chore(deps): upgrade turbo to 2.9.14 to fix CSRF vulnerabilit

[ArtieReus]

Summary

Upgrades turbo from 2.5.6 to 2.9.14 to fix a CSRF vulnerability in Turborepo's login callback flow (Dependabot alert #212).

Security Impact: Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. A malicious web page could send a request to the local callback server with
an attacker-controlled token during authentication.

Changes Made

• Upgraded turbo from 2.5.6 to 2.9.14 (security fix for CSRF vulnerability)
• Upgraded pnpm from 10.32.1 to 10.34.1 (lockfile handling improvements)

Related Issues

• Related pnpm bug: minimumReleaseAge fails on fixed version in package.json during fresh install (no lockfile), incorrectly checking latest tag pnpm/pnpm#11982

Screenshots (if applicable)

N/A - dependency upgrade only

Testing Instructions

1. pnpm i
2. pnpm build
3. pnpm lint
4. pnpm typecheck
5. pnpm test

Checklist

• I have performed a self-review of my code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have made corresponding changes to the documentation (if applicable).
• My changes generate no new warnings or errors.
• I have created a changeset for my changes.

PR Manifesto

Review the PR Manifesto for best practises.

[changeset-bot]

⚠️ No Changeset found

Latest commit: cf10170

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

Pull request overview

This PR updates the monorepo’s build tooling dependencies to address a reported Turborepo CSRF vulnerability by upgrading turbo, and also bumps the pinned pnpm version used via packageManager.

Changes:

• Upgraded turbo from 2.5.6 to 2.9.14.
• Updated the root packageManager pin from pnpm@10.32.1 to pnpm@10.34.1.
• Refreshed pnpm-lock.yaml to reflect the new Turborepo package layout (@turbo/* optional binaries).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Bumps turbo and the pinned pnpm version via packageManager.
pnpm-lock.yaml	Updates the lockfile to match turbo@2.9.14 resolution and its platform-specific optional deps.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported