turbo
2.11.10 · 20 Oct 2026MIT17.5M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for turbo. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 2.11.10 | Safe from 2.9.14 | |
| 1.13.4 | 11 open advisories, worst moderate · last release Jun 2024, no longer updated |
- ModerateTurbo: Login callback CSRF/session fixationGHSA-hcf7-66rw-9f5r · 19 May 2026
- 2.x2.0.0 – 2.9.12Fixed in 2.9.14
- 1.x and older0.0.1 – 1.13.4No fix, no longer updated · move to 2.9.14
- LowTurbo: Unexpected local code execution during Yarn Berry detectionGHSA-3qcw-2rhx-2726 · 19 May 2026
- 2.x2.0.0 – 2.9.12Fixed in 2.9.14
- 1.x1.1.0 – 1.13.4No fix on 1.x · move to 2.9.14
Quality and security signals
What npm and deps.dev say about the latest release. Signals, not a verdict.
- Licence
- ProvenancePresent, built from github.com/vercel/turborepoSays where the release was built and from which commit. It does not say the code is safe.
- Published byGitHub Actions
- Maintainers on npm
- Size
- GitHub stars31,180 on vercel/turborepo
- Last release2.11.8, 13 October 2026
- OpenSSF ScorecardNo Scorecard for this repository
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.