chore(deps): update dependency turbo to v2.8.8 by renovate[bot] · Pull Request #1520 · settlemint/sdk

renovate · 2026-01-12T02:02:18Z

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
turbo (source)	devDependencies	minor	`2.7.3` → `2.8.8`

Release Notes

vercel/turborepo (turbo)

`v2.8.7`: Turborepo v2.8.7

Compare Source

What's Changed

Changelog

fix: Keep stdin alive for persistent tasks in stream mode by @anthonyshew in #11793
feat: Add internal agents app for repo automation by @anthonyshew in #11799
chore: Add env vars by @anthonyshew in #11800
fix: Handle subpath package imports in turbo boundaries by @anthonyshew in #11798
feat: Add dashboard with run tracking and live logs for agent sandboxes by @anthonyshew in #11802
fix: Normalize bare LF to CRLF in TUI output to prevent garbled logs by @anthonyshew in #11804

Full Changelog: vercel/turborepo@v2.8.6...v2.8.7

`v2.8.6`: Turborepo v2.8.6

Compare Source

What's Changed

Changelog

chore: Add internal agents app for repo automation by @anthonyshew in #11781
feat: Add internal agents app for repo automation by @anthonyshew in #11783
chore: Manual audits by @anthonyshew in #11785
chore: Fixing audit agent by @anthonyshew in #11786
chore: Still iterating on sec audit fixer by @anthonyshew in #11787
fix: Emit space for empty vt100 cells to fix TUI repaint on task switch by @anthonyshew in #11789

Full Changelog: vercel/turborepo@v2.8.5...v2.8.6

`v2.8.5`: Turborepo v2.8.5

Compare Source

What's Changed

@turbo/codemod

fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @anthonyshew in #11766
fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11765

@turbo/repository

fix: Rename cli workspace package to avoid false audit match by @anthonyshew in #11767

Changelog

fix: Add Vary: Accept header to docs markdown endpoint by @molebox in #11759
chore: Agentic workflows app by @anthonyshew in #11773
chore: Add internal agents app for repo automation by @anthonyshew in #11776
chore: Update reproduction request message by @anthonyshew in #11778
Revert "fix: Upgrade node-plop to 0.32.3" by @anthonyshew in #11780

Full Changelog: vercel/turborepo@v2.8.4...v2.8.5

`v2.8.4`: Turborepo v2.8.4

Compare Source

What's Changed

create-turbo

fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11683
fix: Upgrade inquirer to remove lodash dependency by @anthonyshew in #11709
fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability by @anthonyshew in #11702
fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability by @anthonyshew in #11706

eslint

fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities by @anthonyshew in #11681
fix: Upgrade eslint to v10 to resolve @eslint/plugin-kit ReDoS vulnerability by @anthonyshew in #11705

Examples

examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in #11679

Changelog

fix: Upgrade tar to 7.5.7 to address security vulnerabilities by @anthonyshew in #11680
fix: Upgrade ts-json-schema-generator to fix glob command injection vulnerability by @anthonyshew in #11684
fix: Upgrade fumadocs and shiki in docs to resolve mdast-util-to-hast vulnerability by @anthonyshew in #11704
fix: Replace ts-node with tsx to resolve diff DoS vulnerability by @anthonyshew in #11708
fix: Upgrade bytes to >=1.11.1 to fix RUSTSEC-2026-0007 by @anthonyshew in #11715
chore: Update ratatui dependencies (paste blocked upstream) by @anthonyshew in #11717
Revert "chore: Update ratatui dependencies (paste blocked upstream)" by @anthonyshew in #11722
fix: Upgrade ratatui to 0.30.0 to drop unmaintained paste crate by @anthonyshew in #11723
chore: Upgrade reqwest toward addressing RUSTSEC-2025-0134 by @anthonyshew in #11718
fix(docs): Fix code syntax highlighting by using correct Shiki CSS variable names by @anthonyshew in #11726
fix: Upgrade async-io to 2.x to drop unmaintained instant crate by @anthonyshew in #11719
fix: Migrate from unmaintained serde_yaml to serde_yml by @anthonyshew in #11720
fix: Upgrade test-case and merge to drop unmaintained proc-macro-error by @anthonyshew in #11721
fix: Upgrade indicatif to 0.18.3 to drop unmaintained number_prefix by @anthonyshew in #11716
refactor: Centralize configuration resolution funnel by @anthonyshew in #11727
fix: Upgrade rustls chain to resolve RUSTSEC-2025-0134 by @anthonyshew in #11739
fix: Upgrade test-case to resolve transitive proc-macro-error by @anthonyshew in #11737
fix: Upgrade pest/pest_derive to resolve yanked version by @anthonyshew in #11734
fix: Upgrade git2 to fix RUSTSEC-2026-0008 by @anthonyshew in #11729
fix: Upgrade pprof to fix RUSTSEC-2024-0408 by @anthonyshew in #11730
fix: Upgrade portable-pty to resolve RUSTSEC-2017-0008 by @anthonyshew in #11732
fix: Upgrade oxc_resolver to resolve yanked papaya dependency by @anthonyshew in #11733
fix: Upgrade futures/futures-util to resolve yanked futures-util 0.3.30 by @anthonyshew in #11735
fix: Replace unic-segment with unicode-segmentation in globwatch by @anthonyshew in #11736
fix: Replace serde_yml with serde_yaml_ng to fix RUSTSEC-2025-0067/0068 by @anthonyshew in #11755
fix: Replace oxc_resolver with unrs_resolver to fix yanked papaya dependency by @anthonyshew in #11754
fix: Upgrade node-plop to 0.32.3 by @anthonyshew in #11756
docs: Capitalizaiton in update github-actions.mdx by @anthonyshew in #11762

Full Changelog: vercel/turborepo@v2.8.3...v2.8.4

`v2.8.3`: Turborepo v2.8.3

Compare Source

What's Changed

Changelog

fix: Upgrade capnp to 0.24 by @anthonyshew in #11656
fix: Upgrade h2 to fix CONTINUATION Flood by @anthonyshew in #11658
fix: Upgrade crossbeam-channel to 0.5.15 by @anthonyshew in #11657
chore: Remove abandoned turbo clone command by @anthonyshew in #11673
fix: Upgrade rustls and ring by @anthonyshew in #11659
fix: Upgrade openssl to 0.10.75 by @anthonyshew in #11660
fix: Replace unmaintained adler with adler2 by @anthonyshew in #11661

Full Changelog: vercel/turborepo@v2.8.2...v2.8.3

`v2.8.2`: Turborepo v2.8.2

Compare Source

What's Changed

Docs

fix: Upgrade next to fix HTTP deserialization DoS by @anthonyshew in #11597
fix: Upgrade mermaid to fix lodash-es vulnerability by @anthonyshew in #11611
fix: Upgrade recharts to fix lodash vulnerability by @anthonyshew in #11606
chore: Move applications to apps/ directory by @anthonyshew in #11613
fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @anthonyshew in #11616

create-turbo

fix: Upgrade tsup to fix rollup and glob vulnerabilities by @anthonyshew in #11601
fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @anthonyshew in #11622
fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @anthonyshew in #11623
feat: Migrate from tsup to tsdown by @anthonyshew in #11649

@turbo/codemod

fix: Upgrade axios to fix SSRF vulnerability by @anthonyshew in #11599
fix: Replace axios with native fetch in turbo-codemod by @anthonyshew in #11600
fix: Upgrade diff to fix DoS vulnerabilities by @anthonyshew in #11621

eslint

fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @anthonyshew in #11610
fix: Upgrade esbuild to fix arbitrary request vulnerability by @anthonyshew in #11615

Examples

examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in #11591
fix: escaping for link titles in LinksService by @odaysec in #11632

Changelog

fix: Add allowComments and allowTrailingCommas to turbo.json schema by @ddmoney420 in #11579
chore: Eliminate ts-rs serde attribute parse warnings by @anthonyshew in #11589
fix: Extract git argument validation into reusable helper by @anthonyshew in #11593
fix: Upgrade fast-xml-parser to fix RangeError DoS by @anthonyshew in #11598
fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in #11596
fix: Upgrade tar to fix security vulnerabilities by @anthonyshew in #11602
fix: Upgrade @actions/github to fix @octokit vulnerabilities by @anthonyshew in #11607
fix: Upgrade @vercel/blob and @actions packages to fix undici vulnerability by @anthonyshew in #11608
docs: Running Root Tasks by @Netail in #11630
Update README.md title and remove features section by @anthonyshew in #11651
docs: Update using-environment-variables.mdx by @anthonyshew in #11652
fix: Upgrade js-yaml to address CVE-2025-64718 by @alexmkio in #11650
fix: Remove smooth scrolling from docs by @anthonyshew in #11654
fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @anthonyshew in #11655

New Contributors

@ddmoney420 made their first contribution in #11579
@i5d6 made their first contribution in #11591
@Netail made their first contribution in #11630
@alexmkio made their first contribution in #11650

Full Changelog: vercel/turborepo@v2.8.1...v2.8.2

`v2.8.1`: Turborepo v2.8.1

Compare Source

What's Changed

Docs

docs: Release post for 2.8 by @anthonyshew in #11559
docs: Update oxc.mdx to include cache false by @bestickley in #11571
docs: Fix curl markdown Accept header syntax in 2.8 release blog by @marko-hologram in #11580
docs: Fix worktree command in blog post by @anthonyshew in #11583
docs: Rename command → subcommand by @anthonyshew in #11584
feat: Add requestType tracking for header-negotiated markdown by @molebox in #11585

Changelog

fix: Support trailing commas in microfrontends JSONC files by @anthonyshew in #11573
perf: Replace third-party crates with Rust std lib equivalents by @anthonyshew in #11569
perf: Reduce duplicate dependency versions by @anthonyshew in #11568
chore: Remove legacy Go/goreleaser buildcontainer directory by @anthonyshew in #11576
chore: Rename README.md to RULE.md in skills directory by @anthonyshew in #11582
fix: Validate turbo version from lockfile for all package managers by @anthonyshew in #11587

New Contributors

@bestickley made their first contribution in #11571
@marko-hologram made their first contribution in #11580

Full Changelog: vercel/turborepo@v2.8.0...v2.8.1

`v2.8.0`: Turborepo v2.8.0

Compare Source

What's Changed

Docs

fix(docs): Hide line numbers for terminal code blocks by @anthonyshew in #11560
fix: Disable pointer events on closed chat panel by @anthonyshew in #11561

@turbo/repository

chore: Update to Rust 1.93.0 by @ognevny in #11548

Changelog

chore: Update docs:dev script filter to point to the correct documentation site path by @yujiseok in #11551
docs(skills): Standardize --dry flag usage by @jeniabrook in #11550
fix: Normalize ANSI escape codes in insta snapshots by @anthonyshew in #11564
chore: Remove unused dependencies by @anthonyshew in #11565

New Contributors

@yujiseok made their first contribution in #11551

Full Changelog: vercel/turborepo@v2.7.6...v2.8.0

`v2.7.6`

Compare Source

`v2.7.5`: Turborepo v2.7.5

Compare Source

What's Changed

Docs

docs(fix): Add loading state after sources load in AI chat by @anthonyshew in #11442
feat(turbo-json): Add optional description field to task definitions by @anthonyshew in #11447
fix(docs): Clean up markdown output for LLM content negotiation by @anthonyshew in #11452
docs: Block search engine indexing on subdomains by @anthonyshew in #11455
chore: Update domain to turborepo.dev by @anthonyshew in #11454
fix(docs): Allow search engine indexing on production domain by @anthonyshew in #11456
fix(docs): Fix mobile hamburger menu not opening by @anthonyshew in #11482
feat(docs): Add search icon to mobile header by @anthonyshew in #11483
feat: Add errorsOnlyShowHash future flag by @anthonyshew in #11486
feat: Add docs subcommand for searching documentation by @anthonyshew in #11490
feat(docs): Implement two-stage chat by @anthonyshew in #11493
fix(docs): Cancel active stream when clearing chat by @anthonyshew in #11494
feat(docs): Add version warning for old docs subdomains by @anthonyshew in #11495
docs: Show 'Searching sources...' loading state in AI chat by @anthonyshew in #11496

create-turbo

chore: update copyright year to 2026 by @rootdiae in #11476

Changelog

fix(scope): Make package inference deterministic for subdirectory filters by @anthonyshew in #11432
fix(tui): Only call DisableMouseCapture on Windows if mouse capture was enabled by @anthonyshew in #11444
fix: Improve behavior for OOM-killed tasks by @anthonyshew in #11477
fix: Remove root app package requirement for polyrepo support by @anthonyshew in #11478
fix(tui): Enable mouse capture for all terminals to restore scroll functionality by @anthonyshew in #11487
fix: Replace execSync with execFileSync for oxfmt by @odaysec in #11463

Full Changelog: vercel/turborepo@v2.7.4...v2.7.5

`v2.7.4`: Turborepo v2.7.4

Compare Source

What's Changed

Docs

docs: Add dependsOn to lint task for proper cache invalidation by @anthonyshew in #11384
chore: Migrate from Prettier to oxfmt by @anthonyshew in #11392
docs: Add Oxc (oxlint, oxfmt) guide by @anthonyshew in #11398
chore: Update oxlint configuration by @anthonyshew in #11413
feat: Git worktree support by @anthonyshew in #11416
docs: Exclude sitemap.xml from middleware to prevent i18n rewrite by @anthonyshew in #11419
fix(docs): Exclude schema.json paths from middleware matcher by @anthonyshew in #11420
docs: Fix OpenAPI spec by @anthonyshew in #11421
fix(docs): Make mobile menu scrollable on small viewports by @anthonyshew in #11422
fix(docs): Fix markdown content negotation matcher by @anthonyshew in #11425

create-turbo

fix(create-turbo): Lowercase bun label for consistency by @anthonyshew in #11388
refactor(create-turbo): Simplify git initialization to single commit by @anthonyshew in #11387

Examples

fix: update outdated packages to remove node/nest deprecation warning by @varma-cephas in #11395
examples: Upgrade with-prisma to prisma 7.2.0 and pnpm by @msebi in #11402
fix(example): remove @expo/webpack-config from with-react-native-web by @wantop1 in #11408

Changelog

fix: Support file watching for non-root volumes on MacOS by @mdlawson in #11363
fix(create-turbo): Prevent hang when using bun package manager by @anthonyshew in #11386
fix(turbo-utils): Add proxy support to fetch requests by @anthonyshew in #11389
fix: Validate root and temp directory paths in download function by @odaysec in #11311
chore: Add fix scripts for lint, format, and TOML checking by @anthonyshew in #11397
fix: Prevent infinite loop in pnpm turbo script and update docs by @anthonyshew in #11400
docs: Add AGENTS.md and remove .cursor rules by @anthonyshew in #11401
fix: Normalize workspace globs with leading ./ by @anthonyshew in #11403
fix(ui): Fix text selection when TUI sidebar is hidden by @anthonyshew in #11405
fix(tui): Properly disable mouse mode on exit and panic by @anthonyshew in #11418

New Contributors

@mdlawson made their first contribution in #11363
@odaysec made their first contribution in #11311
@varma-cephas made their first contribution in #11395
@msebi made their first contribution in #11402
@wantop1 made their first contribution in #11408

Full Changelog: vercel/turborepo@v2.7.3...v2.7.4

Configuration

📅 Schedule: Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday ( * 0-4,22-23 * * 1-5 ), Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

cubic-dev-ai

No issues found across 2 files

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot added the dependencies Dependency updates label Jan 12, 2026

renovate bot enabled auto-merge (squash) January 12, 2026 02:02

renovate-approve-2 bot approved these changes Jan 12, 2026

View reviewed changes

renovate-approve bot approved these changes Jan 12, 2026

View reviewed changes

github-actions bot added qa:running QA workflow is currently running status:approved Pull request has been approved labels Jan 12, 2026

cubic-dev-ai bot reviewed Jan 12, 2026

View reviewed changes

renovate bot force-pushed the renovate/turbo-monorepo branch from 251f2c7 to 155afcc Compare January 17, 2026 06:10

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.7.4~~ chore(deps): update dependency turbo to v2.7.5 Jan 17, 2026

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.7.5~~ chore(deps): update dependency turbo to v2.7.6 Jan 24, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch 2 times, most recently from 3cf97f2 to 1dc5318 Compare January 28, 2026 19:15

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.7.6~~ chore(deps): update dependency turbo to v2.8.0 Jan 28, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 1dc5318 to 9901082 Compare January 30, 2026 22:42

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.0~~ chore(deps): update dependency turbo to v2.8.1 Jan 30, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 9901082 to d3e0bef Compare February 3, 2026 06:14

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.1~~ chore(deps): update dependency turbo to v2.8.2 Feb 3, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from d3e0bef to a9926e7 Compare February 3, 2026 23:00

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.2~~ chore(deps): update dependency turbo to v2.8.3 Feb 3, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from a9926e7 to 4a94302 Compare February 10, 2026 23:52

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.3~~ chore(deps): update dependency turbo to v2.8.5 Feb 10, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from 4a94302 to e09ef1c Compare February 11, 2026 15:35

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.5~~ chore(deps): update dependency turbo to v2.8.6 Feb 11, 2026

renovate bot force-pushed the renovate/turbo-monorepo branch from e09ef1c to bee6f7d Compare February 11, 2026 23:10

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.6~~ chore(deps): update dependency turbo to v2.8.7 Feb 11, 2026

chore(deps): update dependency turbo to v2.8.8

392faaa

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot force-pushed the renovate/turbo-monorepo branch from bee6f7d to 392faaa Compare February 13, 2026 22:57

renovate bot changed the title ~~chore(deps): update dependency turbo to v2.8.7~~ chore(deps): update dependency turbo to v2.8.8 Feb 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency turbo to v2.8.8#1520

chore(deps): update dependency turbo to v2.8.8#1520
renovate[bot] wants to merge 1 commit intomainfrom
renovate/turbo-monorepo

renovate bot commented Jan 12, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.8.7: Turborepo v2.8.7

What's Changed

Changelog

v2.8.6: Turborepo v2.8.6

What's Changed

Changelog

v2.8.5: Turborepo v2.8.5

What's Changed

@​turbo/codemod

@​turbo/repository

Changelog

v2.8.4: Turborepo v2.8.4

What's Changed

create-turbo

eslint

Examples

Changelog

v2.8.3: Turborepo v2.8.3

What's Changed

Changelog

v2.8.2: Turborepo v2.8.2

What's Changed

Docs

create-turbo

@​turbo/codemod

eslint

Examples

Changelog

New Contributors

v2.8.1: Turborepo v2.8.1

What's Changed

Docs

Changelog

New Contributors

v2.8.0: Turborepo v2.8.0

What's Changed

Docs

@​turbo/repository

Changelog

New Contributors

v2.7.6

v2.7.5: Turborepo v2.7.5

What's Changed

Docs

create-turbo

Changelog

v2.7.4: Turborepo v2.7.4

What's Changed

Docs

create-turbo

Examples

Changelog

New Contributors

Configuration

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Jan 12, 2026 •

edited

Loading

`v2.8.7`: Turborepo v2.8.7

`v2.8.6`: Turborepo v2.8.6

`v2.8.5`: Turborepo v2.8.5

@turbo/codemod

@turbo/repository

`v2.8.4`: Turborepo v2.8.4

`v2.8.3`: Turborepo v2.8.3

`v2.8.2`: Turborepo v2.8.2

@turbo/codemod

`v2.8.1`: Turborepo v2.8.1

`v2.8.0`: Turborepo v2.8.0

@turbo/repository

`v2.7.6`

`v2.7.5`: Turborepo v2.7.5

`v2.7.4`: Turborepo v2.7.4