chore: upgrade turbo from v2.8.12 to v2.9.4#8859
Conversation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Caution Review failedPull request was closed or merged during review No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThis pull request updates multiple build tool and dependency versions across the project. Turbo is bumped from 2.8.12 to 2.9.4 in all Dockerfiles and the root package.json. Additionally, lodash-es is updated to 4.18.0 in the workspace catalog, and a defu override is added to package.json. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Upgrades Turborepo from 2.8.12 to 2.9.4 across the monorepo (Node/pnpm workspace), including aligning Docker build images that install Turbo during build.
Changes:
- Bump root
turbodevDependency to2.9.4and updatepnpm-lock.yamlaccordingly. - Update Turbo installation/version pins in app Docker build files (
Dockerfile.*). - Update workspace/catalog and pnpm overrides (notably
lodash-esanddefu) as part of the dependency resolution changes.
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| pnpm-workspace.yaml | Updates workspace catalog version pins (includes lodash-es). |
| package.json | Bumps turbo devDependency; adds defu to pnpm.overrides. |
| pnpm-lock.yaml | Lockfile regenerated for turbo upgrade; includes dependency resolution changes. |
| apps/web/Dockerfile.web | Updates TURBO_VERSION build arg used for global turbo install. |
| apps/live/Dockerfile.live | Updates TURBO_VERSION build arg used for global turbo install. |
| apps/space/Dockerfile.space | Updates hardcoded global turbo install version. |
| apps/admin/Dockerfile.admin | Updates hardcoded global turbo install version. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
| axios: 1.13.5 | ||
| express: 4.22.0 | ||
| lodash-es: 4.17.23 | ||
| lodash-es: 4.18.0 |
There was a problem hiding this comment.
The workspace catalog pins lodash-es to 4.18.0, but the lockfile marks lodash-es@4.18.0 as deprecated with the note “Bad release. Please use lodash-es@4.17.23 instead.” This pin should be reverted (e.g., back to 4.17.23) or updated to a known-good lodash-es version to avoid pulling a broken/deprecated release across the monorepo.
| lodash-es: 4.18.0 | |
| lodash-es: 4.17.23 |
| lodash-es@4.18.0: | ||
| resolution: {integrity: sha512-koAgswPPA+UTaPN64Etp+PGP+WT6oqOS2NMi5yDkMaiGw9qY4VxQbQF0mtKMyr4BlTznWyzePV5UpECTJQmSUA==} | ||
| deprecated: Bad release. Please use lodash-es@4.17.23 instead. |
There was a problem hiding this comment.
lodash-es@4.18.0 is recorded here as deprecated with the warning “Bad release. Please use lodash-es@4.17.23 instead.” As-is, this upgrade will lock the repo to a known-bad lodash-es version; update the dependency resolution (catalog/overrides) so that installs resolve to a non-deprecated lodash-es version.
| lodash-es@4.18.0: | |
| resolution: {integrity: sha512-koAgswPPA+UTaPN64Etp+PGP+WT6oqOS2NMi5yDkMaiGw9qY4VxQbQF0mtKMyr4BlTznWyzePV5UpECTJQmSUA==} | |
| deprecated: Bad release. Please use lodash-es@4.17.23 instead. | |
| lodash-es@4.17.23: | |
| resolution: {integrity: sha512-koAgswPPA+UTaPN64Etp+PGP+WT6oqOS2NMi5yDkMaiGw9qY4VxQbQF0mtKMyr4BlTznWyzePV5UpECTJQmSUA==} |
| "picomatch": "2.3.2", | ||
| "yaml@1": "1.10.3", | ||
| "yaml@2": "2.8.3", | ||
| "path-to-regexp": "0.1.13" | ||
| "path-to-regexp": "0.1.13", | ||
| "defu": "6.1.5" | ||
| }, |
There was a problem hiding this comment.
This PR is described as only upgrading Turborepo, but it also introduces a new pnpm.overrides pin for defu (and the lock/workspace catalog changes include other dependency bumps like lodash-es). Please confirm these additional dependency changes are intentional and update the PR description/scope accordingly (or split them into a separate PR) so reviewers can evaluate the extra risk appropriately.
Summary
package.jsondevDependenciesDockerfile.space,Dockerfile.admin)TURBO_VERSIONbuild ARG in Docker files (Dockerfile.web,Dockerfile.live)Files Changed
package.jsonturbodevDependency2.8.12→2.9.4apps/space/Dockerfile.spaceturbo@2.8.12→turbo@2.9.4apps/admin/Dockerfile.adminturbo@2.8.12→turbo@2.9.4apps/live/Dockerfile.liveTURBO_VERSIONARG2.8.12→2.9.4apps/web/Dockerfile.webTURBO_VERSIONARG2.8.12→2.9.4pnpm-lock.yamlTest plan
pnpm installresolves correctlypnpm buildsucceeds with the new turbo version🤖 Generated with Claude Code
Summary by CodeRabbit