chore(deps): update dependency turbo to v2.9.14 [security] by renovate[bot] · Pull Request #647 · Innei/Shiro

renovate · 2026-05-28T18:16:08Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
turbo (source)	`2.8.11` → `2.9.14`

Turbo: Unexpected local code execution during Yarn Berry detection

CVE-2026-45772 / GHSA-3qcw-2rhx-2726

More information

Details

Impact

Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands.

Fix

Turbo now avoids executing project-local Yarn during package manager detection. Yarn versions and paths are inferred from metadata such as package.json, parsing the value of yarnPath in .yarnrc.yml rather than executing it, and yarn.lock, and unrecognized Yarn lockfile formats are rejected instead of falling back to executing yarn.

Workarounds

If you cannot upgrade immediately, do not run Turborepo commands in untrusted repositories. Review or remove .yarnrc.yml files that define yarnPath before running Turborepo, especially in CI or automated tooling that processes external projects.

Severity

CVSS Score: 0.0 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Turbo: Login callback CSRF/session fixation

CVE-2026-45773 / GHSA-hcf7-66rw-9f5r

More information

Details

Impact

Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitimate callback, the CLI could complete login with the wrong credentials.

This affects users authenticating the turbo CLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not affected.

Fix

The login and SSO redirect flows now generate a random state value, include it in the browser authentication URL, and require the same value on the localhost callback before accepting a token. Callbacks with a missing or mismatched state are rejected.

Workarounds

If you cannot upgrade immediately, avoid browser-based self-hosted turbo login or SSO flows on machines that may load untrusted web content during authentication. Use a pre-provisioned token or environment-based authentication instead.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vercel/turborepo (turbo)

`v2.9.14`: Turborepo v2.9.14

Compare Source

[!NOTE]
This release contains important security fixes.

High:

GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection

Low:

What's Changed

Changelog

release(turborepo): 2.9.12 by @github-actions[bot] in #12774
fix: Restore docs mobile menu by @anthonyshew in #12782
ci: Use pull_request for PR title linting by @anthonyshew in #12787
ci: Scope GitHub Actions caches by branch by @anthonyshew in #12788
test: Validate lockfiles without dependency downloads by @anthonyshew in #12789
Removed unneeded import form hash creation script in docs by @dancrumb in #12799
fix: Validate auth callback state by @anthonyshew in #12802
fix: Harden VS Code extension command execution by @anthonyshew in #12800
fix: Avoid project-local Yarn during detection by @anthonyshew in #12801
chore: Release 2.9.13 by @anthonyshew in #12803

New Contributors

@dancrumb made their first contribution in #12799

Full Changelog: vercel/turborepo@v2.9.12...v2.9.14

`v2.9.12`: Turborepo v2.9.12

Compare Source

What's Changed

Changelog

release(turborepo): 2.9.11 by @github-actions[bot] in #12771
fix: Allow transit nodes in LSP diagnostics by @anthonyshew in #12773

Full Changelog: vercel/turborepo@v2.9.11...v2.9.12

`v2.9.11`: Turborepo v2.9.11

Compare Source

What's Changed

Changelog

release(turborepo): 2.9.10 by @github-actions[bot] in #12745
ci: Publish VS Code extension on release by @anthonyshew in #12747
fix: Start daemon for VSCode Extension from the extension itself by @anthonyshew in #12749
release(turborepo): 2.9.11-canary.1 by @github-actions[bot] in #12748
fix: Include file URIs in LSP lifecycle logs by @anthonyshew in #12751
fix: Handle JSON decoration visitor depth by @anthonyshew in #12752
fix: Resolve relative turbo path in VS Code extension by @anthonyshew in #12753
fix: Preserve Bun nested dependencies during prune by @anthonyshew in #12754
fix: Prefer installed Turbo for LSP by @anthonyshew in #12755
release(turborepo): 2.9.11-canary.2 by @github-actions[bot] in #12750
ci: Parallelize LSP release publishing by @anthonyshew in #12758
fix: Reduce VS Code extension startup popups by @anthonyshew in #12759
fix: Support turbo.jsonc in VS Code extension by @anthonyshew in #12760
fix: Remove VS Code task key gradient by @anthonyshew in #12761
release(turborepo): 2.9.11-canary.3 by @github-actions[bot] in #12756
chore: Release v2.9.11-canary.4 by @anthonyshew in #12762
ci: Stop VS Code publish from blocking release PR by @anthonyshew in #12763
release(turborepo): 2.9.11-canary.5 by @github-actions[bot] in #12764
fix: Publish VS Code extension from release tag by @anthonyshew in #12765
fix: Support shimmed VS Code LSP probes by @anthonyshew in #12767
release(turborepo): 2.9.11-canary.6 by @github-actions[bot] in #12766
release(turborepo): 2.9.11-canary.7 by @github-actions[bot] in #12768
fix: Allow $TURBO_EXTENDS$ in LSP diagnostics by @anthonyshew in #12770

Full Changelog: vercel/turborepo@v2.9.10...v2.9.11

`v2.9.10`: Turborepo v2.9.10

Compare Source

What's Changed

Changelog

release(turborepo): 2.9.9-canary.4 by @github-actions[bot] in #12716
release(turborepo): 2.9.9 by @github-actions[bot] in #12719
fix: Respect SCM env vars in turbo query affected by @anthonyshew in #12722
ci: Package VSCode extension in release workflow by @anthonyshew in #12723
fix: Avoid some raw create-turbo example telemetry by @anthonyshew in #12725
fix: Escape graph HTML payloads by @anthonyshew in #12726
fix: Prevent OTEL token injection to spoofed origins by @anthonyshew in #12727
fix: Retry HTTP status failures by @anthonyshew in #12728
fix: Validate microfrontend proxy Host header by @anthonyshew in #12730
fix: Redact task hash env debug logs by @anthonyshew in #12733
fix: Filter microfrontend proxy environments by @anthonyshew in #12732
fix: Preserve FSEvents mount points for device-relative paths by @anthonyshew in #12729
fix: Validate proxy Host headers by @anthonyshew in #12731
fix: Resolve TypeScript .js extension imports to .ts files in boundaries by @maschwenk in #12644
fix: Use random temp path for repo downloads by @anthonyshew in #12736
release(turborepo): 2.9.10-canary.1 by @github-actions[bot] in #12734
fix: Reject OTel endpoints with userinfo by @anthonyshew in #12737
fix: Authenticate local devtools WebSocket by @anthonyshew in #12738
fix: Handle clipboard exec errors by @anthonyshew in #12739
fix: Restrict Vercel token reuse to trusted API origins by @anthonyshew in #12740
fix: Keep workspace config discovery inside root by @anthonyshew in #12741
fix: Hardening for daemon IPC endpoints by @anthonyshew in #12742
fix: Enforce cache filesystem boundaries by @anthonyshew in #12743

Full Changelog: vercel/turborepo@v2.9.9...v2.9.10

`v2.9.9`: Turborepo v2.9.9

Compare Source

What's Changed

Changelog

release(turborepo): 2.9.8 by @github-actions[bot] in #12700
fix: Remove Unix parent death watchdogs by @anthonyshew in #12699
release(turborepo): 2.9.9-canary.1 by @github-actions[bot] in #12705
fix: Scope repo index prefixes to Git root by @anthonyshew in #12706
release(turborepo): 2.9.9-canary.2 by @github-actions[bot] in #12708
ci: Harden non-release GitHub Actions by @anthonyshew in #12707
docs: Add pnpm workspace flag (-w) to Oxc setup docs by @mattjoll in #12655
fix: Harden OG image signatures by @anthonyshew in #12709
fix: Scope release npm publishing credentials by @anthonyshew in #12710
ci: Harden release workflows by @anthonyshew in #12711
release(turborepo): 2.9.9-canary.3 by @github-actions[bot] in #12712
fix: Harden docs security endpoints by @anthonyshew in #12713
ci: Harden internal GitHub Actions by @anthonyshew in #12714
ci: Harden release workflow handling by @anthonyshew in #12715
fix: Preserve lockfiles during dry-run conversion by @anthonyshew in #12717
ci: Fix LSP workflow container matrix by @anthonyshew in #12718

New Contributors

@mattjoll made their first contribution in #12655

Full Changelog: vercel/turborepo@v2.9.8...v2.9.9

`v2.9.8`: Turborepo v2.9.8

Compare Source

What's Changed

@turbo/repository

chore: Update to Rust 1.95.0 by @ognevny in #12636

Changelog

release(turborepo): 2.9.7 by @github-actions[bot] in #12679
test: Add regression for gitignored output restore by @anthonyshew in #12681
docs: Clarify root task guidance by @anthonyshew in #12683
fix: Preserve concrete dependency precedence by @anthonyshew in #12682
release(turborepo): 2.9.8-canary.1 by @github-actions[bot] in #12685
fix: Resolve Yarn catalog affected packages by @anthonyshew in #12684
release(turborepo): 2.9.8-canary.2 by @github-actions[bot] in #12687
fix: Preserve Bun prune lockfile validity by @anthonyshew in #12686
release(turborepo): 2.9.8-canary.3 by @github-actions[bot] in #12689
fix: Create prune docker bin stubs by @anthonyshew in #12688
release(turborepo): 2.9.8-canary.4 by @github-actions[bot] in #12690
fix: Keep tbx shell connections stable by @anthonyshew in #12692
perf: Reduce turbo watch hash memory spikes by @anthonyshew in #12695
release(turborepo): 2.9.8-canary.5 by @github-actions[bot] in #12696
fix: Reduce parent-death watchdog CPU usage by @anthonyshew in #12697
release(turborepo): 2.9.8-canary.6 by @github-actions[bot] in #12698

Full Changelog: vercel/turborepo@v2.9.7...v2.9.8

`v2.9.7`: Turborepo v2.9.7

Compare Source

What's Changed

eslint

chore: Upgrade dependencies to resolve their known vulnerabilities by @anthonyshew in #12604

Examples

feat(sandbox): Bump @vercel/sandbox from v1 to beta by @marc-vercel in #12595
chore: Update examples to Turbo 2.9.6 by @cursor[bot] in #12600
examples: Add Ultracite example by @haydenbleasel in #12615

Changelog

fix: Align Markdown docs routing with docs/md endpoints by @molebox in #12596
fix: Support two-dot git ranges in filter selectors by @anthonyshew in #12599
feat: Graceful shutdown by @anthonyshew in #12607
test: Add stdin EOF startup regression coverage by @anthonyshew in #12609
fix: Ignore SIGINT in shim after spawning local turbo by @anthonyshew in #12612
fix: Support pnpm v11 multi-document lockfiles by @anthonyshew in #12616
fix: Preserve graceful shutdown exit code by @anthonyshew in #12620
fix: Keep Node wrapper alive during graceful shutdown by @anthonyshew in #12622
fix: Preserve PTY graceful shutdown semantics by @anthonyshew in #12624
feat: Move Vercel auth to standard OAuth/device flows by @markandrus in #12526
fix: Preserve legacy Vercel auth compatibility by @anthonyshew in #12629
fix: Recover Vercel auth tokens across login flows by @anthonyshew in #12631
docs: Fix TURBO_PLATFORM_ENV_DISABLED value in docs (true, not false) by @sleitor in #12633
chore: Update flags SDK by @AndyBitz in #12646
ci: Disable AWS-backed sccache by @anthonyshew in #12663
fix: Prevent prune from overmatching gitignore entries by @anthonyshew in #12662
ci: Harden release API commits by @anthonyshew in #12664
ci: Fix release API commit paths by @anthonyshew in #12665
release(turborepo): 2.9.7-canary.14 by @github-actions[bot] in #12666
chore: Add tbx sandbox helper by @anthonyshew in #12668
fix: Allow npm registry in tbx sandboxes by @anthonyshew in #12669
fix: Install turbo globally in tbx base by @anthonyshew in #12670
docs: Clarify package hash file inputs by @anthonyshew in #12671
fix: Allow tbx sandboxes to use stale bases by @anthonyshew in #12672
fix: Install dotfiles during tbx base refresh by @anthonyshew in #12673
fix: Improve tbx sandbox startup by @anthonyshew in #12674
fix: Improve tbx sandbox startup defaults by @anthonyshew in #12675
fix: Support pnpm 11 flat patch lockfiles by @anthonyshew in #12676
docs: Fix link to passthrough variables source code by @Wartijn in #12643
release(turborepo): 2.9.7-canary.15 by @github-actions[bot] in #12677
fix: Avoid rerunning non-cacheable watch dependencies by @anthonyshew in #12678

New Contributors

@marc-vercel made their first contribution in #12595
@cursor[bot] made their first contribution in #12600
@markandrus made their first contribution in #12526
@AndyBitz made their first contribution in #12646
@Wartijn made their first contribution in #12643

Full Changelog: vercel/turborepo@v2.9.6...v2.9.7

`v2.9.6`: Turborepo v2.9.6

Compare Source

What's Changed

create-turbo

chore: Update dependencies found in audits by @anthonyshew in #12586

Examples

fix: Add missing @types/node to with-svelte example apps by @anthonyshew in #12585

Changelog

docs: Add Bun equivalent for updating dependencies by @anthonyshew in #12580
fix: Mention turbo.json in concurrency error message by @anthonyshew in #12582
fix: Surface actionable message when remote cache is requested but not linked by @anthonyshew in #12584
chore: Delete agents app by @anthonyshew in #12587
fix: Load custom CA certificates in fast webpki-only HTTP client by @anthonyshew in #12591
docs: Remove pre-release badges by @anthonyshew in #12592

Full Changelog: vercel/turborepo@v2.9.5...v2.9.6

`v2.9.5`: Turborepo v2.9.5

Compare Source

What's Changed

create-turbo

feat: Replace package manager commands in scaffolded README files by @DependerKumarSoni in #6747

@turbo/telemetry

fix: Suppress telemetry alert when running on Vercel by @anthonyshew in #12576

Changelog

feat: Add circular package dependency detection to boundaries by @anthonyshew in #12567
perf: Increase remote cache upload chunk size from 8KB to 256KB by @anthonyshew in #12568
perf: Parallelize boundaries checking with Rayon and cache DFS traversals by @anthonyshew in #12569

New Contributors

@DependerKumarSoni made their first contribution in #6747

Full Changelog: vercel/turborepo@v2.9.4...v2.9.5

`v2.9.4`: Turborepo v2.9.4

Compare Source

What's Changed

@turbo/codemod

fix: Always update $schema URL to versioned format during migration by @anthonyshew in #12529
fix: Support turbo.jsonc in codemod transforms by @anthonyshew in #12532
fix: Preserve prerelease info in schema URL during codemod migration by @anthonyshew in #12542

Examples

build(deps): Bump @xmldom/xmldom from 0.8.11 to 0.8.12 in /examples/with-react-native-web by @dependabot[bot] in #12537

Changelog

feat: Add incremental task caching by @anthonyshew in #12531
docs: Send siteId as label on feedback GitHub issues by @molebox in #12527
Replace local ai-agent-detection with @vercel/agent-readability by @molebox in #12528
fix: Prevent filterUsingTasks --filter from pulling dependents into Task Graph by @anthonyshew in #12535
fix: Only enforce signature key length for keys that exist by @anthonyshew in #12538
fix: Validate engine concurrency after task-level filtering by @anthonyshew in #12540
feat: Allow --affected and --filter to be combined by @anthonyshew in #12543
fix(config): Deep-merge nested OTEL config across priority sources by @bitttttten in #12513
fix: Retain microfrontend proxy tasks when using filterUsingTasks by @anthonyshew in #12545
fix: Bun workspace lockfile pruning producing invalid output by @JRoy in #12548
fix: Respect dirty .gitignore patterns during task input hashing by @anthonyshew in #12557

New Contributors

@JRoy made their first contribution in #12548

Full Changelog: vercel/turborepo@v2.9.3...v2.9.4

`v2.9.3`: Turborepo v2.9.3

Compare Source

What's Changed

Changelog

fix: Preserve per-workspace lockfiles during pnpm pruning by @anthonyshew in #12519

Full Changelog: vercel/turborepo@v2.9.2...v2.9.3

`v2.9.2`: Turborepo v2.9.2

Compare Source

What's Changed

Examples

feat(examples): Add Next.js + Elysia full-stack starter template by @eastgold15 in #12414

Changelog

docs: Add documentation for cacheMaxAge and cacheMaxSize options by @anthonyshew in #12500
fix: Resolve correct nested bun lockfile versions during prune by @anthonyshew in #12506
Revert "fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes" by @anthonyshew in #12507
fix: Unblock watch loop so interruptible persistent tasks restart on file changes by @anthonyshew in #12509
fix(api-client): Treat * as wildcard in preflight Access-Control-Allow-Headers by @bitttttten in #12503
docs: Document turbo.* generator variables by @anthonyshew in #12511
fix: Backfill missing pnpm workspace importer entries during prune by @anthonyshew in #12514
fix: Include transitive dependencies in engine graph pruning for affected paths using Task Graph by @anthonyshew in #12516
fix: Update AI-generated response disclaimer to include human attribution by @Copilot in #12517
fix: Preserve shallow install strategy during npm lockfile pruning by @anthonyshew in #12520

New Contributors

@eastgold15 made their first contribution in #12414

Full Changelog: vercel/turborepo@v2.9.1...v2.9.2

`v2.9.1`: Turborepo v2.9.1

Compare Source

What's Changed

@turbo/codemod

feat: Handle package manager catalogs in migration codemod by @anthonyshew in #12496

@turbo/repository

feat: Add cacheMaxAge and cacheMaxSize for local cache eviction by @anthonyshew in #12487

Changelog

docs: Release post for 2.9 by @anthonyshew in #12441

Full Changelog: vercel/turborepo@v2.9.0...v2.9.1

`v2.9.0`: Turborepo v2.9.0

Compare Source

What's Changed

Docs

docs: Release post for 2.8 by @anthonyshew in #11559
docs: Update oxc.mdx to include cache false by @bestickley in #11571
docs: Fix curl markdown Accept header syntax in 2.8 release blog by @marko-hologram in #11580
docs: Fix worktree command in blog post by @anthonyshew in #11583
docs: Rename command → subcommand by @anthonyshew in #11584
feat: Add requestType tracking for header-negotiated markdown by @molebox in #11585
fix: Upgrade next to fix HTTP deserialization DoS by @anthonyshew in #11597
fix: Upgrade mermaid to fix lodash-es vulnerability by @anthonyshew in #11611
fix: Upgrade recharts to fix lodash vulnerability by @anthonyshew in #11606
chore: Move applications to apps/ directory by @anthonyshew in #11613
fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @anthonyshew in #11616
chore: Migrate to Ultracite by @haydenbleasel in #11948
fix: Strip JSX components from heading anchors and TOC entries by @anthonyshew in #12404

create-turbo

fix: Upgrade tsup to fix rollup and glob vulnerabilities by @anthonyshew in #11601
fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @anthonyshew in #11622
fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @anthonyshew in #11623
feat: Migrate from tsup to tsdown by @anthonyshew in #11649
fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11683
fix: Upgrade inquirer to remove lodash dependency by @anthonyshew in #11709
fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability by @anthonyshew in #11702
fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability by @anthonyshew in #11706
fix: Recover version numbering to 2.8.9-canary.0 by @anthonyshew in #11853
fix: Sanitize git command inputs in create-turbo by @anthonyshew in #11876
chore: Remove pnpm-eslint .vscode transform from create-turbo by @anthonyshew in #12186
fix: Improve create-turbo connectivity check and offline error messages by @anthonyshew in #12257
feat: Add affectedUsingTaskInputs future flag for task-level --affected detection by @anthonyshew in #12247
fix: Replace dns.lookup with https.get for create-turbo online check by @anthonyshew in #12277
fix: Remove redundant online check from create-turbo by @anthonyshew in #12281
fix: Sort uninstalled package managers to bottom of create-turbo selection by @anthonyshew in #12353

turbo-ignore

fix: Resolve pnpm audit vulnerabilities via dependency bumps by @anthonyshew in #12220
feat: Deprecate turbo-ignore in favor of turbo query affected by @anthonyshew in #12382
fix: Tailored turbo-ignore deprecation notice for Vercel users by @anthonyshew in #12385

@turbo/codemod

fix: Upgrade axios to fix SSRF vulnerability by @anthonyshew in #11599
fix: Replace axios with native fetch in turbo-codemod by @anthonyshew in #11600
fix: Upgrade diff to fix DoS vulnerabilities by @anthonyshew in #11621
fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @anthonyshew in #11766
fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11765
fix: Enhance path validation in assertSafeGitArgument by @odaysec in #11788
fix: Guard against missing pipeline key in clean-globs codemod by @anthonyshew in #12235
fix: Stop add-package-names codemod from silently renaming existing packages by @anthonyshew in #12332
fix: Handle Yarn 2+ in @turbo/codemod install commands by @anthonyshew in #12477

eslint

fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @anthonyshew in #11610
fix: Upgrade esbuild to fix arbitrary request vulnerability by @anthonyshew in #11615
fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities by @anthonyshew in #11681
fix: Upgrade eslint to v10 to resolve @eslint/plugin-kit ReDoS vulnerability by @anthonyshew in #11705
fix(eslint-plugin-turbo): Guard against missing tasks/pipeline in forEachTaskDef by @sleitor in #12411

@turbo/repository

fix: Rename cli workspace package to avoid false audit match by @anthonyshew in #11767
perf: Defer TLS initialization to a background thread by @anthonyshew in #11967
fix: Add repository field to @turbo/repository package.json by @anthonyshew in #11982
release(library): 0.0.1-canary.19 by @github-actions[bot] in #11983
feat: Add experimentalObservability with an OTel backend by @bkonkle in #11130
release(library): 0.0.1-canary.20 by @github-actions[bot] in [#

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-05-28T18:16:10Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
shiro	Error		Sep 3, 2026 10:42pm UTC

safedep · 2026-05-28T18:16:15Z

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
`@codemirror/autocomplete @ 6.20.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@codemirror/commands @ 6.11.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@codemirror/lang-html @ 6.4.12` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@codemirror/lang-jinja @ 6.0.1` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@codemirror/lang-markdown @ 6.5.2` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@codemirror/lang-yaml @ 6.1.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@codemirror/language @ 6.12.4` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@codemirror/legacy-modes @ 6.5.4` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@codemirror/lint @ 6.9.7` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@codemirror/state @ 6.7.2` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@codemirror/view @ 6.43.11` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@floating-ui/core @ 1.8.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@floating-ui/dom @ 1.8.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@floating-ui/react-dom @ 2.1.9` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@floating-ui/utils @ 0.2.12` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@haklex/rich-editor @ 0.0.105` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@haklex/rich-kit-shiro @ 0.0.105` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@iconify-json/material-icon-theme @ 1.2.70` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@iconify/utils @ 3.1.4` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@icons-pack/react-simple-icons @ 13.15.1` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/clipboard @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/code-core @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/dragon @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/extension @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/headless @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/html @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/link @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/list @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/markdown @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/rich-text @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/selection @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/table @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/text @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lexical/utils @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lezer/common @ 1.5.2` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lezer/cpp @ 1.1.6` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lezer/css @ 1.3.6` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lezer/lr @ 1.4.10` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lezer/markdown @ 1.7.2` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lezer/php @ 1.0.6` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@lezer/python @ 1.1.19` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@marijn/find-cluster-break @ 1.0.4` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@mermaid-js/parser @ 1.2.1` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@napi-rs/wasm-runtime @ 1.2.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@oxc-project/types @ 0.148.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@preact/signals-core @ 1.14.4` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@rolldown/pluginutils @ 1.0.1` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@shikijs/core @ 4.4.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@shikijs/engine-javascript @ 4.4.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@shikijs/engine-oniguruma @ 4.4.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@shikijs/langs @ 4.4.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@shikijs/primitive @ 4.4.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@shikijs/themes @ 4.4.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@shikijs/types @ 4.4.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@tybys/wasm-util @ 0.10.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`@types/hast @ 3.0.5` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`ajv @ 6.15.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`buffer-image-size @ 0.6.4` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`crelt @ 1.0.7` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`cytoscape @ 3.34.2` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`cytoscape-cose-bilkent @ 4.1.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`cytoscape-fcose @ 2.2.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`dayjs @ 1.11.23` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`dompurify @ 3.4.14` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`es-toolkit @ 1.52.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`fastdom @ 1.0.12` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`happy-dom @ 20.14.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`import-meta-resolve @ 4.2.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`katex @ 0.16.47` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`lexical @ 0.42.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`lightningcss @ 1.33.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`lodash-es @ 4.18.1` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`lucide-react @ 1.40.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`mermaid @ 11.17.2` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`nanoid @ 3.3.18` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`oniguruma-parser @ 0.12.2` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`oniguruma-to-es @ 4.3.6` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`picomatch @ 4.0.7` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`postcss @ 8.5.28` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`react-intersection-observer @ 10.1.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`rolldown @ 1.2.7` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`semver @ 7.8.5` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`shiki @ 4.4.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`strictdom @ 1.0.1` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`stylis @ 4.4.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`tinyglobby @ 0.2.17` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`ts-dedent @ 2.3.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`turbo @ 2.9.14` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`uuid @ 14.0.2` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`vite @ 8.0.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`vitest @ 4.1.0` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗
`ws @ 8.21.3` _npm _{pnpm-lock.yaml}	✔️	✔️	✔️	🔗

View complete scan results →

_{This report is generated by SafeDep GitHub App}

renovate Bot added the renovate label May 28, 2026

vercel Bot had a problem deploying to Preview May 28, 2026 18:16 Failure

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from 8f89b0e to 436c65f Compare June 1, 2026 17:53

vercel Bot had a problem deploying to Preview June 1, 2026 17:53 Failure

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from 436c65f to 8962959 Compare June 13, 2026 20:03

vercel Bot had a problem deploying to Preview June 13, 2026 20:03 Failure

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from 8962959 to 46c6adf Compare July 12, 2026 16:53

vercel Bot had a problem deploying to Preview July 12, 2026 16:53 Failure

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from 46c6adf to cd7fbe7 Compare July 16, 2026 19:29

vercel Bot had a problem deploying to Preview July 16, 2026 19:29 Failure

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from cd7fbe7 to 84bfb60 Compare July 21, 2026 02:49

vercel Bot had a problem deploying to Preview July 21, 2026 02:49 Failure

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from 84bfb60 to c7d32ab Compare July 24, 2026 16:33

vercel Bot had a problem deploying to Preview July 24, 2026 16:33 Failure

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from c7d32ab to 7af1438 Compare July 30, 2026 16:34

vercel Bot had a problem deploying to Preview July 30, 2026 16:34 Failure

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from 7af1438 to 998ea93 Compare August 11, 2026 22:30

vercel Bot had a problem deploying to Preview August 11, 2026 22:30 Failure

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from 998ea93 to 75d9d62 Compare August 14, 2026 11:12

vercel Bot had a problem deploying to Preview August 14, 2026 11:12 Failure

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from 75d9d62 to 7eee0c1 Compare August 26, 2026 20:36

vercel Bot had a problem deploying to Preview August 26, 2026 20:36 Failure

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from 7eee0c1 to 161e9c8 Compare September 2, 2026 14:19

vercel Bot had a problem deploying to Preview September 2, 2026 14:31 Failure

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from 161e9c8 to ebd3100 Compare September 3, 2026 10:54

vercel Bot had a problem deploying to Preview September 3, 2026 10:54 Failure

chore(deps): update dependency turbo to v2.9.14 [security]

3e72a89

renovate Bot force-pushed the renovate/npm-turbo-vulnerability branch from ebd3100 to 3e72a89 Compare September 3, 2026 22:42

vercel Bot had a problem deploying to Preview September 3, 2026 22:42 Failure

Navigation Menu

Uh oh!

chore(deps): update dependency turbo to v2.9.14 [security] - #647

chore(deps): update dependency turbo to v2.9.14 [security]#647
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-turbo-vulnerability

renovate Bot commented May 28, 2026 •

edited

Loading

Uh oh!

vercel Bot commented May 28, 2026 •

edited

Loading

Uh oh!

safedep Bot commented May 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Turbo: Unexpected local code execution during Yarn Berry detection

Details

Impact

Fix

Workarounds

Severity

References

Turbo: Login callback CSRF/session fixation

Details

Impact

Fix

Workarounds

Severity

References

Release Notes

v2.9.14: Turborepo v2.9.14

High:

Low:

What's Changed

Changelog

New Contributors

v2.9.12: Turborepo v2.9.12

What's Changed

Changelog

v2.9.11: Turborepo v2.9.11

What's Changed

Changelog

v2.9.10: Turborepo v2.9.10

What's Changed

Changelog

v2.9.9: Turborepo v2.9.9

What's Changed

Changelog

New Contributors

v2.9.8: Turborepo v2.9.8

What's Changed

@​turbo/repository

Changelog

v2.9.7: Turborepo v2.9.7

What's Changed

eslint

Examples

Changelog

New Contributors

v2.9.6: Turborepo v2.9.6

What's Changed

create-turbo

Examples

Changelog

v2.9.5: Turborepo v2.9.5

What's Changed

create-turbo

@​turbo/telemetry

Changelog

New Contributors

v2.9.4: Turborepo v2.9.4

What's Changed

@​turbo/codemod

Examples

Changelog

New Contributors

v2.9.3: Turborepo v2.9.3

What's Changed

Changelog

v2.9.2: Turborepo v2.9.2

What's Changed

Examples

Changelog

New Contributors

v2.9.1: Turborepo v2.9.1

What's Changed

@​turbo/codemod

@​turbo/repository

Changelog

v2.9.0: Turborepo v2.9.0

What's Changed

renovate Bot commented May 28, 2026 •

edited

Loading

`v2.9.14`: Turborepo v2.9.14

`v2.9.12`: Turborepo v2.9.12

`v2.9.11`: Turborepo v2.9.11

`v2.9.10`: Turborepo v2.9.10

`v2.9.9`: Turborepo v2.9.9

`v2.9.8`: Turborepo v2.9.8

@turbo/repository

`v2.9.7`: Turborepo v2.9.7

`v2.9.6`: Turborepo v2.9.6

`v2.9.5`: Turborepo v2.9.5

@turbo/telemetry

`v2.9.4`: Turborepo v2.9.4

@turbo/codemod

`v2.9.3`: Turborepo v2.9.3

`v2.9.2`: Turborepo v2.9.2

`v2.9.1`: Turborepo v2.9.1

@turbo/codemod

@turbo/repository

`v2.9.0`: Turborepo v2.9.0

@turbo/codemod

@turbo/repository

vercel Bot commented May 28, 2026 •

edited

Loading

safedep Bot commented May 28, 2026 •

edited

Loading