Packages

turbo

2.11.8MIT
  • 2.11.8 is the latest, published 13 October 2026.
  • 2 security advisories, all fixed.
  • 2.x: 118 releases since 4 June 2024, 17 in the last 90 days.

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

Releases in the last 90 days

Feed of releases and advisories

Every stable release, newest first. Notes are quoted as the maintainers published them.

  1. 2.11.8

    13 October 2026
    Add experimental setup future flag

    What's Changed

    Changelog

    • feat: Add experimental setup future flag

    • fix: Remove Bash dependency from strict environment tests

    • fix: Use repository package manager for automatic Turbo downloads

    • feat: Add shared platform primitives for setup and shim

    • fix: Populate task graphs for affected and filtered listings

    • feat: Add bounded checksum-verifying downloads

    • feat: Validate setup npm version requests

    • fix: Prune unused pnpm catalog snapshots

    • feat: Resolve Node versions from native declarations

    • feat: Honor tool-download proxy and certificate settings

    • feat: Check bounded setup version-request overlap

    • feat: Discover setup JavaScript package-manager declarations

    • feat: Verify local artifact bytes without HTTP

    • fix: Deflake concurrent agent guidance updates

    • feat: Extract verified TAR archives into private staging

    • feat: Add experimental setup command surface

    • feat: Extract safe Node TAR symlinks

    • feat: Infer setup roots without package managers

    • feat: Add atomic managed tool installation inventory

    • fix: Invalidate managed repositories when turbo.lock changes

    • feat: Safely extract verified ZIP archives

    • fix: Avoid duplicate code CI on pull request reviews

    • feat: Validate portable setup tool resolutions

    • fix: Preserve scoped tool paths and owner-executable exports

    • fix: Preserve Node runtime failure policy provenance

    • feat: Add an internal managed-run capability query

    • feat: Verify bounded SHA-512 tool artifacts

    • fix: Repair missing install generations and share tool readiness

  2. 2.11.7

    2 October 2026
    Pass SDKROOT through to repository tasks

    What's Changed

    Changelog

    • fix: Pass SDKROOT through to repository tasks

    • fix: Ignore Vercel OIDC token rotation in .env.local cache inputs

  3. 2.11.6

    1 October 2026
    Upgrade standalone turbo on installer reruns

    What's Changed

    Changelog

    • fix: Upgrade standalone turbo on installer reruns

    • fix: Keep Yarn patch resolutions with npm protocol selectors in prune

    • fix: Match production MFE negative lookaheads locally

    • fix: Normalize task inputs consistently for affected detection and hashing

    • feat: Add task tags with configuration inheritance

    • fix: Upgrade brace-expansion to latest compatible releases

    • security

      docs: Point security.txt to Vercel HackerOne program

    • feat: Expose task and package tags in query

    • feat: Filter query tasks and packages by tags

    • feat: Filter tasks by tags in the CLI

    • fix: Complete task query metadata for non-script entrypoints

    • fix: Infer single-package mode for query commands

  4. 2.11.5

    28 September 2026
    Back off remote artifact requests during outages

    What's Changed

    Changelog

    • fix: Back off remote artifact requests during outages

    • feat: Bundle docs in turbo npm package

    • fix: Stabilize pnpm per-workspace lockfile hashes

    • security

      fix: Update js-yaml to address CVE-2026-84375

    • security

      chore: Upgrade Next.js in docs and factory for CVE-2026-94545

    • fix: Remove unmaintained proc-macro-error2

    • fix: Sign complete on-disk artifacts after local cache writes

    • fix: Use map_while for invariant text prefixes

    • fix: Wait for watcher setup with Tokio wait_for

    • fix: Reject empty tokens when reading token files

    • fix: Format pnpm v5 package names

    • fix: Report package manager error source paths

    • fix: Resolve LSP task references with JSONC AST

    • fix: Validate scope selector glob bases

    • fix: Add path context to globwatch errors

    • perf: Parse character

  5. 2.11.4

    24 September 2026
    Respect negated global dependencies in affected detection

    What's Changed

    Changelog

    • fix: Respect negated global dependencies in affected detection

    • fix: Only reject secondary go.work files Go reads for workspace members

    • feat: Add affected query APIs to turborepo-query

    • feat: Add pure microfrontend port resolver

    • fix: Disable remote cache after unrecoverable forbidden responses

    • perf: Send cache analytics in larger batches

    • perf: Batch dry-run remote cache existence checks

    • fix: Coordinate artifact requests after rate limiting

    • fix: Share concurrent remote-cache token recovery

    • fix: Put version in turbo query JSON output instead of a separate banner

  6. 2.11.3

    22 September 2026
    Avoid microfrontend polyrepo warnings

    What's Changed

    Changelog

    • fix: Avoid microfrontend polyrepo warnings

    • fix: Ignore gitignored files in boundaries

    • fix: Stabilize boundaries tag order in prune

    • fix: Normalize affected task input globs

    • fix(affected): Treat root internal dependency changes as global

    • perf: Reuse parsed lockfile during lazy graph loading

    • fix: Stop with tasks when parent exits

  7. 2.11.2

    18 September 2026
    Restore repeatable CLI flags

    What's Changed

    Changelog

    • fix: Restore repeatable CLI flags

  8. 2.11.1

    18 September 2026
    Allow esbuild builds for pnpm generators

    What's Changed

    Changelog

    • fix: Allow esbuild builds for pnpm generators

  9. 2.11.0

    18 September 2026
    Avoid normalizing git index path joins

    What's Changed

    Changelog

    • perf: Avoid normalizing git index path joins

    • feat: Migrate TUI virtual terminals from vt100 to Ghostty

    • fix: Support Corepack packageManager integrity hashes

    • fix(env): Add XDG_DATA_* to pass-through

    • feat: Support devEngines.packageManager

    • feat: Support devEngines packageManager in workspaces

    • feat: Update add package manager codemod

    • feat: Update workspace package manager declarations

    • fix: Install Zig for LSP builds

    • feat: Recognize nub as a package manager

    • fix: Preserve 3-level nested Bun lockfile entries during prune

    • fix: Avoid following nested symlinked cache outputs

    • feat: Add nub package manager support to JavaScript packages

    • fix: Link ghostty-vt statically on Windows MSVC

    • feat: Add nub to create-turbo options

    • fix: Normalize package manager versions

    • fix: Use singular workspace in package resolution error

    • fix: Support nub native lockfiles

    • perf(build): Enable thin LTO + codegen-units=1 for release builds

    • feat: Add aube package manager support

    • fix: Normalize package manager version output

    • fix(repository): honor semver ranges in devEngines.packageManager.version

    • fix: Skip node_modules in boundaries checks

    • fix: Add token exchange recovery guidance

    • feat: Add --production flag to turbo prune

    • feat: Accept Bun lockfile version 2

    • fix: Handle task executor join errors as internal errors

    • fix: Tweaks for nub support

  10. 2.10.13

    14 September 2026
    Remove unsupported remote cache environment variable

    What's Changed

    Changelog

    • fix: Remove unsupported remote cache environment variable

    • fix: Copy TUI selections locally over SSH

    • feat: Use uv workspace metadata

    • feat: Support Python virtual environments

    • fix: Scope uv lockfile affectedness

    • fix: Explain disabled uv task caching

    • fix: Explain uv identity probe failures

    • fix: Explain uncached Cargo library builds

    • fix: Explain disabled Cargo task caching

    • fix: Keep Cargo tasks runnable without compiler identity

    • feat: Support Cargo root packages

    • feat(repository): Expose flat lockfile package list for metrics

    • feat: Expand repository lockfile package metadata

    • fix: Restrict Factory to review comments

    • fix: Pluralize package count in run prelude

    • fix: Restore docs client navigation

    • fix: Refresh Factory workspaces from main

    • perf: Speed up plain package listings

    • fix: Detect package-level turbo.jsonc

    • fix: Format Slack pull request notifications

    • feat: Link workspaces to pull requests

    • fix: Show workspace failure details

    • fix: Gracefully handle native lockfile failures

    • fix: Show native tasks in task listings

    • fix: Deduplicate multi-language watch hashes

    • fix: Normalize multi-language cache environment inputs

    • fix: Update --filter help links to canonical docs URL

    • perf: Skip Cargo resolution for workspace-only queries

Show 7 earlier releases

  1. 2.10.12

    25 August 2026
    Refresh documentation social cards

    What's Changed

    Changelog

    • feat: Refresh documentation social cards

    • fix: Preserve showcase logo sizes

    • fix: Refine mobile homepage interactions

    • fix: Align homepage KPIs to the right

    • fix: Prevent homepage KPI overflow

    • perf: Skip unused Package Configuration stats

    • perf: Stream dry-run JSON output

    • perf: Merge same-prefix tree-wildcard globs into one directory walk

    • fix: Remove incremental task caching

    • security

      feat: Add security.txt endpoint

    • feat: Redesign factory control plane

    • perf: Replace regex captures with hand-written parsers in berry lockfile identifiers

    • perf: Index Berry lockfile resolution overrides by dependency name

    • feat: Add SSH command affordance for factory sandboxes

    • fix: Show invalid affected task glob

    • perf: Skip unused repository indexing for package listings

    • feat: Rebuild the factory image on every merge to main

    • fix: Decouple graceful shutdown tests from the shell commands example

    • feat: Start ad-hoc factory work from the operator page

    • fix: Rebuild factory images without custom workflows

    • feat: Add factory navigation

    • feat: Add durable Factory workspaces

    • feat: Stream Factory sandbox as terminal

    • fix: Restore Factory workspace creation

    • fix: Update Factory session network policy

    • fix: Improve Factory terminal line spacing

    • fix: Install Factory publishing skill

    • feat: Standardize Factory meta titles to Turborepo suffix

  2. 2.10.11

    18 August 2026
    Automatically approve release workflows

    What's Changed

    Changelog

    • fix: Automatically approve release workflows

    • fix: Avoid repeated strict entrypoint traversal

    • feat: Cache native uv tool tasks

    • fix: Isolate concurrent generator config bundles

    • fix: Respect gitignore without git metadata

    • feat: Expand performance agent toolbox

    • fix: Tolerate transient input files

  3. 2.10.10

    14 August 2026
    Support nub.lock files

    What's Changed

    Changelog

    • feat: Support nub.lock files

    • perf: Walk the repository once when pruning

    • security

      fix(deps): Upgrade js-yaml to 4.3.1 (GHSA-5p4m-2wfm-xmqj)

    • fix: Enable Eve examples pull requests

    • feat: Add Eve operator dashboard

    • fix: Remove unsupported sandbox network policy

    • feat: Rotate Eve example maintenance daily

    • fix: Resolve agent lint errors

    • fix(cli): Move EXPERIMENTAL label from ls command to --output flag

    • fix: Apply nested parent gitignore patterns in manual hashing

    • feat: Add pytest task discovery

    • feat: Notify Slack when agents open PRs

    • fix: Expose Slack delivery diagnostics

    • feat: Add daily performance agent

    • feat: Support cross-toolchain repository affectedness

    • fix: Scope musl library dependency installation

    • fix(bun): Preserve overrides objects, trustedDependencies, workspace bins and git integrity through prune; accept lockfileVersion 3

  4. 2.10.9

    7 August 2026
    Walk literal-prefix tree globs without wax compilation

    What's Changed

    Changelog

    • perf: Walk literal-prefix tree globs without wax compilation

    • fix: Accept semver ranges in devEngines.packageManager.version

    • perf(lockfiles): Borrow field-name scalars in the pnpm fast parser

    • perf(repository): Avoid discarded alias allocation in Relationship

    • perf(lockfiles): Drop redundant human_name clone for pnpm v7/v9

    • perf: Index workspace nodes by name in project_relationships

    • perf: Share resolution identity lists across identical workspace closures

    • perf: Index Bun nested lockfile entries by name for fallback resolution

    • perf: Memoize framework inference per package during task hashing

    • perf: Avoid materializing transient declarations in external_dependencies

    • perf: Enable shared closure DP for npm and yarn1 lockfiles

    • perf: Parse pnpm explicit-key entries in the lockfile fast path

    • perf: Parallelize resolution fingerprint hashing

    • perf: Build resolution identity lists in parallel

    • perf: Intern resolution identities as Arc<str> across closures

    • fix: Compose affected tasks with package filters

    • fix: Upgrade brace-expansion to 5.0.9

    • fix: Don't use eprintln! in the panic hook

    • fix: Invalidate only when Git ignore sources change

    • feat: Compose aggregate native task dependencies

    • fix: Respect aggregate task overrides

    • feat: Parse Python quality tool declarations

    • feat: Resolve Python quality plans

    • feat: Synthesize Python quality tasks

    • feat: Hash Python quality task inputs

    • fix: Prune Bun wildcard workspace dev dependencies

    • fix: Prevent Windows process cleanup PID reuse

  5. 2.10.8

    31 July 2026
    Scroll TUI task list with mouse wheel

    What's Changed

    Changelog

    • fix: Scroll TUI task list with mouse wheel

    • fix: Make releases resumable

    • perf: Cache telemetry salt instead of re-reading config on every hash

    • feat: Support Android (Termux)

    • fix: Resolve gitdir for linked worktrees in repo index

    • feat: Resolve GitHub Actions remote base refs behind future flag

    • fix: Use tokenless release review gate

    • fix: Support fork PRs in review gate

    • fix: Serialize macOS Homebrew setup

  6. 2.10.7

    25 July 2026
    Verify version after attempting codemod upgrade

    What's Changed

    Changelog

    • fix: Verify version after attempting codemod upgrade

    • fix: Upgrade @vercel/connect

    • feat: Select runnable task entrypoints

    • fix: Prevent mobile homepage overflow

    • fix: Preserve pnpm root dependencies during prune

    • fix: Preserve pnpm aliased dependencies during prune

    • fix: Support multiple macOS file watch roots

  7. 2.10.6

    22 July 2026
All 325 releases

Major versions

  • 2.xsince 4 June 2024 · latest 2.11.8 · 118 releases
  • 1.xsince 9 December 2021 · latest 1.13.4 · 138 releases
  • 0.xsince 6 May 2013 · latest 0.8.5 · 69 releases

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 14 October 2026. Releases and advisories last read 14 October 2026.

Know when your own dependencies move

Inlinr tracks your coding time automatically. Switch dependency tracking on for a project and it reads that repository's manifest to show what is behind and what has been deprecated — off by default, one project at a time.

See what Inlinr doesAll packages