Turborepo v2.10.0

What's Changed

create-turbo

• feat: Replace package manager commands in scaffolded README files by @DependerKumarSoni in #6747
• chore: Update dependencies found in audits by @anthonyshew in #12586

@turbo/codemod

• feat: Handle package manager catalogs in migration codemod by @anthonyshew in #12496
• fix: Always update $schema URL to versioned format during migration by @anthonyshew in #12529
• fix: Support turbo.jsonc in codemod transforms by @anthonyshew in #12532
• fix: Preserve prerelease info in schema URL during codemod migration by @anthonyshew in #12542

eslint

• chore: Upgrade dependencies to resolve their known vulnerabilities by @anthonyshew in #12604

@turbo/repository

• feat: Add cacheMaxAge and cacheMaxSize for local cache eviction by @anthonyshew in #12487
• chore: Update to Rust 1.95.0 by @ognevny in #12636

@turbo/telemetry

• fix: Suppress telemetry alert when running on Vercel by @anthonyshew in #12576

Examples

• feat(examples): Add Next.js + Elysia full-stack starter template by @eastgold15 in #12414
• build(deps): Bump @xmldom/xmldom from 0.8.11 to 0.8.12 in /examples/with-react-native-web by @dependabot[bot] in #12537
• fix: Add missing @types/node to with-svelte example apps by @anthonyshew in #12585
• feat(sandbox): Bump @vercel/sandbox from v1 to beta by @marc-vercel in #12595
• chore: Update examples to Turbo 2.9.6 by @cursor[bot] in #12600
• examples: Add Ultracite example by @haydenbleasel in #12615

Changelog

• docs: Release post for 2.9 by @anthonyshew in #12441
• docs: Add documentation for cacheMaxAge and cacheMaxSize options by @anthonyshew in #12500
• fix: Resolve correct nested bun lockfile versions during prune by @anthonyshew in #12506
• Revert "fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes" by @anthonyshew in #12507
• fix: Unblock watch loop so interruptible persistent tasks restart on file changes by @anthonyshew in #12509
• fix(api-client): Treat * as wildcard in preflight Access-Control-Allow-Headers by @bitttttten in #12503
• docs: Document turbo.* generator variables by @anthonyshew in #12511
• fix: Backfill missing pnpm workspace importer entries during prune by @anthonyshew in #12514
• fix: Include transitive dependencies in engine graph pruning for affected paths using Task Graph by @anthonyshew in #12516
• fix: Update AI-generated response disclaimer to include human attribution by @anthonyshew with @Copilot in #12517
• fix: Preserve shallow install strategy during npm lockfile pruning by @anthonyshew in #12520
• fix: Preserve per-workspace lockfiles during pnpm pruning by @anthonyshew in #12519
• feat: Add incremental task caching by @anthonyshew in #12531
• docs: Send siteId as label on feedback GitHub issues by @molebox in #12527
• Replace local ai-agent-detection with @vercel/agent-readability by @molebox in #12528
• fix: Prevent filterUsingTasks --filter from pulling dependents into Task Graph by @anthonyshew in #12535
• fix: Only enforce signature key length for keys that exist by @anthonyshew in #12538
• fix: Validate engine concurrency after task-level filtering by @anthonyshew in #12540
• feat: Allow --affected and --filter to be combined by @anthonyshew in #12543
• fix(config): Deep-merge nested OTEL config across priority sources by @bitttttten in #12513
• fix: Retain microfrontend proxy tasks when using filterUsingTasks by @anthonyshew in #12545
• fix: Bun workspace lockfile pruning producing invalid output by @JRoy in #12548
• fix: Respect dirty .gitignore patterns during task input hashing by @anthonyshew in #12557
• feat: Add circular package dependency detection to boundaries by @anthonyshew in #12567
• perf: Increase remote cache upload chunk size from 8KB to 256KB by @anthonyshew in #12568
• perf: Parallelize boundaries checking with Rayon and cache DFS traversals by @anthonyshew in #12569
• docs: Add Bun equivalent for updating dependencies by @anthonyshew in #12580
• fix: Mention turbo.json in concurrency error message by @anthonyshew in #12582
• fix: Surface actionable message when remote cache is requested but not linked by @anthonyshew in #12584
• chore: Delete agents app by @anthonyshew in #12587
• fix: Load custom CA certificates in fast webpki-only HTTP client by @anthonyshew in #12591
• docs: Remove pre-release badges by @anthonyshew in #12592
• fix: Align Markdown docs routing with docs/md endpoints by @molebox in #12596
• fix: Support two-dot git ranges in filter selectors by @anthonyshew in #12599
• feat: Graceful shutdown by @anthonyshew in #12607
• test: Add stdin EOF startup regression coverage by @anthonyshew in #12609
• fix: Ignore SIGINT in shim after spawning local turbo by @anthonyshew in #12612
• fix: Support pnpm v11 multi-document lockfiles by @anthonyshew in #12616
• fix: Preserve graceful shutdown exit code by @anthonyshew in #12620
• fix: Keep Node wrapper alive during graceful shutdown by @anthonyshew in #12622
• fix: Preserve PTY graceful shutdown semantics by @anthonyshew in #12624
• feat: Move Vercel auth to standard OAuth/device flows by @markandrus in #12526
• fix: Preserve legacy Vercel auth compatibility by @anthonyshew in #12629
• fix: Recover Vercel auth tokens across login flows by @anthonyshew in #12631
• docs: Fix TURBO_PLATFORM_ENV_DISABLED value in docs (true, not false) by @sleitor in #12633
• chore: Update flags SDK by @AndyBitz in #12646
• ci: Disable AWS-backed sccache by @anthonyshew in #12663
• fix: Prevent prune from overmatching gitignore entries by @anthonyshew in #12662
• ci: Harden release API commits by @anthonyshew in #12664
• ci: Fix release API commit paths by @anthonyshew in #12665
• release(turborepo): 2.9.7-canary.14 by @github-actions[bot] in #12666
• chore: Add tbx sandbox helper by @anthonyshew in #12668
• fix: Allow npm registry in tbx sandboxes by @anthonyshew in #12669
• fix: Install turbo globally in tbx base by @anthonyshew in #12670
• docs: Clarify package hash file inputs by @anthonyshew in #12671
• fix: Allow tbx sandboxes to use stale bases by @anthonyshew in #12672
• fix: Install dotfiles during tbx base refresh by @anthonyshew in #12673
• fix: Improve tbx sandbox startup by @anthonyshew in #12674
• fix: Improve tbx sandbox startup defaults by @anthonyshew in #12675
• fix: Support pnpm 11 flat patch lockfiles by @anthonyshew in #12676
• docs: Fix link to passthrough variables source code by @Wartijn in #12643
• release(turborepo): 2.9.7-canary.15 by @github-actions[bot] in #12677
• fix: Avoid rerunning non-cacheable watch dependencies by @anthonyshew in #12678
• release(turborepo): 2.9.7 by @github-actions[bot] in #12679
• test: Add regression for gitignored output restore by @anthonyshew in #12681
• docs: Clarify root task guidance by @anthonyshew in #12683
• fix: Preserve concrete dependency precedence by @anthonyshew in #12682
• release(turborepo): 2.9.8-canary.1 by @github-actions[bot] in #12685
• fix: Resolve Yarn catalog affected packages by @anthonyshew in #12684
• release(turborepo): 2.9.8-canary.2 by @github-actions[bot] in #12687
• fix: Preserve Bun prune lockfile validity by @anthonyshew in #12686
• release(turborepo): 2.9.8-canary.3 by @github-actions[bot] in #12689
• fix: Create prune docker bin stubs by @anthonyshew in #12688
• release(turborepo): 2.9.8-canary.4 by @github-actions[bot] in #12690
• fix: Keep tbx shell connections stable by @anthonyshew in #12692
• perf: Reduce turbo watch hash memory spikes by @anthonyshew in #12695
• release(turborepo): 2.9.8-canary.5 by @github-actions[bot] in #12696
• fix: Reduce parent-death watchdog CPU usage by @anthonyshew in #12697
• release(turborepo): 2.9.8-canary.6 by @github-actions[bot] in #12698
• release(turborepo): 2.9.8 by @github-actions[bot] in #12700
• fix: Remove Unix parent death watchdogs by @anthonyshew in #12699
• release(turborepo): 2.9.9-canary.1 by @github-actions[bot] in #12705
• fix: Scope repo index prefixes to Git root by @anthonyshew in #12706
• release(turborepo): 2.9.9-canary.2 by @github-actions[bot] in #12708
• ci: Harden non-release GitHub Actions by @anthonyshew in #12707
• docs: Add pnpm workspace flag (-w) to Oxc setup docs by @mattjoll in #12655
• fix: Harden OG image signatures by @anthonyshew in #12709
• fix: Scope release npm publishing credentials by @anthonyshew in #12710
• ci: Harden release workflows by @anthonyshew in #12711
• release(turborepo): 2.9.9-canary.3 by @github-actions[bot] in #12712
• fix: Harden docs security endpoints by @anthonyshew in #12713
• ci: Harden internal GitHub Actions by @anthonyshew in #12714
• ci: Harden release workflow handling by @anthonyshew in #12715
• fix: Preserve lockfiles during dry-run conversion by @anthonyshew in #12717
• ci: Fix LSP workflow container matrix by @anthonyshew in #12718
• release(turborepo): 2.9.9-canary.4 by @github-actions[bot] in #12716
• release(turborepo): 2.9.9 by @github-actions[bot] in #12719
• fix: Respect SCM env vars in turbo query affected by @anthonyshew in #12722
• ci: Package VSCode extension in release workflow by @anthonyshew in #12723
• fix: Avoid some raw create-turbo example telemetry by @anthonyshew in #12725
• fix: Escape graph HTML payloads by @anthonyshew in #12726
• fix: Prevent OTEL token injection to spoofed origins by @anthonyshew in #12727
• fix: Retry HTTP status failures by @anthonyshew in #12728
• fix: Validate microfrontend proxy Host header by @anthonyshew in #12730
• fix: Redact task hash env debug logs by @anthonyshew in #12733
• fix: Filter microfrontend proxy environments by @anthonyshew in #12732
• fix: Preserve FSEvents mount points for device-relative paths by @anthonyshew in #12729
• fix: Validate proxy Host headers by @anthonyshew in #12731
• fix: Resolve TypeScript .js extension imports to .ts files in boundaries by @maschwenk in #12644
• fix: Use random temp path for repo downloads by @anthonyshew in #12736
• release(turborepo): 2.9.10-canary.1 by @github-actions[bot] in #12734
• fix: Reject OTel endpoints with userinfo by @anthonyshew in #12737
• fix: Authenticate local devtools WebSocket by @anthonyshew in #12738
• fix: Handle clipboard exec errors by @anthonyshew in #12739
• fix: Restrict Vercel token reuse to trusted API origins by @anthonyshew in #12740
• fix: Keep workspace config discovery inside root by @anthonyshew in #12741
• fix: Hardening for daemon IPC endpoints by @anthonyshew in #12742
• fix: Enforce cache filesystem boundaries by @anthonyshew in #12743
• release(turborepo): 2.9.10 by @github-actions[bot] in #12745
• ci: Publish VS Code extension on release by @anthonyshew in #12747
• fix: Start daemon for VSCode Extension from the extension itself by @anthonyshew in #12749
• release(turborepo): 2.9.11-canary.1 by @github-actions[bot] in #12748
• fix: Include file URIs in LSP lifecycle logs by @anthonyshew in #12751
• fix: Handle JSON decoration visitor depth by @anthonyshew in #12752
• fix: Resolve relative turbo path in VS Code extension by @anthonyshew in #12753
• fix: Preserve Bun nested dependencies during prune by @anthonyshew in #12754
• fix: Prefer installed Turbo for LSP by @anthonyshew in #12755
• release(turborepo): 2.9.11-canary.2 by @github-actions[bot] in #12750
• ci: Parallelize LSP release publishing by @anthonyshew in #12758
• fix: Reduce VS Code extension startup popups by @anthonyshew in #12759
• fix: Support turbo.jsonc in VS Code extension by @anthonyshew in #12760
• fix: Remove VS Code task key gradient by @anthonyshew in #12761
• release(turborepo): 2.9.11-canary.3 by @github-actions[bot] in #12756
• chore: Release v2.9.11-canary.4 by @anthonyshew in #12762
• ci: Stop VS Code publish from blocking release PR by @anthonyshew in #12763
• release(turborepo): 2.9.11-canary.5 by @github-actions[bot] in #12764
• fix: Publish VS Code extension from release tag by @anthonyshew in #12765
• fix: Support shimmed VS Code LSP probes by @anthonyshew in #12767
• release(turborepo): 2.9.11-canary.6 by @github-actions[bot] in #12766
• release(turborepo): 2.9.11-canary.7 by @github-actions[bot] in #12768
• fix: Allow $TURBO_EXTENDS$ in LSP diagnostics by @anthonyshew in #12770
• release(turborepo): 2.9.11 by @github-actions[bot] in #12771
• fix: Allow transit nodes in LSP diagnostics by @anthonyshew in #12773
• release(turborepo): 2.9.12 by @github-actions[bot] in #12774
• fix: Restore docs mobile menu by @anthonyshew in #12782
• ci: Use pull_request for PR title linting by @anthonyshew in #12787
• ci: Scope GitHub Actions caches by branch by @anthonyshew in #12788
• test: Validate lockfiles without dependency downloads by @anthonyshew in #12789
• Removed unneeded import form hash creation script in docs by @dancrumb in #12799
• fix: Validate auth callback state by @anthonyshew in #12802
• fix: Harden VS Code extension command execution by @anthonyshew in #12800
• fix: Avoid project-local Yarn during detection by @anthonyshew in #12801
• chore: Release 2.9.13 by @anthonyshew in #12803
• release(turborepo): 2.9.14 by @github-actions[bot] in #12805
• fix: Prune package.json workspaces by @anthonyshew in #12808
• fix: Wait for process trees before task completion by @anthonyshew in #12809
• release(turborepo): 2.9.15-canary.1 by @github-actions[bot] in #12810
• ci: Sign macOS release binaries by @anthonyshew in #12811
• release(turborepo): 2.9.15-canary.2 by @github-actions[bot] in #12812
• fix: Prevent cache archive symlink reads by @anthonyshew in #12813
• release(turborepo): 2.9.15-canary.3 by @github-actions[bot] in #12814
• fix: Avoid path-racy chmod during directory restore by @anthonyshew in #12815
• fix: Prevent cache restore symlink race writes by @anthonyshew in #12817
• chore: Deny Rust panic extraction by default by @anthonyshew in #12818
• fix: Make structured log symlink defense race-safe by @anthonyshew in #12821
• fix: Preserve Bun alias child packages by @anthonyshew in #12822
• fix: Avoid UTF-8 panics at boundaries by @anthonyshew in #12823
• fix: Preserve non-UTF-8 Git path boundaries by @anthonyshew in #12826
• fix: Create daemon dirs with private permissions by @anthonyshew in #12827
• fix: Return Berry lockfile errors instead of panicking by @anthonyshew in #12828
• fix: Isolate Corepack state in integration tests by @anthonyshew in #12831
• ci: Use larger Windows runners for Rust tests by @anthonyshew in #12832
• docs: Add with-vite-module-federation example by @gioboa in #12794
• test: Run Rust tests without partitioning by @anthonyshew in #12833
• chore: Remove TaskHashTracker-based expect() calls by @anthonyshew in #12836
• chore: Deduplicate hash canonicalization by @anthonyshew in #12837
• fix: Prevent Windows process drain hangs by @anthonyshew in #12838
• fix: Refactor execsync to execfilesync for Shell command built from environment values by @bjormgyg in #12829
• test: Bound vt100 random quickcheck by @anthonyshew in #12839
• fix: Validate daemon discovery responses by @anthonyshew in #12840
• fix: Store PackageGraph root invariants by @anthonyshew in #12841
• chore: Avoid engine graph node expects by @anthonyshew in #12842
• test: Make Rust tests parallel-safe by @anthonyshew in #12843
• fix: Avoid graph utility node lookup panics by @anthonyshew in #12844
• fix: Avoid graph walker expect() calls by @anthonyshew in #12845
• fix: Remove fs panic extraction lints by @anthonyshew in #12846
• fix: Remove fixed map panic extraction calls by @anthonyshew in #12847
• fix: Remove devtools WebSocket panics by @anthonyshew in #12850
• fix: Remove json rewrite panic lint allow by @anthonyshew in #12848
• fix: Remove turborepo-types panic lint allows by @anthonyshew in #12849
• chore: Remove turborepo-hash build expect by @anthonyshew in #12851
• fix: Remove napi panic lint allows by @anthonyshew in #12852
• fix: Avoid globwatch expect calls by @anthonyshew in #12853
• fix: Remove LSP expect callsites by @anthonyshew in #12854
• fix: Remove scope panic lint allows by @anthonyshew in #12855
• fix: Remove task hash panic lints by @anthonyshew in #12856
• fix: Remove frameworks panic lint allows by @anthonyshew in #12857
• fix: Remove microfrontends proxy expect lint allow by @anthonyshew in #12859
• fix: Avoid API client expect calls by @anthonyshew in #12858
• fix: Avoid task executor expect calls by @anthonyshew in #12860
• fix: Remove turbo-trace unwrap callsite by @anthonyshew in #12863
• fix: Remove Vercel API mock expect usage by @anthonyshew in #12862
• fix: Remove vt100 expect lint allow by @anthonyshew in #12861
• fix: Remove turborepo-shim expect callsites by @anthonyshew in #12864
• test: Deflake daemon existing process test by @anthonyshew in #12865
• fix: Avoid repository NAPI unwrap calls by @anthonyshew in #12866
• fix: Remove pidlock panic callsites by @anthonyshew in #12867
• fix: Remove telemetry panic callsites by @anthonyshew in #12868
• chore: Remove Rust re-export shims by @anthonyshew in #12870
• fix: Remove turbo-json panic lint allows by @anthonyshew in #12869
• fix: Remove globwalk's expect() callsites by @anthonyshew in #12871
• fix: Remove turbopath's expect() callsites by @anthonyshew in #12872
• test: Deflake Corepack prepare lock on Windows by @anthonyshew in #12873
• fix: Remove signals panic callsites by @anthonyshew in #12874
• fix: Remove turbo-trace's expect() allow by @anthonyshew in #12876
• fix: Remove Vercel API mock unwrap usage by @anthonyshew in #12877
• fix: Remove task executor unwrap usage by @anthonyshew in #12878
• fix: Remove run summary expect usage by @anthonyshew in #12879
• fix: Remove microfrontends proxy unwrap usage by @anthonyshew in #12880
• fix: Remove api client unwrap usage by @anthonyshew in #12881
• fix: Remove globwalk unwrap usage by @anthonyshew in #12883
• fix: Remove UI expect() usage by @anthonyshew in #12882
• fix: Remove microfrontends expect usage by @anthonyshew in #12885
• fix: Remove boundaries's expect() usage by @anthonyshew in #12887
• fix: Remove turborepo-process's unwrap() usage by @anthonyshew in #12888
• fix: Remove UI unwrap usage by @anthonyshew in #12889
• fix: Remove microfrontends unwrap allow by @anthonyshew in #12890
• fix: Remove turborepo-process's expect() usage by @anthonyshew in #12891
• fix: Remove scm expect usage by @anthonyshew in #12893
• fix: Remove auth unwrap usage by @anthonyshew in #12886
• fix: Remove turbopath's unwrap() usage by @anthonyshew in #12884
• fix: Remove auth's expect() usage by @anthonyshew in #12895
• fix: Remove wax unwrap usage by @anthonyshew in #12899
• fix: Remove scm unwrap usage by @anthonyshew in #12897
• fix: Remove turborepo-boundaries's unwrap() usage by @anthonyshew in #12896
• fix: Remove daemon unwrap usage by @anthonyshew in #12898
• fix: Include lockfile-changed packages in affected tasks by @anthonyshew in #12900
• fix: Remove turborepo-wax's expect() usage by @anthonyshew in #12901
• fix: Remove turborepo-filewatch's expect() usage by @anthonyshew in #12903
• fix: Remove turborepo-cache's expect() usage by @anthonyshew in #12902
• fix: Remove turborepo-daemon's expect() usage by @anthonyshew in #12904
• fix: Remove turborepo-engine's unwrap() usage by @anthonyshew in #12906
• fix: Remove filewatch unwrap usage by @anthonyshew in #12907
• fix: Remove engine expect usage by @anthonyshew in #12908
• fix: Remove cache unwrap usage by @anthonyshew in #12909
• fix: Remove turborepo-lockfiles expect() usage by @anthonyshew in #12910
• chore: Set pnpm minimum release age by @anthonyshew in #12912
• fix: Remove turborepo-lockfiles's unwrap() usage by @anthonyshew in #12911
• fix: Remove turborepo-vt100's unwrap() usage by @anthonyshew in #12913
• release(turborepo): 2.9.15-canary.4 by @github-actions[bot] in #12905
• fix: Remove turborepo-lib's unwrap() usage by @anthonyshew in #12915
• fix: Remove turborepo-lib's expect() usage by @anthonyshew in #12914
• fix: Remove shim test unwrap usage by @anthonyshew in #12917
• fix: Remove turbo json test unwrap allowance by @anthonyshew in #12918
• fix: Remove run summary test unwrap usage by @anthonyshew in #12916
• release(turborepo): 2.9.15-canary.5 by @github-actions[bot] in #12919
• fix: Restore task completion semantics by @anthonyshew in #12923
• fix: Preserve nested Bun workspace dependency versions by @anthonyshew in #12924
• release(turborepo): 2.9.15-canary.6 by @github-actions[bot] in #12925
• fix: Restore release PR auto-merge by @anthonyshew in #12927
• perf: Index repo gitignore matchers by @anthonyshew in #12928
• ci: Disable incremental Rust test builds by @anthonyshew in #12929
• perf: Trim OpenTelemetry crate features by @anthonyshew in #12930
• perf: Trim microfrontends proxy HTTP features by @anthonyshew in #12931
• fix: Accept experimentalCI object config by @anthonyshew in #12934
• release(turborepo): 2.9.15-canary.7 by @github-actions[bot] in #12935
• fix: Restore a few internal invariant checks by @anthonyshew in #12933
• fix: Improve profile tracing coverage by @anthonyshew in #12936
• fix: Use build-scale OTel duration buckets by @anthonyshew in #12939
• fix: Preserve pnpm injected peer package entries by @anthonyshew in #12940
• feat: Add heap allocation profiling by @anthonyshew in #12943
• release(turborepo): 2.9.15-canary.8 by @anthonyshew in #12945
• docs: Correct attribute presence claims in turborepo-otel by @adityasingh2400 in #12932
• chore(turbo-codemod): Remove duplicate "in" in transforms path comment by @mvanhorn in #12948
• chore: Switch Geist font imports to npm geist package by @christopherkindl in #12952
• fix: Respect root gitignore during prune by @anthonyshew in #12953
• fix: Harden OTEL endpoint validation by @anthonyshew in #12954
• release(turborepo): 2.9.15 by @github-actions[bot] in #12955
• fix: Avoid hanging PTY shutdown by @anthonyshew in #12958
• fix: Retry npm tlog publish failures by @anthonyshew in #12959
• release(turborepo): 2.9.16-canary.1 by @anthonyshew in #12960
• fix: Preserve nested Bun dependency versions by @anthonyshew in #12963
• Revert "fix: Preserve nested Bun dependency versions" by @anthonyshew in #12964
• release(turborepo): 2.9.16-canary.2 by @github-actions[bot] in #12961
• fix: Preserve nested Bun dependency versions by @anthonyshew in #12965
• fix: Don't delete existing .git when using --no-git flag by @anthonyshew in #12968
• fix: Keep non-PTY stdin alive for persistent tasks by @anthonyshew in #12972
• release(turborepo): 2.9.16 by @github-actions[bot] in #12970
• release(turborepo): 2.9.17-canary.1 by @github-actions[bot] in #12973
• fix: Add auth HTTP timeouts by @anthonyshew in #12976
• fix: Detect affected root tasks in query by @anthonyshew in #12977
• fix: Wait for Windows graceful shutdown by @anthonyshew in #12979
• release(turborepo): 2.9.17-canary.2 by @github-actions[bot] in #12980
• test: Skip installs for JSON output fixtures by @anthonyshew in #12981
• feat: Add Rsbuild examples by @Nsttt in #12942
• test: Skip installs for single package dry runs by @anthonyshew in #12982
• test: Skip Corepack setup without installs by @anthonyshew in #12983
• test: Skip installs for metadata-only Rust tests by @anthonyshew in #12985
• test: Skip remaining unnecessary fixture installs by @anthonyshew in #12986
• test: Add final hash contract snapshots by @anthonyshew in #12984
• test: Trim run logging integration matrix by @anthonyshew in #12987
• test: Trim affected query integration matrix by @anthonyshew in #12988
• test: Narrow Windows integration test group by @anthonyshew in #12989
• test: Trim task dependency integration coverage by @anthonyshew in #12990
• test: Trim affected integration coverage by @anthonyshew in #12991
• test: Collapse integration test matrices by @anthonyshew in #12992
• test: Collapse non-watch integration matrices by @anthonyshew in #12993
• test: Collapse summary and caching test setup by @anthonyshew in #12994
• test: Trim lockfile-aware caching integration matrix by @anthonyshew in #12995
• test: Move inference, env, and otel coverage lower by @anthonyshew in #12996
• test: Trim turborepo-scm subprocess tests by @anthonyshew in #12998
• test: Remove Windows nextest thread cap by @anthonyshew in #12999
• test: Trim workspace config integration tests by @anthonyshew in #13000
• test: Trim run logging integration coverage by @anthonyshew in #13001
• test: Trim summary inference and single package tests by @anthonyshew in #13002
• test: Trim continue and persistent integration tests by @anthonyshew in #13004
• test: Trim force and workspace inheritance tests by @anthonyshew in #13005
• test: Trim SCM regression matrix by @anthonyshew in #13006
• test: Trim miscellaneous integration tests by @anthonyshew in #13007
• test: Trim affected and cache integration coverage by @anthonyshew in #13008
• refactor: Split engine builder modules by @anthonyshew in #13009
• refactor: Split process child module by @anthonyshew in #13014
• refactor: Split CLI module by @anthonyshew in #13013
• refactor: Split Bun lockfile module by @anthonyshew in #13012
• Fix typo in .gitignore comment by @saiteja-madha in #13010
• fix: Preserve Bun nested dependency versions by @anthonyshew in #13016
• docs: Exclude Next.js dev server output from cache examples by @anthonyshew in #13019
• release(turborepo): 2.9.17-canary.3 by @github-actions[bot] in #13017
• fix: Highlight active docs sidebar item by @anthonyshew in #13023
• fix: Ignore peer dependencies in package graph by @kitten in #13025
• release(turborepo): 2.9.17-canary.4 by @github-actions[bot] in #13032
• fix: Preserve pnpm override-resolved prune deps by @anthonyshew in #13031
• fix: Keep PTY stdin open for tasks by @anthonyshew in #13033
• fix: Add TUI pane padding before logs by @anthonyshew in #13034
• fix(api-client): Support P-521 ECDSA certificate chains over rustls by @anthonyshew in #13036
• chore: Restore aarch64 musl release builds by @anthonyshew in #13037
• release(turborepo): 2.9.17-canary.5 by @github-actions[bot] in #13038
• docs: Remove ESM warning from gen page by @anthonyshew in #13039
• fix: Bypass npm command shim on Windows by @anthonyshew in #13040
• feat: Add JIT task input hashing by @anthonyshew in #13043
• fix: Defer hashes for JIT task dependents by @anthonyshew in #13045
• release(turborepo): 2.9.17-canary.6 by @github-actions[bot] in #13044
• release(turborepo): 2.9.17-canary.7 by @github-actions[bot] in #13046
• fix: Send Ctrl+C to Windows PTY tasks by @anthonyshew in #13041
• release(turborepo): 2.9.17 by @github-actions[bot] in #13047
• ci: Fetch version.txt via API in docs alias failure notification by @anthonyshew in #13050
• fix: Harden cache archive symlink restore by @anthonyshew in #13051
• chore: Remove web UI mode by @anthonyshew in #13052
• fix: Harden query server file access by @anthonyshew in #13053
• fix: Confine prune patch paths by @anthonyshew in #13054
• fix: Prevent git argument injection in SCM refs by @anthonyshew in #13055
• fix: Strip special mode bits from cache restore by @anthonyshew in #13056
• fix: Contain incremental cache outputs by @anthonyshew in #13057
• fix(turborepo): Normalize Windows daemon path hash by @Balance8 in #13020
• fix: Preserve vt100 cell byte counts by @anthonyshew in #13058
• fix: Separate artifact signature fields by @anthonyshew in #13059
• fix: Validate OidHash hex buffers by @anthonyshew in #13060
• fix: Block self-hosted login URLs from attempting to use Vercel's SSO by @anthonyshew in #13061
• release(turborepo): 2.9.18 by @github-actions[bot] in #13062
• fix: Re-authenticate when stored token loses access to linked team by @anthonyshew in #13064
• release(turborepo): 2.9.19-canary.1 by @github-actions[bot] in #13065
• fix: Stop shim from killing local turbo on Windows Ctrl+C by @anthonyshew in #13067
• release(turborepo): 2.9.19-canary.2 by @github-actions[bot] in #13068
• ci: Add PR workflow timeouts by @anthonyshew in #13070
• fix: Deliver Ctrl-C to ConPTY children during graceful shutdown on Windows by @anthonyshew in #13069
• release(turborepo): 2.9.19-canary.3 by @github-actions[bot] in #13071
• fix: Use PTY for interactive Windows tasks by @anthonyshew in #13073
• fix: Filter pruned pnpm workspace patches by @anthonyshew in #13075
• fix: Cache outputs through internal symlinks by @anthonyshew in #13076
• fix: Avoid Windows PTY task output by @anthonyshew in #13077
• release(turborepo): 2.9.19-canary.4 by @github-actions[bot] in #13074
• release(turborepo): 2.9.19-canary.5 by @github-actions[bot] in #13079
• fix: Preserve PNPM deps check config by @anthonyshew in #13084
• fix: Speed up default create-turbo download by @anthonyshew in #13085
• fix: Preserve pnpm peer-resolved prune entries by @anthonyshew in #13086
• fix: Precompute unblocked JIT descendants by @anthonyshew in #13088
• fix: Use repo package manager for generate by @anthonyshew in #13089
• fix: Handle Windows package manager shutdown by @anthonyshew in #13090
• release(turborepo): 2.9.19-canary.6 by @github-actions[bot] in #13092
• fix: Prevent duplicate PTY graceful shutdown signals by @anthonyshew in #13093
• fix: Remove accidental shell commands example changes by @anthonyshew in #13094
• release(turborepo): 2.9.19-canary.7 by @github-actions[bot] in #13095
• fix: Refine graceful shutdown messaging by @anthonyshew in #13098
• fix: Gracefully stop nested PTY processes by @anthonyshew in #13100
• fix: Restore TUI force shutdown by @anthonyshew in #13102
• release(turborepo): 2.9.19-canary.8 by @github-actions[bot] in #13103
• fix: Upgrade tsdown in kitchen-sink api to fix dev script by @anthonyshew in #13105
• fix: Soften force shutdown message by @anthonyshew in #13104
• fix: Thread allow_no_package_manager to daemon and watcher by @kitten in #13091
• fix: Preserve bun patchedDependencies during prune by @anthonyshew in #13106
• fix: Ignore symlink cycles when caching outputs by @anthonyshew in #13107
• release(turborepo): 2.9.19-canary.9 by @github-actions[bot] in #13108
• fix: Preserve terminal settings for child PTYs by @anthonyshew in #13110
• fix: Upgrade esbuild to patched version by @anthonyshew in #13112
• fix(prune): Relocate stranded transitive deps when promoting npm workspace-nested packages by @anthonyshew in #13111
• Update Next.js version to 16.2.5 by @hack-313-ip in #13081
• fix: Add ComSpec and PATHEXT to default Windows env passthrough by @anthonyshew in #13114
• fix: Respect task inputs when stopping interruptible persistent tasks in watch by @anthonyshew in #13116
• docs: Fix stderr debugging guidance by @gwagjiug in #13122
• feat: Add deferred hashing for task inputs by @anthonyshew in #13125
• fix: Restart deferred hash consumers in watch by @anthonyshew in #13127
• chore: Update to Rust 1.96.0 by @ognevny in #12974
• fix: Improve watch graceful shutdown by @anthonyshew in #13128
• fix: Hash selected dependency outputs instead of tasks by @anthonyshew in #13129
• release(turborepo): 2.9.19-canary.10 by @github-actions[bot] in #13130

New Contributors

• @eastgold15 made their first contribution in #12414
• @JRoy made their first contribution in #12548
• @DependerKumarSoni made their first contribution in #6747
• @marc-vercel made their first contribution in #12595
• @cursor[bot] made their first contribution in #12600
• @markandrus made their first contribution in #12526
• @AndyBitz made their first contribution in #12646
• @Wartijn made their first contribution in #12643
• @mattjoll made their first contribution in #12655
• @dancrumb made their first contribution in #12799
• @gioboa made their first contribution in #12794
• @bjormgyg made their first contribution in #12829
• @adityasingh2400 made their first contribution in #12932
• @mvanhorn made their first contribution in #12948
• @christopherkindl made their first contribution in #12952
• @Nsttt made their first contribution in #12942
• @saiteja-madha made their first contribution in #13010
• @kitten made their first contribution in #13025
• @Balance8 made their first contribution in #13020
• @gwagjiug made their first contribution in #13122

Full Changelog: v2.9.0...v2.10.0