chore(deps): update turbo monorepo to v2.8.13

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
eslint-config-turbo (source)	2.8.2 → 2.8.13
turbo (source)	2.8.2 → 2.8.13

---

Release Notes

vercel/turborepo (eslint-config-turbo)

v2.8.13: Turborepo v2.8.13

Compare Source

What's Changed

@​turbo/repository

• feat: Add experimentalObservability with an OTel backend by @​bkonkle in #​11130
• release(library): 0.0.1-canary.20 by @​github-actions[bot] in #​12116

Examples

• feat: Add with-otel example with pre-configured Grafana dashboard by @​anthonyshew in #​12043
• examples: Upgrade with-react-native-web example to use latest versions by @​serjooo in #​12085
• fix: Duplicate /signup? in Vercel URL by @​04cb in #​12088
• examples: Fix markdown links inside code blocks in basic README by @​sleitor in #​11946

Changelog

• fix: Suppress npm upgrade notices in integration tests and consolidate test helpers by @​anthonyshew in #​12036
• fix: Replace flaky pnpx symlink-dir with native NTFS junctions in find-turbo test by @​anthonyshew in #​12039
• fix: Prevent corepack download prompt from hanging prysk tests on Windows by @​anthonyshew in #​12041
• fix: Send OTEL metrics without requiring --summarize flag by @​anthonyshew in #​12042
• docs: Fix incorrect otel future flag bypass claim by @​anthonyshew in #​12047
• fix: Address root causes of 9 flaky tests and remove retry workarounds by @​anthonyshew in #​12045
• test: Port 6 prysk CLI tests to pure Rust by @​anthonyshew in #​12048
• docs: Fix experimentalObservability config reference by @​bkonkle in #​12052
• test: Port 10 more prysk tests to pure Rust by @​anthonyshew in #​12051
• test: Port 14 more prysk tests to Rust (single-package + commands) by @​anthonyshew in #​12054
• test: Port 13 more prysk tests to Rust by @​anthonyshew in #​12057
• fix: Exclude peer dependencies from workspace external dep resolution by @​anthonyshew in #​12050
• test: Port all 15 workspace-configs prysk tests to Rust by @​anthonyshew in #​12058
• perf: Stream file contents during hashing to lower memory usage by @​anthonyshew in #​12059
• fix: Treat npm: alias dependencies as external, not workspace references by @​anthonyshew in #​12061
• test: Port 18 more prysk tests to Rust (other/ + lockfile-aware-caching/) by @​anthonyshew in #​12062
• fix: Preserve file: protocol entries in pruned yarn v1 lockfile by @​anthonyshew in #​12064
• perf: Use stack-allocated OidHash in FileHashes and skip expanded hashes on normal runs by @​anthonyshew in #​12065
• test: Port all 8 find-turbo prysk tests to Rust by @​anthonyshew in #​12066
• fix: Support pnpm per-workspace lockfiles in turbo prune by @​anthonyshew in #​12067
• test: Port final 2 prysk tests to Rust (100% complete) by @​anthonyshew in #​12068
• fix: Resolve Berry prune failure when resolutions contain patch overrides by @​anthonyshew in #​12069
• test: Add lockfile fixture for yarn berry resolution pruning (issue #​2791) by @​anthonyshew in #​12071
• refactor: Clean up test infrastructure and eliminate duplication by @​anthonyshew in #​12072
• fix: Retain injected workspace package entries during pnpm lockfile pruning by @​anthonyshew in #​12073
• refactor: Clean up test infrastructure + improve test quality by @​anthonyshew in #​12074
• perf: Speed up lockfile test suite by @​anthonyshew in #​12078
• fix: Preserve file: and link: protocol entries in pruned bun lockfile by @​anthonyshew in #​12076
• fix: Stop running unnecessary npm install in engines tests by @​anthonyshew in #​12081
• test: Add lockfile fixture for pnpm v9 injected workspace deps (issue #​8243) by @​anthonyshew in #​12082
• fix: Filter orphaned Yarn packageExtensions entries during lockfile pruning by @​anthonyshew in #​12084
• fix: Align experimentalObservability on object maps rather than arrays by @​bkonkle in #​12089
• fix: Prevent yarn integration tests from hanging on corepack prompts by @​anthonyshew in #​12090
• fix: Prevent turbo dev from hanging when daemon file watching fails by @​anthonyshew in #​12091
• perf: Optimize npm lockfile parser by @​anthonyshew in #​12093
• chore: Trim unused dependency features for faster compilation by @​anthonyshew in #​12094
• fix: Prevent lockfile-aware yarn test from hanging on corepack downloads by @​anthonyshew in #​12095
• perf: Eliminate per-directory stat syscalls in untracked file detection by @​anthonyshew in #​12096
• perf: Reduce allocations in file hash computation by @​anthonyshew in #​12102
• perf: Replace SWC with oxc for JS/TS parsing by @​anthonyshew in #​12098
• fix: Pre-warm corepack cache to prevent yarn/pnpm tests from hanging by @​anthonyshew in #​12099
• perf: Disable unused zstd default features to reduce C compilation by @​anthonyshew in #​12107
• perf: Replace git subprocess in worktree detection with Rust by @​anthonyshew in #​12106
• test: Add turbo watch tests and refactor file change classification by @​anthonyshew in #​12119
• fix(frameworks): Also check devDependencies when inferring framework in single-package mode by @​sleitor in #​12056
• test: Add boundary tests for framework inference devDependencies support by @​anthonyshew in #​12122
• fix: Stabilize flaky watch_file_change_reruns_affected_package test by @​anthonyshew in #​12123
• fix: Microfrontends merges with into root config instead of replacing it by @​anthonyshew in #​12125
• fix: Omit None otel fields during turbo prune serialization by @​bkonkle in #​12126
• fix: Correct dependency iteration order so dependencies takes precedence over devDependencies by @​anthonyshew in #​12129

New Contributors

• @​bkonkle made their first contribution in #​11130
• @​serjooo made their first contribution in #​12085
• @​04cb made their first contribution in #​12088
• @​sleitor made their first contribution in #​11946

Full Changelog: vercel/turborepo@v2.8.12...v2.8.13

v2.8.12: Turborepo v2.8.12

Compare Source

What's Changed

Changelog

• chore: Reduce compile times by deduplicating thiserror and itertools by @​anthonyshew in #​12000
• chore: Upgrade axum 0.7 to 0.8, deduplicate tower/tower-http by @​anthonyshew in #​12003
• fix: Prevent peerDependencies from overwriting concrete dependency specifiers by @​anthonyshew in #​12004
• fix: Resolve correct nested package version in bun lockfile pruning by @​anthonyshew in #​12008
• fix: Resolve all lockfile pruning test failures by @​anthonyshew in #​12009
• perf: Extract query module into turborepo-query crate by @​anthonyshew in #​12007
• refactor: Migrate dry-json prysk tests to Rust + insta snapshots by @​anthonyshew in #​12010
• perf: Deduplicate petgraph, fixedbitset, and dashmap by @​anthonyshew in #​12011
• refactor: Migrate persistent-dependencies and task-dependencies to Rust + insta by @​anthonyshew in #​12012
• test: Add lockfile-tests fixture for issue #​12013 by @​anthonyshew in #​12014
• perf: Remove libgit2/git2 dependency, replace with gix-object by @​anthonyshew in #​12015
• refactor: Migrate daemon, jsonc, query, edit-turbo-json tests to Rust by @​anthonyshew in #​12016
• perf: Remove async-graphql from turborepo-lib by @​anthonyshew in #​12017
• refactor: Migrate inference and run-logging tests to Rust by @​anthonyshew in #​12018
• refactor: Migrate run-caching and strict-env-vars tests to Rust by @​anthonyshew in #​12020
• fix: Mark lockfile-aware-caching/bun prysk test as flaky by @​anthonyshew in #​12021
• fix: Add nextest retries for flaky tests by @​anthonyshew in #​12027
• refactor: Migrate prune and run-summary tests to Rust by @​anthonyshew in #​12022
• fix: Add nextest retries for flaky prysk tests by @​anthonyshew in #​12030
• fix: Add nextest retries for flaky prune_test::test_prune_composable_config by @​anthonyshew in #​12032
• fix: Suppress npm upgrade notices in Rust integration tests by @​anthonyshew in #​12033

Full Changelog: vercel/turborepo@v2.8.11...v2.8.12

v2.8.11: Turborepo v2.8.11

Compare Source

What's Changed

Docs

• chore: Migrate to Ultracite by @​haydenbleasel in #​11948

@​turbo/repository

• perf: Defer TLS initialization to a background thread by @​anthonyshew in #​11967
• fix: Add repository field to @​turbo/repository package.json by @​anthonyshew in #​11982
• release(library): 0.0.1-canary.19 by @​github-actions[bot] in #​11983

Changelog

• fix: Get all pnpm lockfile pruning tests passing by @​anthonyshew in #​11897
• perf: Optimize pnpm lockfile transitive closure resolution by @​anthonyshew in #​11898
• fix: Resolve npm packages in @​turbo/gen compiled binary by @​anthonyshew in #​11900
• perf: Deduplicate file hashing and parallelize globwalks by @​anthonyshew in #​11902
• perf: Improve transitive dependency resolution cache sharing across workspaces by @​anthonyshew in #​11903
• perf: Reduce filesystem syscalls in globwalk, SCM hashing, and task scheduling by @​anthonyshew in #​11907
• feat: Remove daemon from turbo run, deprecate daemon flags and config by @​anthonyshew in #​11910
• test: Replace help text integration tests with insta snapshots by @​anthonyshew in #​11911
• perf: Reduce allocations in SCM hashing, glob preprocessing, and cache lookups by @​anthonyshew in #​11916
• perf: Parallelize package.json loading and reduce builder allocations by @​anthonyshew in #​11918
• perf: Cache compiled env wildcard regexes for builtin pass-through patterns by @​anthonyshew in #​11920
• perf: Replace O(N) workspace path lookup with HashMap index in DependencySplitter by @​anthonyshew in #​11922
• perf: Parallelize lockfile parsing with workspace discovery by @​anthonyshew in #​11927
• perf: Optimize turbo run hotpath with parallelization and reduced allocations by @​anthonyshew in #​11928
• perf: Share HTTP client and improve profile instrumentation by @​anthonyshew in #​11929
• perf: Share HTTP client and improve profile instrumentation by @​anthonyshew in #​11932
• perf: Reduce git subprocess calls on startup by @​anthonyshew in #​11934
• chore: Upgrade zstd 0.12.3 to 0.13.3 by @​anthonyshew in #​11936
• perf: Replace git subprocesses with libgit2 and skip unnecessary summary work by @​anthonyshew in #​11938
• perf: Reduce per-package hashing overhead and eliminate SCM subprocesses by @​anthonyshew in #​11942
• perf: Reduce CPU overhead in turbo run hot path by @​anthonyshew in #​11947
• perf: Replace libgit2 git status with gix-index for faster file hashing by @​anthonyshew in #​11950
• perf: Resolve literal input paths via stat instead of glob walk by @​anthonyshew in #​11955
• perf: Optimize engine builder, task visitor, and untracked file discovery by @​anthonyshew in #​11956
• perf: Parallelize turbo run pre-execution hot path by @​anthonyshew in #​11958
• chore: Add tracing spans to uninstrumented hot path functions by @​anthonyshew in #​11959
• perf: Use Arc<str> for task dependency hashes to avoid heap clones by @​anthonyshew in #​11962
• perf: Add more tracing spans into startup path by @​anthonyshew in #​11965
• perf: Parallelize task hash computation across topological waves by @​anthonyshew in #​11969
• perf: Send engine callback before tracker bookkeeping and add tracing spans by @​anthonyshew in #​11970
• fix: Resolve git_root to worktree root in linked worktrees by @​anthonyshew in #​11974
• perf: Fast path for shallow wildcard glob patterns in workspace discovery by @​anthonyshew in #​11972
• chore: Move git hooks from pre-commit to pre-push and match CI lint checks by @​anthonyshew in #​11977
• chore: Update AGENTS.md by @​anthonyshew in #​11978
• perf: Replace heap-allocated String with stack-allocated OidHash for git OIDs by @​anthonyshew in #​11984
• perf: Eliminate redundant syscalls in FSCache fetch and exists by @​anthonyshew in #​11985
• perf: Reduce per-task allocations in visitor dispatch loop by @​anthonyshew in #​11986
• docs: Fix same-page anchor links that don't scroll to target by @​anthonyshew in #​11989
• docs: Mention inputs key in package hash inputs table by @​anthonyshew in #​11990
• fix(docs): update sitemap.md to single-line pipe-delimited format by @​molebox in #​11976
• fix: Disable husky pre-push hook during release staging by @​anthonyshew in #​11991
• fix: Use versioned schema URLs in Turborepo skill files by @​anthonyshew in #​11994
• fix: Restore daemon client in RunCache for turbo watch by @​anthonyshew in #​11995

Full Changelog: vercel/turborepo@v2.8.10...v2.8.11

v2.8.10: Turborepo v2.8.10

Compare Source

What's Changed

create-turbo

• fix: Sanitize git command inputs in create-turbo by @​anthonyshew in #​11876

Changelog

• fix: Move node-plop to dependencies so PlopTypes resolves for consumers by @​anthonyshew in #​11862
• chore: Use 2024 edition in more packages, do not ignore some clippy l… by @​ognevny in #​11860
• perf: Optimize hot-path hash computation by avoiding clones and using unstable sorts by @​anthonyshew in #​11872
• perf: Replace twox-hash with xxhash-rust and optimize file hashing by @​anthonyshew in #​11874
• fix: Restrict credential file permissions to owner-only by @​anthonyshew in #​11870
• perf: Reduce allocations in globwalk by @​anthonyshew in #​11528
• perf: Replace O(V³) Floyd-Warshall with O(V+E) DFS in watch mode subgraph creation by @​anthonyshew in #​11878
• feat: Generate LLM-friendly markdown alongside --profile trace output by @​anthonyshew in #​11880
• feat: Make --profile and --anon-profile filename optional by @​anthonyshew in #​11883
• perf: Batch per-package git subprocess calls into repo-wide index by @​anthonyshew in #​11887
• perf: Parallelize and pre-build RepoGitIndex by @​anthonyshew in #​11889
• perf: Pre-compile glob exclusion filter and cache path prefix in file hashing by @​anthonyshew in #​11891

Full Changelog: vercel/turborepo@v2.8.9...v2.8.10

v2.8.9: Turborepo v2.8.9

Compare Source

Full Changelog: vercel/turborepo@v2.8.8...v2.8.9

v2.8.8: Turborepo v2.8.8

Compare Source

What's Changed

@​turbo/codemod

• fix: Enhance path validation in assertSafeGitArgument by @​odaysec in #​11788

Examples

• docs: Replace mysql refs with postgres by @​kyedavey in #​11827

Changelog

• fix: Use private blob store access in agents app by @​anthonyshew in #​11811
• fix: Pass non-empty body when initializing blob log files by @​anthonyshew in #​11812
• docs: Geistdocs update by @​haydenbleasel in #​11807
• fix: Allow overwriting existing blobs in run updates and log appends by @​anthonyshew in #​11813
• docs: Geistdocs update 2 by @​haydenbleasel in #​11814
• fix: Set 5-hour timeout on security audit sandbox by @​anthonyshew in #​11815
• fix: Resolve Windows TUI hang caused by portable-pty 0.9.0 ConPTY changes by @​anthonyshew in #​11816
• fix: Repair audit fixer log streaming and replace git push with patch upload by @​anthonyshew in #​11818
• chore: Small stuff for agent fixer by @​anthonyshew in #​11819
• chore: Bump tonic to 0.14 by @​anthonyshew in #​11820
• fix: Pin @​turbo/gen version to match the running turbo binary by @​anthonyshew in #​11822
• fix: Use secret_key_override in tests to eliminate env var race condition by @​anthonyshew in #​11824
• fix: Avoid panic in sandboxed environments by removing system-configuration dependency by @​anthonyshew in #​11828
• fix: Harden token protection with secrecy crate and close exposure gaps by @​anthonyshew in #​11831
• fix: Clean up orphaned Windows child processes on shutdown by @​anthonyshew in #​11829
• chore: Update lockfile for release by @​anthonyshew in #​11840
• fix: Sync lockfile with @​turbo/gen optionalDependencies by @​anthonyshew in #​11845

New Contributors

• @​haydenbleasel made their first contribution in #​11807
• @​kyedavey made their first contribution in #​11827

Full Changelog: vercel/turborepo@v2.8.7...v2.8.8

v2.8.7: Turborepo v2.8.7

Compare Source

What's Changed

Changelog

• fix: Keep stdin alive for persistent tasks in stream mode by @​anthonyshew in #​11793
• feat: Add internal agents app for repo automation by @​anthonyshew in #​11799
• chore: Add env vars by @​anthonyshew in #​11800
• fix: Handle subpath package imports in turbo boundaries by @​anthonyshew in #​11798
• feat: Add dashboard with run tracking and live logs for agent sandboxes by @​anthonyshew in #​11802
• fix: Normalize bare LF to CRLF in TUI output to prevent garbled logs by @​anthonyshew in #​11804

Full Changelog: vercel/turborepo@v2.8.6...v2.8.7

v2.8.6: Turborepo v2.8.6

Compare Source

What's Changed

Changelog

• chore: Add internal agents app for repo automation by @​anthonyshew in #​11781
• feat: Add internal agents app for repo automation by @​anthonyshew in #​11783
• chore: Manual audits by @​anthonyshew in #​11785
• chore: Fixing audit agent by @​anthonyshew in #​11786
• chore: Still iterating on sec audit fixer by @​anthonyshew in #​11787
• fix: Emit space for empty vt100 cells to fix TUI repaint on task switch by @​anthonyshew in #​11789

Full Changelog: vercel/turborepo@v2.8.5...v2.8.6

v2.8.5: Turborepo v2.8.5

Compare Source

What's Changed

@​turbo/codemod

• fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @​anthonyshew in #​11766
• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11765

@​turbo/repository

• fix: Rename cli workspace package to avoid false audit match by @​anthonyshew in #​11767

Changelog

• fix: Add Vary: Accept header to docs markdown endpoint by @​molebox in #​11759
• chore: Agentic workflows app by @​anthonyshew in #​11773
• chore: Add internal agents app for repo automation by @​anthonyshew in #​11776
• chore: Update reproduction request message by @​anthonyshew in #​11778
• Revert "fix: Upgrade node-plop to 0.32.3" by @​anthonyshew in #​11780

Full Changelog: vercel/turborepo@v2.8.4...v2.8.5

v2.8.4: Turborepo v2.8.4

Compare Source

What's Changed

create-turbo

• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11683
• fix: Upgrade inquirer to remove lodash dependency by @​anthonyshew in #​11709
• fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability by @​anthonyshew in #​11702
• fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability by @​anthonyshew in #​11706

eslint

• fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities by @​anthonyshew in #​11681
• fix: Upgrade eslint to v10 to resolve @​eslint/plugin-kit ReDoS vulnerability by @​anthonyshew in #​11705

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @​i5d6 in #​11679

Changelog

• fix: Upgrade tar to 7.5.7 to address security vulnerabilities by @​anthonyshew in #​11680
• fix: Upgrade ts-json-schema-generator to fix glob command injection vulnerability by @​anthonyshew in #​11684
• fix: Upgrade fumadocs and shiki in docs to resolve mdast-util-to-hast vulnerability by @​anthonyshew in #​11704
• fix: Replace ts-node with tsx to resolve diff DoS vulnerability by @​anthonyshew in #​11708
• fix: Upgrade bytes to >=1.11.1 to fix RUSTSEC-2026-0007 by @​anthonyshew in #​11715
• chore: Update ratatui dependencies (paste blocked upstream) by @​anthonyshew in #​11717
• Revert "chore: Update ratatui dependencies (paste blocked upstream)" by @​anthonyshew in #​11722
• fix: Upgrade ratatui to 0.30.0 to drop unmaintained paste crate by @​anthonyshew in #​11723
• chore: Upgrade reqwest toward addressing RUSTSEC-2025-0134 by @​anthonyshew in #​11718
• fix(docs): Fix code syntax highlighting by using correct Shiki CSS variable names by @​anthonyshew in #​11726
• fix: Upgrade async-io to 2.x to drop unmaintained instant crate by @​anthonyshew in #​11719
• fix: Migrate from unmaintained serde_yaml to serde_yml by @​anthonyshew in #​11720
• fix: Upgrade test-case and merge to drop unmaintained proc-macro-error by @​anthonyshew in #​11721
• fix: Upgrade indicatif to 0.18.3 to drop unmaintained number_prefix by @​anthonyshew in #​11716
• refactor: Centralize configuration resolution funnel by @​anthonyshew in #​11727
• fix: Upgrade rustls chain to resolve RUSTSEC-2025-0134 by @​anthonyshew in #​11739
• fix: Upgrade test-case to resolve transitive proc-macro-error by @​anthonyshew in #​11737
• fix: Upgrade pest/pest_derive to resolve yanked version by @​anthonyshew in #​11734
• fix: Upgrade git2 to fix RUSTSEC-2026-0008 by @​anthonyshew in #​11729
• fix: Upgrade pprof to fix RUSTSEC-2024-0408 by @​anthonyshew in #​11730
• fix: Upgrade portable-pty to resolve RUSTSEC-2017-0008 by @​anthonyshew in #​11732
• fix: Upgrade oxc_resolver to resolve yanked papaya dependency by @​anthonyshew in #​11733
• fix: Upgrade futures/futures-util to resolve yanked futures-util 0.3.30 by @​anthonyshew in #​11735
• fix: Replace unic-segment with unicode-segmentation in globwatch by @​anthonyshew in #​11736
• fix: Replace serde_yml with serde_yaml_ng to fix RUSTSEC-2025-0067/0068 by @​anthonyshew in #​11755
• fix: Replace oxc_resolver with unrs_resolver to fix yanked papaya dependency by @​anthonyshew in #​11754
• fix: Upgrade node-plop to 0.32.3 by @​anthonyshew in #​11756
• docs: Capitalizaiton in update github-actions.mdx by @​anthonyshew in #​11762

Full Changelog: vercel/turborepo@v2.8.3...v2.8.4

v2.8.3: Turborepo v2.8.3

Compare Source

What's Changed

Changelog

• fix: Upgrade capnp to 0.24 by @​anthonyshew in #​11656
• fix: Upgrade h2 to fix CONTINUATION Flood by @​anthonyshew in #​11658
• fix: Upgrade crossbeam-channel to 0.5.15 by @​anthonyshew in #​11657
• chore: Remove abandoned turbo clone command by @​anthonyshew in #​11673
• fix: Upgrade rustls and ring by @​anthonyshew in #​11659
• fix: Upgrade openssl to 0.10.75 by @​anthonyshew in #​11660
• fix: Replace unmaintained adler with adler2 by @​anthonyshew in #​11661

Full Changelog: vercel/turborepo@v2.8.2...v2.8.3

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

🦋 Changeset detected

Latest commit: 10ef3c9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@dume/linting	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.