`v2.9.0`: Turborepo v2.9.0

@turbo/codemod

@turbo/repository