turbo 2.9.0

Turborepo v2.9.0

on Node.js NPM

What's Changed

Docs

• docs: Release post for 2.8 by @anthonyshew in #11559
• docs: Update oxc.mdx to include cache false by @bestickley in #11571
• docs: Fix curl markdown Accept header syntax in 2.8 release blog by @marko-hologram in #11580
• docs: Fix worktree command in blog post by @anthonyshew in #11583
• docs: Rename command → subcommand by @anthonyshew in #11584
• feat: Add requestType tracking for header-negotiated markdown by @molebox in #11585
• fix: Upgrade next to fix HTTP deserialization DoS by @anthonyshew in #11597
• fix: Upgrade mermaid to fix lodash-es vulnerability by @anthonyshew in #11611
• fix: Upgrade recharts to fix lodash vulnerability by @anthonyshew in #11606
• chore: Move applications to apps/ directory by @anthonyshew in #11613
• fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @anthonyshew in #11616
• chore: Migrate to Ultracite by @haydenbleasel in #11948
• fix: Strip JSX components from heading anchors and TOC entries by @anthonyshew in #12404

create-turbo

• fix: Upgrade tsup to fix rollup and glob vulnerabilities by @anthonyshew in #11601
• fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @anthonyshew in #11622
• fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @anthonyshew in #11623
• feat: Migrate from tsup to tsdown by @anthonyshew in #11649
• fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11683
• fix: Upgrade inquirer to remove lodash dependency by @anthonyshew in #11709
• fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability by @anthonyshew in #11702
• fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability by @anthonyshew in #11706
• fix: Recover version numbering to 2.8.9-canary.0 by @anthonyshew in #11853
• fix: Sanitize git command inputs in create-turbo by @anthonyshew in #11876
• chore: Remove pnpm-eslint .vscode transform from create-turbo by @anthonyshew in #12186
• fix: Improve create-turbo connectivity check and offline error messages by @anthonyshew in #12257
• feat: Add affectedUsingTaskInputs future flag for task-level --affected detection by @anthonyshew in #12247
• fix: Replace dns.lookup with https.get for create-turbo online check by @anthonyshew in #12277
• fix: Remove redundant online check from create-turbo by @anthonyshew in #12281
• fix: Sort uninstalled package managers to bottom of create-turbo selection by @anthonyshew in #12353

turbo-ignore

• fix: Resolve pnpm audit vulnerabilities via dependency bumps by @anthonyshew in #12220
• feat: Deprecate turbo-ignore in favor of turbo query affected by @anthonyshew in #12382
• fix: Tailored turbo-ignore deprecation notice for Vercel users by @anthonyshew in #12385

@turbo/codemod

• fix: Upgrade axios to fix SSRF vulnerability by @anthonyshew in #11599
• fix: Replace axios with native fetch in turbo-codemod by @anthonyshew in #11600
• fix: Upgrade diff to fix DoS vulnerabilities by @anthonyshew in #11621
• fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @anthonyshew in #11766
• fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11765
• fix: Enhance path validation in assertSafeGitArgument by @odaysec in #11788
• fix: Guard against missing pipeline key in clean-globs codemod by @anthonyshew in #12235
• fix: Stop add-package-names codemod from silently renaming existing packages by @anthonyshew in #12332
• fix: Handle Yarn 2+ in @turbo/codemod install commands by @anthonyshew in #12477

eslint

• fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @anthonyshew in #11610
• fix: Upgrade esbuild to fix arbitrary request vulnerability by @anthonyshew in #11615
• fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities by @anthonyshew in #11681
• fix: Upgrade eslint to v10 to resolve @eslint/plugin-kit ReDoS vulnerability by @anthonyshew in #11705
• fix(eslint-plugin-turbo): Guard against missing tasks/pipeline in forEachTaskDef by @sleitor in #12411

@turbo/repository

• fix: Rename cli workspace package to avoid false audit match by @anthonyshew in #11767
• perf: Defer TLS initialization to a background thread by @anthonyshew in #11967
• fix: Add repository field to @turbo/repository package.json by @anthonyshew in #11982
• release(library): 0.0.1-canary.19 by @github-actions[bot] in #11983
• feat: Add experimentalObservability with an OTel backend by @bkonkle in #11130
• release(library): 0.0.1-canary.20 by @github-actions[bot] in #12116
• chore: Update to Rust 1.94.0 by @ognevny in #12192
• feat: Add packagesFromLockfile() NAPI binding to @turbo/repository by @anthonyshew in #12454
• release(library): 0.0.1-canary.21 by @github-actions[bot] in #12455

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in #11591
• fix: escaping for link titles in LinksService by @odaysec in #11632
• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in #11679
• docs: Replace mysql refs with postgres by @kyedavey in #11827
• feat: Add with-otel example with pre-configured Grafana dashboard by @anthonyshew in #12043
• examples: Upgrade with-react-native-web example to use latest versions by @serjooo in #12085
• fix: Duplicate /signup? in Vercel URL by @04cb in #12088
• examples: Fix markdown links inside code blocks in basic README by @sleitor in #11946
• fix: Match vite and @vitejs/plugin-react versions on example by @GabrielBB in #12193
• fix: Sync yarn lockfile before upgrading turbo in examples updater by @anthonyshew in #12286
• chore: Upgrade Next.js to 16.2.0 in examples and apps by @anthonyshew in #12389
• fix(examples): Update of with-svelte example by @floriansalihovic in #11952
• fix: Use script-shell=bash for cross-platform with-shell-commands example by @Goldyvaiiii in #12436

Changelog

• fix: Support trailing commas in microfrontends JSONC files by @anthonyshew in #11573
• perf: Replace third-party crates with Rust std lib equivalents by @anthonyshew in #11569
• perf: Reduce duplicate dependency versions by @anthonyshew in #11568
• chore: Remove legacy Go/goreleaser buildcontainer directory by @anthonyshew in #11576
• chore: Rename README.md to RULE.md in skills directory by @anthonyshew in #11582
• fix: Validate turbo version from lockfile for all package managers by @anthonyshew in #11587
• fix: Add allowComments and allowTrailingCommas to turbo.json schema by @ddmoney420 in #11579
• chore: Eliminate ts-rs serde attribute parse warnings by @anthonyshew in #11589
• fix: Extract git argument validation into reusable helper by @anthonyshew in #11593
• fix: Upgrade fast-xml-parser to fix RangeError DoS by @anthonyshew in #11598
• fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11596
• fix: Upgrade tar to fix security vulnerabilities by @anthonyshew in #11602
• fix: Upgrade @actions/github to fix @octokit vulnerabilities by @anthonyshew in #11607
• fix: Upgrade @vercel/blob and @actions packages to fix undici vulnerability by @anthonyshew in #11608
• docs: Running Root Tasks by @Netail in #11630
• Update README.md title and remove features section by @anthonyshew in #11651
• docs: Update using-environment-variables.mdx by @anthonyshew in #11652
• fix: Upgrade js-yaml to address CVE-2025-64718 by @alexmkio in #11650
• fix: Remove smooth scrolling from docs by @anthonyshew in #11654
• fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @anthonyshew in #11655
• fix: Upgrade capnp to 0.24 by @anthonyshew in #11656
• fix: Upgrade h2 to fix CONTINUATION Flood by @anthonyshew in #11658
• fix: Upgrade crossbeam-channel to 0.5.15 by @anthonyshew in #11657
• chore: Remove abandoned turbo clone command by @anthonyshew in #11673
• fix: Upgrade rustls and ring by @anthonyshew in #11659
• fix: Upgrade openssl to 0.10.75 by @anthonyshew in #11660
• fix: Replace unmaintained adler with adler2 by @anthonyshew in #11661
• fix: Upgrade tar to 7.5.7 to address security vulnerabilities by @anthonyshew in #11680
• fix: Upgrade ts-json-schema-generator to fix glob command injection vulnerability by @anthonyshew in #11684
• fix: Upgrade fumadocs and shiki in docs to resolve mdast-util-to-hast vulnerability by @anthonyshew in #11704
• fix: Replace ts-node with tsx to resolve diff DoS vulnerability by @anthonyshew in #11708
• fix: Upgrade bytes to >=1.11.1 to fix RUSTSEC-2026-0007 by @anthonyshew in #11715
• chore: Update ratatui dependencies (paste blocked upstream) by @anthonyshew in #11717
• Revert "chore: Update ratatui dependencies (paste blocked upstream)" by @anthonyshew in #11722
• fix: Upgrade ratatui to 0.30.0 to drop unmaintained paste crate by @anthonyshew in #11723
• chore: Upgrade reqwest toward addressing RUSTSEC-2025-0134 by @anthonyshew in #11718
• fix(docs): Fix code syntax highlighting by using correct Shiki CSS variable names by @anthonyshew in #11726
• fix: Upgrade async-io to 2.x to drop unmaintained instant crate by @anthonyshew in #11719
• fix: Migrate from unmaintained serde_yaml to serde_yml by @anthonyshew in #11720
• fix: Upgrade test-case and merge to drop unmaintained proc-macro-error by @anthonyshew in #11721
• fix: Upgrade indicatif to 0.18.3 to drop unmaintained number_prefix by @anthonyshew in #11716
• refactor: Centralize configuration resolution funnel by @anthonyshew in #11727
• fix: Upgrade rustls chain to resolve RUSTSEC-2025-0134 by @anthonyshew in #11739
• fix: Upgrade test-case to resolve transitive proc-macro-error by @anthonyshew in #11737
• fix: Upgrade pest/pest_derive to resolve yanked version by @anthonyshew in #11734
• fix: Upgrade git2 to fix RUSTSEC-2026-0008 by @anthonyshew in #11729
• fix: Upgrade pprof to fix RUSTSEC-2024-0408 by @anthonyshew in #11730
• fix: Upgrade portable-pty to resolve RUSTSEC-2017-0008 by @anthonyshew in #11732
• fix: Upgrade oxc_resolver to resolve yanked papaya dependency by @anthonyshew in #11733
• fix: Upgrade futures/futures-util to resolve yanked futures-util 0.3.30 by @anthonyshew in #11735
• fix: Replace unic-segment with unicode-segmentation in globwatch by @anthonyshew in #11736
• fix: Replace serde_yml with serde_yaml_ng to fix RUSTSEC-2025-0067/0068 by @anthonyshew in #11755
• fix: Replace oxc_resolver with unrs_resolver to fix yanked papaya dependency by @anthonyshew in #11754
• fix: Upgrade node-plop to 0.32.3 by @anthonyshew in #11756
• docs: Capitalizaiton in update github-actions.mdx by @anthonyshew in #11762
• fix: Add Vary: Accept header to docs markdown endpoint by @molebox in #11759
• chore: Agentic workflows app by @anthonyshew in #11773
• chore: Add internal agents app for repo automation by @anthonyshew in #11776
• chore: Update reproduction request message by @anthonyshew in #11778
• Revert "fix: Upgrade node-plop to 0.32.3" by @anthonyshew in #11780
• chore: Add internal agents app for repo automation by @anthonyshew in #11781
• feat: Add internal agents app for repo automation by @anthonyshew in #11783
• chore: Manual audits by @anthonyshew in #11785
• chore: Fixing audit agent by @anthonyshew in #11786
• chore: Still iterating on sec audit fixer by @anthonyshew in #11787
• fix: Emit space for empty vt100 cells to fix TUI repaint on task switch by @anthonyshew in #11789
• fix: Keep stdin alive for persistent tasks in stream mode by @anthonyshew in #11793
• feat: Add internal agents app for repo automation by @anthonyshew in #11799
• chore: Add env vars by @anthonyshew in #11800
• fix: Handle subpath package imports in turbo boundaries by @anthonyshew in #11798
• feat: Add dashboard with run tracking and live logs for agent sandboxes by @anthonyshew in #11802
• fix: Normalize bare LF to CRLF in TUI output to prevent garbled logs by @anthonyshew in #11804
• fix: Use private blob store access in agents app by @anthonyshew in #11811
• fix: Pass non-empty body when initializing blob log files by @anthonyshew in #11812
• docs: Geistdocs update by @haydenbleasel in #11807
• fix: Allow overwriting existing blobs in run updates and log appends by @anthonyshew in #11813
• docs: Geistdocs update 2 by @haydenbleasel in #11814
• fix: Set 5-hour timeout on security audit sandbox by @anthonyshew in #11815
• fix: Resolve Windows TUI hang caused by portable-pty 0.9.0 ConPTY changes by @anthonyshew in #11816
• fix: Repair audit fixer log streaming and replace git push with patch upload by @anthonyshew in #11818
• chore: Small stuff for agent fixer by @anthonyshew in #11819
• chore: Bump tonic to 0.14 by @anthonyshew in #11820
• fix: Pin @turbo/gen version to match the running turbo binary by @anthonyshew in #11822
• fix: Use secret_key_override in tests to eliminate env var race condition by @anthonyshew in #11824
• fix: Avoid panic in sandboxed environments by removing system-configuration dependency by @anthonyshew in #11828
• fix: Harden token protection with secrecy crate and close exposure gaps by @anthonyshew in #11831
• fix: Clean up orphaned Windows child processes on shutdown by @anthonyshew in #11829
• chore: Update lockfile for release by @anthonyshew in #11840
• fix: Sync lockfile with @turbo/gen optionalDependencies by @anthonyshew in #11845
• docs: Update Vitest guide with projects configuration by @PeterPCW in #11760
• fix: Prevent premature git tag push during release staging by @anthonyshew in #11851
• fix: Replace unsafe pre_exec/setsid with tokio process_group(0) by @anthonyshew in #11854
• fix: Resolve external npm packages in @turbo/gen compiled binary (#11855) by @anthonyshew in #11856
• fix: Move node-plop to dependencies so PlopTypes resolves for consumers by @anthonyshew in #11862
• chore: Use 2024 edition in more packages, do not ignore some clippy l… by @ognevny in #11860
• perf: Optimize hot-path hash computation by avoiding clones and using unstable sorts by @anthonyshew in #11872
• perf: Replace twox-hash with xxhash-rust and optimize file hashing by @anthonyshew in #11874
• fix: Restrict credential file permissions to owner-only by @anthonyshew in #11870
• perf: Reduce allocations in globwalk by @anthonyshew in #11528
• perf: Replace O(V³) Floyd-Warshall with O(V+E) DFS in watch mode subgraph creation by @anthonyshew in #11878
• feat: Generate LLM-friendly markdown alongside --profile trace output by @anthonyshew in #11880
• feat: Make --profile and --anon-profile filename optional by @anthonyshew in #11883
• perf: Batch per-package git subprocess calls into repo-wide index by @anthonyshew in #11887
• perf: Parallelize and pre-build RepoGitIndex by @anthonyshew in #11889
• perf: Pre-compile glob exclusion filter and cache path prefix in file hashing by @anthonyshew in #11891
• fix: Get all pnpm lockfile pruning tests passing by @anthonyshew in #11897
• perf: Optimize pnpm lockfile transitive closure resolution by @anthonyshew in #11898
• fix: Resolve npm packages in @turbo/gen compiled binary by @anthonyshew in #11900
• perf: Deduplicate file hashing and parallelize globwalks by @anthonyshew in #11902
• perf: Improve transitive dependency resolution cache sharing across workspaces by @anthonyshew in #11903
• perf: Reduce filesystem syscalls in globwalk, SCM hashing, and task scheduling by @anthonyshew in #11907
• feat: Remove daemon from turbo run, deprecate daemon flags and config by @anthonyshew in #11910
• test: Replace help text integration tests with insta snapshots by @anthonyshew in #11911
• perf: Reduce allocations in SCM hashing, glob preprocessing, and cache lookups by @anthonyshew in #11916
• perf: Parallelize package.json loading and reduce builder allocations by @anthonyshew in #11918
• perf: Cache compiled env wildcard regexes for builtin pass-through patterns by @anthonyshew in #11920
• perf: Replace O(N) workspace path lookup with HashMap index in DependencySplitter by @anthonyshew in #11922
• perf: Parallelize lockfile parsing with workspace discovery by @anthonyshew in #11927
• perf: Optimize turbo run hotpath with parallelization and reduced allocations by @anthonyshew in #11928
• perf: Share HTTP client and improve profile instrumentation by @anthonyshew in #11929
• perf: Share HTTP client and improve profile instrumentation by @anthonyshew in #11932
• perf: Reduce git subprocess calls on startup by @anthonyshew in #11934
• chore: Upgrade zstd 0.12.3 to 0.13.3 by @anthonyshew in #11936
• perf: Replace git subprocesses with libgit2 and skip unnecessary summary work by @anthonyshew in #11938
• perf: Reduce per-package hashing overhead and eliminate SCM subprocesses by @anthonyshew in #11942
• perf: Reduce CPU overhead in turbo run hot path by @anthonyshew in #11947
• perf: Replace libgit2 git status with gix-index for faster file hashing by @anthonyshew in #11950
• perf: Resolve literal input paths via stat instead of glob walk by @anthonyshew in #11955
• perf: Optimize engine builder, task visitor, and untracked file discovery by @anthonyshew in #11956
• perf: Parallelize turbo run pre-execution hot path by @anthonyshew in #11958
• chore: Add tracing spans to uninstrumented hot path functions by @anthonyshew in #11959
• perf: Use Arc<str> for task dependency hashes to avoid heap clones by @anthonyshew in #11962
• perf: Add more tracing spans into startup path by @anthonyshew in #11965
• perf: Parallelize task hash computation across topological waves by @anthonyshew in #11969
• perf: Send engine callback before tracker bookkeeping and add tracing spans by @anthonyshew in #11970
• fix: Resolve git_root to worktree root in linked worktrees by @anthonyshew in #11974
• perf: Fast path for shallow wildcard glob patterns in workspace discovery by @anthonyshew in #11972
• chore: Move git hooks from pre-commit to pre-push and match CI lint checks by @anthonyshew in #11977
• chore: Update AGENTS.md by @anthonyshew in #11978
• perf: Replace heap-allocated String with stack-allocated OidHash for git OIDs by @anthonyshew in #11984
• perf: Eliminate redundant syscalls in FSCache fetch and exists by @anthonyshew in #11985
• perf: Reduce per-task allocations in visitor dispatch loop by @anthonyshew in #11986
• docs: Fix same-page anchor links that don't scroll to target by @anthonyshew in #11989
• docs: Mention inputs key in package hash inputs table by @anthonyshew in #11990
• fix(docs): update sitemap.md to single-line pipe-delimited format by @molebox in #11976
• fix: Disable husky pre-push hook during release staging by @anthonyshew in #11991
• fix: Use versioned schema URLs in Turborepo skill files by @anthonyshew in #11994
• fix: Restore daemon client in RunCache for turbo watch by @anthonyshew in #11995
• chore: Reduce compile times by deduplicating thiserror and itertools by @anthonyshew in #12000
• chore: Upgrade axum 0.7 to 0.8, deduplicate tower/tower-http by @anthonyshew in #12003
• fix: Prevent peerDependencies from overwriting concrete dependency specifiers by @anthonyshew in #12004
• fix: Resolve correct nested package version in bun lockfile pruning by @anthonyshew in #12008
• fix: Resolve all lockfile pruning test failures by @anthonyshew in #12009
• perf: Extract query module into turborepo-query crate by @anthonyshew in #12007
• refactor: Migrate dry-json prysk tests to Rust + insta snapshots by @anthonyshew in #12010
• perf: Deduplicate petgraph, fixedbitset, and dashmap by @anthonyshew in #12011
• refactor: Migrate persistent-dependencies and task-dependencies to Rust + insta by @anthonyshew in #12012
• test: Add lockfile-tests fixture for issue #12013 by @anthonyshew in #12014
• perf: Remove libgit2/git2 dependency, replace with gix-object by @anthonyshew in #12015
• refactor: Migrate daemon, jsonc, query, edit-turbo-json tests to Rust by @anthonyshew in #12016
• perf: Remove async-graphql from turborepo-lib by @anthonyshew in #12017
• refactor: Migrate inference and run-logging tests to Rust by @anthonyshew in #12018
• refactor: Migrate run-caching and strict-env-vars tests to Rust by @anthonyshew in #12020
• fix: Mark lockfile-aware-caching/bun prysk test as flaky by @anthonyshew in #12021
• fix: Add nextest retries for flaky tests by @anthonyshew in #12027
• refactor: Migrate prune and run-summary tests to Rust by @anthonyshew in #12022
• fix: Add nextest retries for flaky prysk tests by @anthonyshew in #12030
• fix: Add nextest retries for flaky prune_test::test_prune_composable_config by @anthonyshew in #12032
• fix: Suppress npm upgrade notices in Rust integration tests by @anthonyshew in #12033
• fix: Suppress npm upgrade notices in integration tests and consolidate test helpers by @anthonyshew in #12036
• fix: Replace flaky pnpx symlink-dir with native NTFS junctions in find-turbo test by @anthonyshew in #12039
• fix: Prevent corepack download prompt from hanging prysk tests on Windows by @anthonyshew in #12041
• fix: Send OTEL metrics without requiring --summarize flag by @anthonyshew in #12042
• docs: Fix incorrect otel future flag bypass claim by @anthonyshew in #12047
• fix: Address root causes of 9 flaky tests and remove retry workarounds by @anthonyshew in #12045
• test: Port 6 prysk CLI tests to pure Rust by @anthonyshew in #12048
• docs: Fix experimentalObservability config reference by @bkonkle in #12052
• test: Port 10 more prysk tests to pure Rust by @anthonyshew in #12051
• test: Port 14 more prysk tests to Rust (single-package + commands) by @anthonyshew in #12054
• test: Port 13 more prysk tests to Rust by @anthonyshew in #12057
• fix: Exclude peer dependencies from workspace external dep resolution by @anthonyshew in #12050
• test: Port all 15 workspace-configs prysk tests to Rust by @anthonyshew in #12058
• perf: Stream file contents during hashing to lower memory usage by @anthonyshew in #12059
• fix: Treat npm: alias dependencies as external, not workspace references by @anthonyshew in #12061
• test: Port 18 more prysk tests to Rust (other/ + lockfile-aware-caching/) by @anthonyshew in #12062
• fix: Preserve file: protocol entries in pruned yarn v1 lockfile by @anthonyshew in #12064
• perf: Use stack-allocated OidHash in FileHashes and skip expanded hashes on normal runs by @anthonyshew in #12065
• test: Port all 8 find-turbo prysk tests to Rust by @anthonyshew in #12066
• fix: Support pnpm per-workspace lockfiles in turbo prune by @anthonyshew in #12067
• test: Port final 2 prysk tests to Rust (100% complete) by @anthonyshew in #12068
• fix: Resolve Berry prune failure when resolutions contain patch overrides by @anthonyshew in #12069
• test: Add lockfile fixture for yarn berry resolution pruning (issue #2791) by @anthonyshew in #12071
• refactor: Clean up test infrastructure and eliminate duplication by @anthonyshew in #12072
• fix: Retain injected workspace package entries during pnpm lockfile pruning by @anthonyshew in #12073
• refactor: Clean up test infrastructure + improve test quality by @anthonyshew in #12074
• perf: Speed up lockfile test suite by @anthonyshew in #12078
• fix: Preserve file: and link: protocol entries in pruned bun lockfile by @anthonyshew in #12076
• fix: Stop running unnecessary npm install in engines tests by @anthonyshew in #12081
• test: Add lockfile fixture for pnpm v9 injected workspace deps (issue #8243) by @anthonyshew in #12082
• fix: Filter orphaned Yarn packageExtensions entries during lockfile pruning by @anthonyshew in #12084
• fix: Align experimentalObservability on object maps rather than arrays by @bkonkle in #12089
• fix: Prevent yarn integration tests from hanging on corepack prompts by @anthonyshew in #12090
• fix: Prevent turbo dev from hanging when daemon file watching fails by @anthonyshew in #12091
• perf: Optimize npm lockfile parser by @anthonyshew in #12093
• chore: Trim unused dependency features for faster compilation by @anthonyshew in #12094
• fix: Prevent lockfile-aware yarn test from hanging on corepack downloads by @anthonyshew in #12095
• perf: Eliminate per-directory stat syscalls in untracked file detection by @anthonyshew in #12096
• perf: Reduce allocations in file hash computation by @anthonyshew in #12102
• perf: Replace SWC with oxc for JS/TS parsing by @anthonyshew in #12098
• fix: Pre-warm corepack cache to prevent yarn/pnpm tests from hanging by @anthonyshew in #12099
• perf: Disable unused zstd default features to reduce C compilation by @anthonyshew in #12107
• perf: Replace git subprocess in worktree detection with Rust by @anthonyshew in #12106
• test: Add turbo watch tests and refactor file change classification by @anthonyshew in #12119
• fix(frameworks): Also check devDependencies when inferring framework in single-package mode by @sleitor in #12056
• test: Add boundary tests for framework inference devDependencies support by @anthonyshew in #12122
• fix: Stabilize flaky watch_file_change_reruns_affected_package test by @anthonyshew in #12123
• fix: Microfrontends merges with into root config instead of replacing it by @anthonyshew in #12125
• fix: Omit None otel fields during turbo prune serialization by @bkonkle in #12126
• fix: Correct dependency iteration order so dependencies takes precedence over devDependencies by @anthonyshew in #12129
• perf: Skip irrelevant packages when using package#task syntax by @anthonyshew in #12135
• fix: Use delta temporality for OTel metrics export by @bkonkle in #12136
• fix: Wait for dependsOn on first run of turbo watch by @MrNaif2018 in #11953
• fix: Treat Bun runtime modules as builtins in Boundaries by @anthonyshew in #12141
• feat: Add futureFlags.longerSignatureKey to enforce minimum HMAC key length by @anthonyshew in #12142
• feat: Add runAttributes config to OTel metrics for cardinality control by @bkonkle in #12144
• fix: Preserve deeply nested workspace deps during npm lockfile pruning by @anthonyshew in #12146
• fix: Ensure noUpdateNotifier from turbo.json is respected by @sleitor in #11925
• docs: Document Yarn v1 pass-through args workaround by @anthonyshew in #12150
• fix: Add FORCE_COLOR and NO_COLOR to builtin passthrough env vars by @anthonyshew in #12158
• test: Add integration test coverage for --anon-profile markdown generation by @anthonyshew in #12157
• feat: Add AI coding agent detection telemetry by @anthonyshew in #12159
• feat: Instrument post-hashing setup phase for trace visibility by @anthonyshew in #12160
• perf: Fire-and-forget telemetry and analytics HTTP flushes on shutdown by @anthonyshew in #12162
• perf: Defer lockfile await until after internal dependency resolution by @anthonyshew in #12164
• refactor: Extract turborepo-query-api trait crate for compile-time decoupling by @anthonyshew in #12165
• feat: Include version, platform, and CPU count in Chrome trace profiles by @anthonyshew in #12166
• docs: Remove bespoke AI prompts from documentation pages by @anthonyshew in #12167
• test: Add comprehensive path traversal tests for cache archive by @anthonyshew in #12169
• test: Add regression tests and OutputWatcher trait to prepare for daemon removal from turbo watch by @anthonyshew in #12171
• feat: Remove daemon from watch mode by @anthonyshew in #12175
• perf: Defer SCM task await to overlap with setup work by @anthonyshew in #12177
• perf: Defer cache save to after callback to unblock dependents sooner by @anthonyshew in #12178
• chore: Add oxfmt check to pre-push hook by @anthonyshew in #12187
• fix: Resolve pnpm catalog: specifiers to workspace dependencies in task graph by @anthonyshew in #12185
• perf: Avoid Unconditional HTTP Client Warmup by @anthonyshew in #12189
• perf: Scope Repo Index Untracked Discovery by @anthonyshew in #12195
• perf: Reuse input hashes and trim pnpm lockfile allocations by @anthonyshew in #12199
• docs: Improve Oxc tooling guide for type-aware linting and fix race conditions by @anthonyshew in #12200
• perf: Overlap untracked file walk with builder setup by @anthonyshew in #12201
• perf: Decouple filesystem walk from git index construction by @anthonyshew in #12204
• perf: Race parallel git subprocesses against filesystem walk for optimal index construction by @anthonyshew in #12206
• perf: Two-phase HTTP client init to avoid macOS Keychain blocking by @anthonyshew in #12208
• perf: Skip redundant file writes during cache restore using manifests by @anthonyshew in #12209
• perf: Generate cache restore manifest at save time to eliminate first-hit penalty by @anthonyshew in #12213
• docs: Clarification in oxc guide by @anthonyshew in #12207
• feat: Add affectedTasks query for task-level change detection by @anthonyshew in #12215
• docs: Replace mermaid with reactflow-based diagram components by @anthonyshew in #11770
• fix: Remove unnecessary dependency overrides and bump quinn-proto by @anthonyshew in #12226
• fix: Remove all remaining pnpm dependency overrides by @anthonyshew in #12227
• fix: Promote nested bun lockfile entries when hoisted version is pruned by @anthonyshew in #12228
• fix: Honor --output-logs errors-only for non-cached tasks by @veeceey in #11926
• docs: Remove CONSOLE DO NOT TRACK link by @anthonyshew in #12232
• docs: missing migrate word by @anthonyshew in #12234
• fix: Resolve root-level tasks not executing with //# CLI syntax by @anthonyshew in #12242
• fix: Prevent run summary SendError panic on shutdown by @anthonyshew in #12244
• fix: Deflake watch_rapid_edits_produce_single_rebuild test by @anthonyshew in #12245
• fix: Use FilterMode enum for root task scoping with exclude-only filters by @Jaredw2289-svg in #12212
• fix: Resolve package-name-shaped tsconfig path aliases by @sleitor in #11998
• fix: Use BTreeMap for deterministic lockfile dependency ordering by @anthonyshew in #12254
• fix: Cap rayon thread pool and block_in_place in tokio to prevent deadlock potential by @anthonyshew in #12253
• feat: Add Node.js version to turbo info output by @anthonyshew in #12260
• feat: Send x-ai-agent header on all Vercel API requests by @anthonyshew in #12261
• fix: Deflake watch_edit_during_build_triggers_rebuild test by @anthonyshew in #12263
• fix: Validate task names when --affected yields empty package scope by @anthonyshew in #12268
• feat: Deprecate --scope flag for turbo prune by @anthonyshew in #12269
• docs: Note that future flags affect global hash by @anthonyshew in #12271
• fix: Align query affectedTasks with run --affected for $TURBO_ROOT$ inputs by @anthonyshew in #12270
• fix: Initialize TUI terminal in watch mode even when all tasks hit cache by @anthonyshew in #12273
• feat: Use task graph for watch by @anthonyshew in #12275
• fix: Use BTreeMap for bundled_deps in bun PackageIndex by @anthonyshew in #12266
• fix: Fix non-deterministic hashOfExternalDependencies with Bun lockfiles by @anthonyshew in #12279
• feat: Add turbo query affected CLI shorthand by @anthonyshew in #12283
• chore: Add turborepo-log crate to improve our logging situation by @anthonyshew in #12285
• fix: Ensure pkg#task CLI args are always included in filtered packages by @anthonyshew in #12287
• feat: Wire up turborepo-log with TerminalSink and convert first warning by @anthonyshew in #12289
• feat: Add git SHA and dirty hash to cache metadata by @mehulkar in #12288
• feat: Surface cache SCM metadata in Run Summary by @mehulkar in #12291
• fix: Inline PlopTypes in @turbo/gen to fix implicit any for consumers by @anthonyshew in #12292
• chore: Disable update notifier for this repo by @anthonyshew in #12293
• feat: Add TuiSink to route log events into the TUI by @anthonyshew in #12294
• feat: Publish platform binaries under @turbo/ scoped packages by @anthonyshew in #12296
• feat: Initialize turborepo-log in turbo watch by @anthonyshew in #12298
• fix: Resolve git diff warning in fresh repos and make SCM state lazy by @anthonyshew in #12300
• docs: Add VS Code Jest extension workaround to Jest guide by @anthonyshew in #12303
• feat: Route user-facing warnings through turborepo-log and suppress tracing stderr in TUI mode by @anthonyshew in #12299
• fix: Handle parent directory inputs in non-git repos by @anthonyshew in #12304
• fix: Source cargo env in pre-push hook for Rust toolchain resolution by @anthonyshew in #12306
• refactor: Convert task-access warnings to turborepo_log by @anthonyshew in #12307
• chore: Remove internal .vscode directory by @anthonyshew in #12309
• fix: Expand directory inputs to dir/** in manual SCM and git literal-path optimization by @anthonyshew in #12305
• fix: Infer monorepo root in LSP instead of trusting editor root_uri by @anthonyshew in #12308
• fix: Flush stale mouse tracking events from stdin during TUI cleanup by @anthonyshew in #12311
• refactor: Route run prelude through turborepo_log, add StdoutSink by @anthonyshew in #12310
• feat: Show richer remote cache status in run prelude by @anthonyshew in #12314
• chore: Remove deprecated Spaces feature remnants by @anthonyshew in #12316
• refactor: Route run/watch output through unified TerminalSink by @anthonyshew in #12315
• refactor: Replace tracing::log:: bridge imports with tracing:: directly by @anthonyshew in #12320
• refactor: Replace Source::turbo string literals with Subsystem enum by @anthonyshew in #12321
• fix: Add check:toml to pre-push hook by @anthonyshew in #12322
• fix: Filter phantom tasks from affectedTasks query results by @anthonyshew in #12324
• refactor: Route 'no tasks executed' warning through turborepo-log and add task prefix to TerminalSink by @anthonyshew in #12326
• feat: Allow cyclic package graphs, validate only at task graph level by @anthonyshew in #12327
• fix: Detect affected tasks with $TURBO_ROOT$ inputs when using affectedUsingTaskInputs by @anthonyshew in #12331
• feat: Extend LogSink with task output and grouping support by @anthonyshew in #12328
• fix: Support private GitHub repos in turbo gen workspace --copy by @anthonyshew in #12333
• feat: Add GroupingLayer for per-task output buffering by @anthonyshew in #12334
• fix: Hardening for supporting private GitHub repos in turbo gen workspace --copy by @anthonyshew in #12336
• refactor: Wire GroupingLayer into Visitor and migrate task error/warn to turborepo-log by @anthonyshew in #12337
• perf: Replace subprocess repo index with in-process gix-index by @anthonyshew in #12339
• fix: Prevent $TURBO_DEFAULT$ from matching unrelated root files in affected detection by @anthonyshew in #12341
• feat: Route child process bytes through TaskHandle with sink-owned prefix rendering by @anthonyshew in #12343
• feat: Deprecate graphviz-dependent --graph formats, add native SVG rendering by @anthonyshew in #12344
• refactor: Migrate cache replay and status messages to TaskHandle, remove CacheOutput trait by @anthonyshew in #12345
• refactor: Remove old output pipeline and document logging architecture by @anthonyshew in #12348
• chore: Move section in CONTRIBUTING.md by @anthonyshew in #12350
• chore: Update undici dependency version to 6.24.0 by @hack-313-ip in #12352
• docs: Clean up futureFlags description by @anthonyshew in #12355
• feat: Deprecate --parallel flag by @anthonyshew in #12357
• fix: Resolve $turbo-get-mfe-port by packageName when application key differs by @prudentbird in #12149
• fix: Preserve all bun lockfile overrides during prune by @anthonyshew in #12362
• feat: Include globalDependencies in prune behind Future Flag by @anthonyshew in #12360
• feat: Add filterUsingTasks future flag for task-level --filter resolution by @anthonyshew in #12363
• fix: Suppress noisy rustls TLS warning on stderr by @anthonyshew in #12365
• docs: Fix typo in Turbo 2.7 blog post by @Rohan5commit in #12367
• fix: Fall back to bundled certificates when system cert store is inaccessible by @anthonyshew in #12371
• fix: Pass TURBO_* env vars through to child processes in Strict Mode by @anthonyshew in #12372
• fix: Improve accessibility for docs by @anthonyshew in #12375
• fix: Preserve package.json key order during turbo prune with pnpm patches by @anthonyshew in #12376
• fix: Detect scoped @turbo/{platform} packages in local binary resolution by @EmojiPati in #12386
• fix: Support legacy unscoped binary package names in Node.js shim by @anthonyshew in #12391
• fix: Prevent stdin from being dropped for persistent tasks in stream mode by @anthonyshew in #12394
• docs: Add link to Docker guide in prune --docker flag section by @styfle in #12401
• feat: Add global configuration key behind futureFlags.globalConfiguration by @anthonyshew in #12399
• chore: Update CODEOWNERS to remove /docs owner by @anthonyshew in #12402
• fix: Move docs app icons into app/ directory by @anthonyshew in #12403
• feat: Add experimental structured logging with --json and --log-file flags by @anthonyshew in #12405
• docs: Downgrade Next.js by @anthonyshew in #12408
• chore: Deprecate the turbo scan command by @anthonyshew in #12406
• chore: Upgrade Next.js by @anthonyshew in #12415
• Revert "fix: Flush stale mouse tracking events from stdin during TUI cleanup" by @anthonyshew in #12416
• fix: Add NixOS environment variables to default passthroughs by @anthonyshew in #12417
• fix: Resolve security vulnerabilities in tar and rustls-webpki by @anthonyshew in #12418
• docs: Promote turbo query from experimental to stable by @anthonyshew in #12421
• docs: Clarify turbo-ignore's future by @anthonyshew in #12422
• feat: Rework turbo ls to use query internals and add turbo query ls shorthand by @anthonyshew in #12424
• docs: Clarify environment variables across packages dependency behavior by @ramanverse in #12390
• docs: Expand subpath imports example by @lilianakatrina684-a11y in #12412
• fix: Preserve source dependencies when adding workspace deps in turbo-gen by @sleitor in #11935
• docs: Add Git history requirements to turbo query affected docs by @anthonyshew in #12426
• fix: Prevent horizontal overflow from long inline code on narrow viewports by @anthonyshew in #12428
• feat: Send git SHA and dirty hash to remote cache by @mehulkar in #12427
• fix: Upgrade tokio to 1.47.1+ to fix pidfd_reaper panic by @anthonyshew in #12431
• docs: Add AI guide to sidebar navigation by @anthonyshew in #12438
• docs: Move experimentalObservability into futureFlags section by @anthonyshew in #12439
• fix: Skip Unix domain sockets and other special files during file hashing by @anthonyshew in #12445
• fix: Preserve dedupePeers and unknown pnpm lockfile settings by @attehuhtakangas in #12443
• fix: Align dry run cache status with normal run by checking caching guards by @anthonyshew in #12448
• fix: Resolve turbo watch hang with mixed interruptible persistent tasks by @anthonyshew in #12449
• fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes by @anthonyshew in #12452
• refactor: Move cache hit SHA context to verbose logging by @mehulkar in #12435
• docs: Add missing --force flag documentation by @Goldyvaiiii in #12440
• fix: Prevent panic in turbo watch with persistent tasks by @anthonyshew in #12459
• fix: Support turbo watch in single-package workspaces by @anthonyshew in #12460
• fix: Missing deps after npm lockfile parsing by @anthonyshew in #12464
• docs: Add AI agent detection and automatic markdown rewrites by @molebox in #12462
• fix: Resolve generator name conflicts across workspaces by @anthonyshew in #12467
• fix: Remove root package.json from --affected global triggers by @anthonyshew in #12469
• fix: Show run summary after TUI exits by @anthonyshew in #12471
• fix: Avoid panic for unanchorable/non-UTF8 git paths by @biru-codeastromer in #11106
• feat: Accept experimentalCI key in turbo.json task config by @anthonyshew in #12480
• fix: Prevent pnpm overrides from corrupting resolved peer-dep variants by @frankeld in #12482
• fix: Skip writing unchanged files during slow-path cache restore by @anthonyshew in #12484
• fix: Replace pre-existing symlinks with directories during cache restore by @anthonyshew in #12488
• fix: Follow symlinks during workspace package discovery by @anthonyshew in #12489
• fix: Reduce inotify watch count via gitignore-aware directory walking on Linux by @antoinelyset in #12398

New Contributors

• @bestickley made their first contribution in #11571
• @marko-hologram made their first contribution in #11580
• @ddmoney420 made their first contribution in #11579
• @i5d6 made their first contribution in #11591
• @Netail made their first contribution in #11630
• @alexmkio made their first contribution in #11650
• @haydenbleasel made their first contribution in #11807
• @kyedavey made their first contribution in #11827
• @PeterPCW made their first contribution in #11760
• @bkonkle made their first contribution in #11130
• @serjooo made their first contribution in #12085
• @04cb made their first contribution in #12088
• @sleitor made their first contribution in #11946
• @MrNaif2018 made their first contribution in #11953
• @veeceey made their first contribution in #11926
• @GabrielBB made their first contribution in #12193
• @Jaredw2289-svg made their first contribution in #12212
• @hack-313-ip made their first contribution in #12352
• @prudentbird made their first contribution in #12149
• @Rohan5commit made their first contribution in #12367
• @EmojiPati made their first contribution in #12386
• @ramanverse made their first contribution in #12390
• @lilianakatrina684-a11y made their first contribution in #12412
• @floriansalihovic made their first contribution in #11952
• @Goldyvaiiii made their first contribution in #12436
• @attehuhtakangas made their first contribution in #12443
• @frankeld made their first contribution in #12482
• @antoinelyset made their first contribution in #12398

Full Changelog: v2.8.0...v2.9.0