vercel/turborepo v2.8.2

Turborepo v2.8.2

on GitHub

What's Changed

Docs

• fix: Upgrade next to fix HTTP deserialization DoS by @anthonyshew in #11597
• fix: Upgrade mermaid to fix lodash-es vulnerability by @anthonyshew in #11611
• fix: Upgrade recharts to fix lodash vulnerability by @anthonyshew in #11606
• chore: Move applications to apps/ directory by @anthonyshew in #11613
• fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @anthonyshew in #11616

create-turbo

• fix: Upgrade tsup to fix rollup and glob vulnerabilities by @anthonyshew in #11601
• fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @anthonyshew in #11622
• fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @anthonyshew in #11623
• feat: Migrate from tsup to tsdown by @anthonyshew in #11649

@turbo/codemod

• fix: Upgrade axios to fix SSRF vulnerability by @anthonyshew in #11599
• fix: Replace axios with native fetch in turbo-codemod by @anthonyshew in #11600
• fix: Upgrade diff to fix DoS vulnerabilities by @anthonyshew in #11621

eslint

• fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @anthonyshew in #11610
• fix: Upgrade esbuild to fix arbitrary request vulnerability by @anthonyshew in #11615

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in #11591
• fix: escaping for link titles in LinksService by @odaysec in #11632

Changelog

• fix: Add allowComments and allowTrailingCommas to turbo.json schema by @ddmoney420 in #11579
• chore: Eliminate ts-rs serde attribute parse warnings by @anthonyshew in #11589
• fix: Extract git argument validation into reusable helper by @anthonyshew in #11593
• fix: Upgrade fast-xml-parser to fix RangeError DoS by @anthonyshew in #11598
• fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11596
• fix: Upgrade tar to fix security vulnerabilities by @anthonyshew in #11602
• fix: Upgrade @actions/github to fix @octokit vulnerabilities by @anthonyshew in #11607
• fix: Upgrade @vercel/blob and @actions packages to fix undici vulnerability by @anthonyshew in #11608
• docs: Running Root Tasks by @Netail in #11630
• Update README.md title and remove features section by @anthonyshew in #11651
• docs: Update using-environment-variables.mdx by @anthonyshew in #11652
• fix: Upgrade js-yaml to address CVE-2025-64718 by @alexmkio in #11650
• fix: Remove smooth scrolling from docs by @anthonyshew in #11654
• fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @anthonyshew in #11655

New Contributors

• @ddmoney420 made their first contribution in #11579
• @i5d6 made their first contribution in #11591
• @Netail made their first contribution in #11630
• @alexmkio made their first contribution in #11650

Full Changelog: v2.8.1...v2.8.2