← all branches

dependabot/npm_and_yarn/turbo-2.9.14

safe
a35edf1 · fullPR #351reviewed 2026-07-26 20:03 UTC0H · 0M · 0L · 7I
The branch
Purpose
Keep the monorepo build toolchain current and patch known CVEs in turbo
Goal
Bump turbo dev dependency from 2.6.1 to 2.9.14
Sub-goals
  • Patch GHSA-5xc8-49mv-x4mm (High - VSCode extension command injection)
  • Patch GHSA-hcf7-66rw-9f5r (Low - login callback CSRF)
  • Patch GHSA-3qcw-2rhx-2726 (Low - Yarn Berry detection code exec)
The changes (whole branch)
What
turbo version bumped in package.json devDependencies; pnpm-lock.yaml updated with new resolved version and vitest peer resolution string normalization
Why
Dependabot security update — three CVEs in turbo 2.6.1 patched in 2.9.14
Areas
package.json+1−1pnpm-lock.yaml+8−8
Blast
2 files, +9/-9 lines. devDependencies only — zero runtime impact.
dependabot security-patch dev-only
➖ci· CI status not accessible via token scope➖coderabbit· no .coderabbit.yaml present

Findings · 7

correctness1

info

turbo 2.6.1→2.9.14 dev-dependency bump

package.json

Dev-only task runner. No runtime presence. Lockfile normalization is cosmetic.

security4

info

GHSA-5xc8-49mv-x4mm resolved: VSCode Extension command injection (High)

package.json

Batu does not use the Turbo VSCode extension. Vector never reachable.

info

GHSA-hcf7-66rw-9f5r resolved: Login callback CSRF (Low)

package.json

Affects turbo remote-cache login — not used by Batu.

info

GHSA-3qcw-2rhx-2726 resolved: Yarn Berry detection code exec (Low)

package.json

Batu uses pnpm, not Yarn Berry.

info

Supply chain: large version jump (2.6.1→2.9.14)

package.json

Vercel-maintained, public changelog, npm provenance. devDependencies only — never shipped to production.

improvement2

info

turbo.json $schema for LSP diagnostics (2.9.x feature)

turbo.json

Optional: add $schema to turbo.json to enable editor completions.

info

Cache scoping improvements in 2.9.x

turbo.json

Good moment to audit outputs/inputs in turbo.json if cache invalidation issues occur.