npm / turbo
turbo
What changed in turbo 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
19 breaking32 security7 deprecations80 new APIs and options33 performance88 behavior and defaults29 tooling253 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initturbo 2541 changes
Breaking changes 19
Managed setup refuses to run on Windows arm64 hosts, including when x64 turbo runs under emulation.
The fallback now rejects local sources that are not workspace members.
Empty tokens are rejected when reading token files.
Go tasks now follow Go's default binary output paths.
Incremental task caching is removed.
Unsupported Cargo local packages are rejected.
Cargo workspace packages must declare a name.
Output paths that traverse directories are rejected.
Web UI mode is removed.
Rejects OTEL endpoints that contain userinfo.
Unix parent death watchdogs were removed, changing how Turbo processes respond to the death of their parent process.
Using --filter with filterUsingTasks no longer pulls dependents into the task graph.
The configuration uses object maps rather than arrays.
Platform binaries are published under @turbo/ scoped packages.
The root package.json is no longer treated as a global trigger for --affected.
turbo run no longer uses the daemon; daemon flags and configuration are deprecated.
The daemon is removed from turbo run, changing how the command executes.
Removes the abandoned turbo clone command.
Turbo now validates that the version in a lockfile is a semver string.
Security 32
Prevents cache restoration from writing to Git metadata and rejects Windows prefixed paths during restore.
Complete on-disk artifacts are signed after local cache writes.
Hardens cache archive symlink restoration and strips special mode bits from restored files.
Validates proxy Host headers and filters proxy environments.
Rejects OpenTelemetry endpoints with userinfo and prevents token injection to spoofed origins.
Cache archive symlink restoration is hardened.
Contains incremental cache outputs to prevent them from escaping their intended location.
Prune patch paths are confined.
Hardens file access by the query server.
Prevents git argument injection through SCM refs.
Prevents self-hosted login URLs from attempting to use Vercel SSO.
Hardens cache archive reads and restore writes against symlink attacks and path races.
OpenTelemetry endpoint validation was hardened.
Turbo: Login callback CSRF/session fixation
Turbo: Unexpected local code execution during Yarn Berry detection
Hardened VS Code extension command execution to address command injection.
Hardens daemon IPC endpoints.
Escapes HTML payloads in graphs.
Authenticates the local devtools WebSocket.
Validates the Host header used by the microfrontend proxy.
Prevents OTEL tokens from being injected to spoofed origins.
Validates Host headers used by proxies.
Redacts environment values from task hash debug logs.
Restricts Vercel token reuse to trusted API origins.
Resolves security vulnerabilities in rustls-webpki.
Resolves security vulnerabilities in tar.
This future flag enforces a minimum HMAC key length.
Sanitizes git command inputs in create-turbo.
Restricts credential file permissions to owner-only.
Path validation in assertSafeGitArgument was enhanced, improving the codemod's handling of Git arguments.
Upgraded h2 to fix CONTINUATION Flood.
A command injection vulnerability in turbo-ignore was fixed.
Deprecations 7
The --scope flag for turbo prune is deprecated.
The turbo scan command is deprecated.
Deprecates turbo-ignore in favor of
turbo query affected.The deprecation notice is tailored for Vercel users.
Graphviz-dependent graph formats are deprecated, and native SVG rendering is added.
The --parallel flag is deprecated.
Deprecates the --scope flag.
New APIs and options 80
Setup now allows native package manager configuration.
Adds an uninstall mode; the installer no longer automatically installs the Unix shell hook.
Adds shell-hook support for activating managed tools in bash, zsh, fish, and PowerShell, and exporting managed runtime variables.
Adds a command surface for running commands with the managed environment.
Adds managed setup for resolving, locking, installing, and activating repository toolchains and dependencies, including JavaScript package managers, Go, Rust, Python, and additional tools.
Supports setup without lock writes, records trusted setup roots for no-lock installs, and activates and hashes no-lock selections during plain turbo run.
Adds controls for skipping dependency lifecycle scripts through repository policy and the CLI.
Allows setup downloads to use credential-free mirror overrides, with mirrors configurable in the root setup policy.
Adds root-only setup policy configuration for declaring repository tools and applying setup policy.
An experimental future flag for setup was added.
An experimental setup command surface can create and reconcile local setup locks, resolve and install managed Node.js and package-manager tools, and check, refresh, or force-reinstall locked tools.
Tasks can now have tags, with configuration inheritance.
The CLI can now filter tasks by tags.
Query results now expose task and package tags.
Query can now filter tasks and packages by tags.
Adds standalone installer URLs for curl-pipe-bash installation.
The package adds affected query APIs.
Turborepo adds experimental native Go workspace support, including workspace graphs, task tables, input and output contracts, external resolution fingerprints, toolchain environment fingerprints, change observations, and prune planning.
Framework inference now supports Remix and the NUXT_ENV_* wildcard.
Static repository discovery and safe affected candidates are exposed.
turbo query now exposes compact task planning.
Cargo root packages are supported, allowing Turborepo to include root-level Cargo packages in its workspace handling.
Adds an experimental foundation for Go workspace graphs.
Adds a NUXT_ENV_* wildcard for environment variable inference.
Turborepo now detects package-level turbo.jsonc files.
Adds Remix framework inference.
Workspace.find adds skipPackageGraph, allowing callers to skip package graph construction.
Affectedness calculations can span different toolchains.
Turborepo supports nub.lock files.
Remote base refs can be resolved in GitHub Actions behind a future flag.
Adds selection of runnable task entrypoints.
Turborepo supports repositories containing only Cargo projects.
The Remote Cache can serve as an sccache backend for Cargo tasks, with sccache embedded so no separate installation is needed.
Adds the no-op experimentalCargoWorkspaces future flag.
turbo query exposes resolved experimentalCI task configuration.
Adds nub to the package manager options available in create-turbo.
Users can toggle between the TUI and streamed logs.
Adds a --production flag to turbo prune.
Turborepo recognizes package manager declarations in devEngines.packageManager, including declarations in workspaces.
Adds circular package dependency detection to boundaries.
Adds JIT task input hashing and deferred hashing for task inputs, allowing hashes to be computed later in task execution.
Adds JIT task input hashing.
Supports P-521 ECDSA certificate chains over rustls.
Adds heap allocation profiling for investigating memory use.
Adds incremental task caching.
Adds cacheMaxAge to configure local cache eviction based on age.
Adds cacheMaxSize to configure local cache eviction based on size.
The turbo.json task configuration accepts the experimentalCI key.
Adds experimentalObservability with an OpenTelemetry backend.
FORCE_COLOR and NO_COLOR are included in the built-in passthrough environment variables.
Prune can include globalDependencies behind a future flag.
Experimental structured logging is available with --json and --log-file.
Experimental structured logging is available with --log-file and --json.
The global configuration key can be included in prune behind futureFlags.globalConfiguration.
A global configuration key is added behind futureFlags.globalConfiguration.
Adds a flag for experimental structured logging.
Adds a flag for experimental structured logging.
Adds a NAPI binding that exposes packages from a lockfile.
The command uses query internals, and turbo query ls is added as a shorthand.
This future flag enables task-level resolution for --filter.
Pruning can include
globalDependenciesbehind a future flag.A CLI shorthand is available for the affected query.
Adds a future flag for task-level --affected detection using task inputs.
A new query detects changes at the task level.
Adds telemetry for detecting AI coding agents.
Adds FORCE_COLOR to the builtin passthrough environment variables.
This OTel metrics configuration controls cardinality.
Adds experimental OpenTelemetry observability configuration using object maps rather than arrays.
The turbo.json schema now permits comments and trailing commas.
An agent skill was added to Turbo.
Task definitions can include an optional description field.
Adds the errorsOnlyShowHash future flag.
Adds a docs subcommand for searching documentation.
Turbo adds support for Git worktrees.
Provides a query for external dependencies.
Root-level microfrontends.json configuration is allowed for @vercel/microfrontends.
Tasks can use an extends field in turbo.json.
Adds microfrontends support, including configuration through microfrontends.json.
Adds support for custom microfrontends.json naming.
Lets users search the TUI task list by pressing /.
Performance 33
The dry-run HEAD fallback is parallelized.
Nested .gitignore discovery now skips ignored directories.
Avoids formatting Bun lockfiles during parsing.
Parses character classes without compiling a regex.
Serves a static GraphiQL page.
Reduces TUI allocations by upgrading Ratatui.
Reduces CLI size by upgrading serde_json.
Cache analytics are sent in larger batches.
Dry-run remote cache existence checks are batched.
Reuses the parsed lockfile during lazy graph loading.
Remote-cache transfers now bound memory use instead of retaining whole artifacts.
Memory usage is bounded while task output is streamed.
Turborepo skips unused Package Configuration stat calls, reducing unnecessary filesystem work.
Same-prefix tree-wildcard globs are merged into one directory walk.
Native uv tool tasks are cached.
Pruning walks the repository once, improving the pruning process.
Simple include globs are evaluated without wax compilation, improving their evaluation performance.
Reduces hash memory spikes while running watch.
Boundaries checking is parallelized with Rayon, and DFS traversals are cached.
Increases remote cache upload chunk size from 8KB to 256KB.
Skips irrelevant packages when using package#task syntax, improving task selection performance.
Streams file contents during hashing and reduces allocations in file hash computation to lower memory usage.
Replaces SWC with oxc for JavaScript and TypeScript parsing.
Optimizes the npm lockfile parser.
Eliminates per-directory stat system calls during untracked file detection.
The hot path is optimized through parallelization and reduced allocations.
Replaces twox-hash with xxhash-rust and optimizes file hashing.
Batches per-package git subprocess calls into a repo-wide index.
Reduces allocations in globwalk.
Optimizes hot-path hash computation by avoiding clones and using unstable sorts.
Replaces O(V³) Floyd-Warshall with O(V+E) DFS in watch mode subgraph creation.
Finding tasks impacted by packages is faster.
Makes an ESLint rule approximately 8.6 times faster.
Behavior and default changes 88
Activates managed tools and resolves native task commands through managed binaries during task execution.
The check mode activates locked Go and checks its readiness; setup plans and checks also report locked dependency actions.
Agent guidance is disabled by default.
Artifact requests are coordinated after rate limiting.
Remote caching is disabled after unrecoverable forbidden responses.
The version is included in JSON output instead of appearing in a separate banner.
Cargo and uv affectedness can now be inferred from static package inputs.
Go workspace packages now receive derived short names.
Native tasks are now shown in task listings.
Package queries and pruning now account for tasks.
Rust builds are more stable on macOS.
Raw output retention is bounded independently of scrollback.
experimentalCI is now included in task hashes, so changes to this setting affect cache keys.
LOCALAPPDATA is now passed through by default.
Next.js framework inference now recognizes NEXT_DEPLOYMENT_ID.
Turborepo uses uv workspace metadata when working with uv projects.
Affected queries now include virtual tasks.
Dry-run JSON output is streamed, improving how the command produces its output.
The EXPERIMENTAL label moves from the ls command to the --output flag.
Dependencies for aggregate native tasks are composed, and aggregate task overrides are respected.
Unresolved Cargo artifacts are no longer cached.
Cargo cache is isolated by host platform, requires current lockfiles for caching, and hashes Cargo build environment inputs.
Cargo run tasks are no longer cached.
Outputs outside package roots are allowed.
Turborepo parses and validates the task command field and can resolve and execute command overrides.
Toolchain tasks appear in the TUI and are not run in silence.
Turbo discovers Cargo crates as packages in a workspace.
Turbo hashes Cargo external dependencies per crate.
turbo prune becomes Cargo-aware.
turbo watch becomes Cargo-aware.
Turborepo accepts Bun lockfile version 2.
TUI selection is automatically copied to the clipboard when the mouse is released.
Tasks can be selected by clicking rows in the TUI task list.
Adds graceful shutdown and preserves exit codes and PTY semantics while keeping the Node wrapper alive during shutdown.
Adds HTTP timeouts for auth requests.
Defers hashes for JIT task dependents.
LSP diagnostics now allow transit nodes.
Graceful shutdown now preserves exit codes and PTY semantics, keeps the Node wrapper alive, and ignores SIGINT in the shim after spawning local turbo.
Vercel authentication moves to standard OAuth/device flows while retaining legacy compatibility and recovering tokens across login flows.
The fast webpki-only HTTP client now loads custom CA certificates.
Boundaries checking now detects circular package dependencies.
Scaffolded README files now use replacement package manager commands.
Telemetry alerts are suppressed when running on Vercel.
Allows --affected and --filter to be combined when selecting tasks.
Nested OTEL configuration is deep-merged across priority sources.
Preflight handling now treats * as a wildcard in Access-Control-Allow-Headers.
The filename is now optional for --profile and --anon-profile.
Pruning supports pnpm per-workspace lockfiles.
Watch mode no longer uses the daemon.
NixOS environment variables are added to the default passthroughs.
Git SHA and dirty hash are sent to the remote cache.
The run summary is shown after the TUI exits.
The query command is promoted from experimental to stable.
Watch is supported in single-package workspaces.
The Node.js shim now supports legacy unscoped binary package names.
Cache metadata now includes the Git SHA and dirty hash.
Uninstalled package managers are now sorted to the bottom of the package manager selection.
Cyclic package graphs are allowed; validation is performed only at the task graph level.
The run prelude displays richer remote cache status.
The Run Summary now surfaces cache SCM metadata.
Workspace copying now supports private GitHub repositories.
TURBO_* environment variables are passed through to child processes in Strict Mode.
Includes the Node.js version in the command output.
Watch uses the task graph.
Treats Bun runtime modules as builtins when checking boundaries.
Includes version, platform, and CPU count in Chrome trace profiles.
Adds NO_COLOR to the builtin passthrough environment variables.
OTel metrics export uses delta temporality.
Telemetry and analytics HTTP flushes are fire-and-forget during shutdown.
Single-package mode also checks devDependencies when inferring the framework.
OTel metrics are sent without requiring the --summarize flag.
The filename is now optional.
Profile trace output now includes LLM-friendly Markdown.
The filename is now optional.
The docs markdown endpoint now includes the Vary: Accept header, affecting how responses are cached based on the Accept header.
Microfrontends JSONC files now support trailing commas.
Turbo version validation now uses the lockfile for all package managers.
Removes the requirement for a root app package to support polyrepos.
Wildcards now exclude framework-inferred environment variables.
Packages are now allowed to import themselves.
Tasks are composed when turbo.json files are composed.
Task restarts in watch mode are fine-grained and interruptible.
A GitHub Actions environment variable is now included in the default passthrough.
A Windows-specific environment variable is added to the default passthroughs.
The selected task highlight uses reverse video to improve accessibility.
Padding is added to task names and icons in the TUI.
Some Linux variables are added to the default passthrough environment variables.
The icon is moved to the left side in the terminal user interface.
Tooling 29
Installs locked JavaScript dependencies in frozen or immutable modes, including npm, pnpm, Yarn, and Bun.
Supports offline setup from verified cached artifacts and reuses trusted installations and verified downloads.
Adds managed tool provisioning and activation on native Windows x64 for Node, pnpm, Go, Rust, Python, uv, Bun, and Yarn.
Records locked tool selections and artifacts for setup, including Go, Rust, Yarn, and Bun; setup can create or refresh these selections.
The npm package now bundles documentation, making the docs available in the package.
Turborepo discovers Cargo crates as packages, executes Cargo crate tasks, and derives task inputs, outputs, and per-crate external dependency hashes.
Turborepo recognizes nub as a package manager, supports its native lockfiles, and adds it to create-turbo options.
Turborepo now supports pnpm 6 single-package lockfiles.
Turborepo adds support for Python virtual environments.
Turborepo can discover pytest tasks.
Turborepo parses Python quality tool declarations, resolves and synthesizes tasks, and hashes their inputs.
Turborepo adds support for running on Android through Termux.
Turborepo adds a native format task for Cargo projects.
Turborepo can discover uv workspaces, run native uv tasks, hash lockfile closures, watch workspace changes, and prune workspaces.
Turborepo can infer tasks for Cargo workspaces.
Adds verification tasks scoped to individual Cargo crates.
Run summaries report incremental cache reuse.
Turbo executes Cargo crate tasks via Cargo.
Turbo derives input and output globs for Cargo tasks.
Turborepo adds package manager support for aube.
Adds a sandbox helper, with fixes for npm registry access, stale bases, dotfile installation during base refresh, and sandbox startup.
Turbo surfaces an actionable message when remote cache is requested but not linked, helping developers resolve the configuration issue.
The concurrency error message now mentions turbo.json, helping developers identify where to configure concurrency.
The migration codemod now handles package manager catalogs.
The post-hashing setup phase is instrumented for trace visibility.
A new transformer is available in @turbo/codemod to update versioned schema JSON.
Turborepo adds support for Yarn 4 catalogs.
The microfrontends port command is cross-platform.
Introduces a new OAuth flow for the Turborepo CLI with Vercel.
Fixes and other changes 253
Attributes lockfile changes to the crates whose dependencies changed.
Fixes parsing JSX in JavaScript files.
Preserves task output after tasks exit with a non-zero status.
Activates managed tools when running turbo watch.
The codemod no longer generates duplicate package names.
Task graphs are now populated for affected and filtered listings.
Automatic Turbo downloads now use the repository's package manager.
Cargo lint task hashing now includes Clippy configuration.
Dry runs now report inferred framework environment variables for deferred tasks.
Go discovery remains stable when a repository is reached through a symlink.
Pruned workspaces now support npm patches.
Pruning now preserves unknown pnpm lockfile settings and removes unused catalog snapshots.
Optional npm peers are now excluded from pruned lockfiles.
uv tool configuration is now carried into pruned workspaces.
Vercel OIDC token rotation is ignored in .env.local cache inputs.
SDKROOT is passed through to repository tasks.
Production MFE negative lookaheads now match locally.
Query commands now infer single-package mode.
Standalone turbo is upgraded when the installer is rerun.
Task inputs are normalized consistently for affected detection and hashing.
Prune now keeps Yarn patch resolutions that use npm protocol selectors.
Query metadata is completed for non-script entrypoints.
Adds path context to globwatch errors.
Resolves LSP task references with a JSONC AST.
Reports source paths for package manager errors.
Stabilizes pnpm per-workspace lockfile hashes.
Formats pnpm v5 package names correctly.
Remote artifact requests back off during outages, avoiding repeated requests while the remote service is unavailable.
Validates glob bases in scope selectors.
Restores log streaming in the TUI after the Ratatui upgrade.
Waits for watcher setup to complete.
Affected detection now respects negated global dependencies.
Only secondary go.work files that Go reads for workspace members are rejected.
Concurrent remote-cache token recovery is shared.
Normalizes input globs used to determine affected tasks.
Root internal dependency changes are treated as global changes when determining affected tasks.
Gitignored files are ignored when checking boundaries.
Avoids microfrontend polyrepo warnings.
Stops tasks when their parent exits.
Stabilizes the order of boundary tags in prune output.
Repeatable CLI flags are restored, so developers can pass the same flag multiple times again.
esbuild builds are now allowed for pnpm generators.
Invalid affected-task globs are shown to the user.
Affected-task queries include virtual tasks and compose correctly with package filters.
Pruning preserves Bun overrides, trusted dependencies, workspace bins, and git integrity, and accepts lockfile version 3.
Manual hashing applies nested parent gitignore patterns and respects gitignore rules even without Git metadata.
Affectedness from uv lockfile changes is scoped appropriately.
Leading flags are again accepted for implicit run commands.
Berry lockfile identifiers are parsed with hand-written parsers instead of regex captures.
Berry lockfile resolution overrides are indexed by dependency name.
Turborepo now respects gitignore rules even when git metadata is absent.
Turborepo now tolerates transient input files.
Manual hashing now applies nested parent gitignore patterns.
Bun pruning preserves overrides objects, trustedDependencies, workspace bins, and git integrity, and accepts lockfileVersion 3.
Affected tasks are now composed with package filters.
Prunes Bun wildcard workspace development dependencies.
Invalidates only when Git ignore sources change.
File watching falls back to polling on macOS.
The TUI task list can now be scrolled with the mouse wheel.
Supports multiple file watch roots on macOS.
Preserves pnpm root dependencies during pruning.
Preserves pnpm aliased dependencies during pruning.
JIT inputs are matched for affected tasks.
Dynamic imports are checked in boundaries.
Cargo profile outputs are resolved exactly.
Cargo target output layouts are resolved.
Git failures are surfaced by create-turbo.
Pruning preserves pnpm node@runtime: lockfile entries.
Shutdown signals are retained when force exiting.
Colors are preserved in TUI output.
Pruning a Bun production workspace excludes development dependencies.
The turbo watch behavior is refactored.
Pruning preserves the Yarn Babel extension.
Project Yarn package extensions are preserved.
Pruning removes extraneous entries from bun.lock.
npm prune rehoisting is made deterministic and complete.
Pruning preserves pnpm patches that use version range keys.
Fixes make the compile cache actually cache, avoid ambient CARGO_INCREMENTAL suppressing cache injection, and prevent storage failures from failing builds.
Task inputs preserve watch rerun semantics.
Pruning preserves Yarn package extension ranges.
Relative imports resolving into node_modules are no longer flagged.
Ancestor-scoped Bun dependencies remain resolvable after prune renames.
Input exclusion globs are now applied during the filesystem walk.
Resolves Bun scoped package dependencies that share a name with a dependency.
The version field accepts semver ranges.
Reports malformed JSON parse errors instead of panicking.
Skips node_modules in boundaries checks.
Adds support for nub native lockfiles.
Normalizes the displayed package manager version.
Normalizes package manager versions.
Uses the singular form “workspace” in package resolution errors.
Improves error messaging when a platform binary is missing.
Adds recovery guidance for token exchange errors.
Hardens terminal restoration during TUI shutdown.
Recovers from slow initial hashing instead of timing out.
Avoids following nested symlinked cache outputs.
Preserves three-level nested Bun lockfile entries during pruning.
Turborepo supports Corepack packageManager integrity hashes, fixing package manager detection for configurations that include them.
XDG_DATA_* environment variables are included in the environment variables passed through by Turborepo.
Re-authenticates when a stored token loses access to its linked team.
Adds support for pnpm v11 multi-document lockfiles.
Fixes lockfile and workspace pruning across Bun, npm, pnpm, Yarn, and package.json workspaces, including preservation of install strategies and per-workspace lockfiles.
Respects the root gitignore during pruning and preserves package-manager dependency, patch, and override information in pruned workspaces.
Affected queries now respect SCM environment variables and include packages changed through lockfiles.
Keeps non-PTY stdin alive for persistent tasks and uses a PTY for interactive Windows tasks.
The watch loop restarts interruptible persistent tasks after file changes and avoids rerunning non-cacheable watch dependencies.
Special mode bits are stripped during cache restore.
The daemon path hash is normalized on Windows.
Bypasses the npm command shim on Windows.
Ignores peer dependencies when constructing the package graph.
Keeps non-PTY stdin alive for persistent tasks.
Preserves pnpm override-resolved dependencies during pruning.
Keeps PTY stdin open for tasks.
Detects affected root tasks in query results.
Waits for graceful shutdown on Windows.
Sends Ctrl+C to Windows PTY tasks.
Preserves nested dependency versions for Bun.
No longer deletes an existing
.gitdirectory when used.Avoids hanging during PTY shutdown.
Packages changed in the lockfile are now included when determining affected tasks.
Berry lockfile errors are returned instead of causing a panic.
Bun alias child packages and nested workspace dependency versions are preserved.
Accepts
experimentalCIas an object configuration.Pruning now correctly handles package.json workspaces.
pnpm injected peer package entries are now preserved.
Turborepo waits for process trees before task completion and prevents Windows process drain hangs.
Pruning now respects the root gitignore.
Restores task completion semantics.
The language server now prefers an installed Turbo.
LSP diagnostics now allow $TURBO_EXTENDS$.
The VS Code extension now resolves relative turbo paths correctly.
Pruning now preserves nested Bun dependencies.
The extension starts the daemon itself, reducing setup friction for developers using the extension.
The extension now supports turbo.jsonc configuration files.
The extension now supports shimmed VS Code LSP probes.
Enforces filesystem boundaries for the cache.
Handles errors from clipboard exec operations.
Preserves FSEvents mount points for device-relative paths.
Retries requests that fail with HTTP status errors.
Filters environments passed through the microfrontend proxy.
Uses a random temporary path for repository downloads.
Respects SCM environment variables when determining affected packages.
Resolves TypeScript
.jsextension imports to.tsfiles in boundaries.Keeps workspace configuration discovery inside the repository root.
Dry-run conversion now preserves lockfiles.
Repo index prefixes are scoped to the Git root.
Preserves concrete dependency precedence.
Keeps shell connections stable.
Creates bin stubs for Docker prune output.
Preserves Bun prune lockfile validity.
Resolves affected packages when using Yarn catalogs.
Filter selectors now support two-dot Git ranges.
Turbo supports pnpm v11 multi-document and flat patch lockfiles.
Prune no longer overmatches gitignore entries.
Non-cacheable watch dependencies are no longer rerun.
Bun workspace lockfile pruning no longer produces invalid output.
Engine concurrency is validated after task-level filtering.
Microfrontend proxy tasks are retained when using filterUsingTasks.
Migration codemods update the schema URL to a versioned format and preserve prerelease information.
Signature key length is enforced only for keys that exist.
Task input hashing now respects dirty .gitignore patterns.
Codemod transforms now support turbo.jsonc configuration files.
pnpm pruning now preserves per-workspace lockfiles.
turbo prune now preserves npm's shallow install strategy during lockfile pruning.
turbo prune now backfills missing pnpm workspace importer entries.
Engine graph pruning for affected paths now includes transitive dependencies when using the Task Graph.
Interruptible persistent tasks restart on file changes instead of leaving the watch loop blocked.
Keeps stdin alive for persistent tasks in stream mode.
Pruning preserves file: and link: protocol entries in Bun lockfiles.
Pruning retains injected workspace package entries in pnpm lockfiles.
Fixes incorrect git root resolution in linked worktrees by resolving to the worktree root.
Dry-run cache status now matches normal runs by checking caching guards.
Unix domain sockets and other special files are skipped during file hashing.
The eslint-plugin-turbo task-definition iteration now guards against missing tasks or pipeline.
Fixes missing dependencies after npm lockfile parsing.
Lockfile parsing now preserves dedupePeers and unknown pnpm settings.
Avoids setsid() during PTY spawn to prevent macOS Gatekeeper CPU spikes.
Generator name conflicts across workspaces are resolved.
Fixes a hang with mixed interruptible persistent tasks.
Prevents a panic with persistent tasks.
Prevents stdin from being dropped for persistent tasks in stream mode.
Local binary resolution now detects scoped @turbo/{platform} packages.
The codemod no longer silently renames existing packages.
Affected task query results no longer include phantom tasks.
Affected task detection now handles
$TURBO_ROOT$inputs when this option is used.Pruning with pnpm patches now preserves package.json key order.
Task arguments are now always included in filtered packages.
Affected detection no longer matches unrelated root files.
Inlining PlopTypes fixes implicit any for consumers.
Pruning preserves all Bun lockfile overrides.
Validates task names when --affected produces an empty package scope.
Aligns query affectedTasks behavior with run --affected for $TURBO_ROOT$ inputs.
Fixes root-level tasks not executing when using //# CLI syntax.
Improves the connectivity check and offline error messages, and removes a redundant online check.
Resolves package-name-shaped path aliases in tsconfig paths.
Initializes the TUI terminal even when all tasks hit cache.
Nested Bun lockfile entries are promoted when a hoisted version is pruned.
The clean-globs codemod now guards against a missing pipeline key.
The errors-only setting is now honored for non-cached tasks.
Resolves pnpm catalog: specifiers to workspace dependencies in the task graph.
Waits for dependsOn on the first run and no longer uses the daemon in watch mode.
Ensures the noUpdateNotifier setting in turbo.json is respected.
Preserves deeply nested workspace dependencies during npm lockfile pruning.
On its first run, turbo watch waits for dependsOn tasks to complete.
Corrects dependency iteration order so dependencies takes precedence over devDependencies.
Filters orphaned Yarn packageExtensions entries during lockfile pruning.
Merges with into the root configuration instead of replacing it.
The command no longer hangs when daemon file watching fails.
Fixes pruning for pnpm per-workspace lockfiles, Berry patch overrides, injected pnpm workspace packages, and file: or link: protocol entries in Yarn v1 and Bun lockfiles.
Excludes peer dependencies from workspace external dependency resolution and treats npm: alias dependencies as external rather than workspace references.
turbo prune now resolves correct nested Bun lockfile versions.
peerDependencies no longer overwrite concrete dependency specifiers.
Restores the daemon client in RunCache for turbo watch.
Moves node-plop to dependencies so PlopTypes resolves for consumers.
Avoided a panic in sandboxed environments by removing the system-configuration dependency.
Orphaned Windows child processes are cleaned up on shutdown.
Fixed a hang in the Windows TUI caused by portable-pty 0.9.0 ConPTY changes.
Keeps stdin alive for persistent tasks in stream mode.
Normalizes bare LF to CRLF to prevent garbled logs.
turbo boundaries now handles subpath package imports.
Emits a space for empty vt100 cells to fix TUI repainting when switching tasks.
A directory filter no longer causes Turbo to inject a package name.
Enables mouse capture for all terminals to restore scroll functionality.
Improves behavior for tasks killed due to out-of-memory conditions.
Makes package inference deterministic for subdirectory filters.
Using the bun package manager no longer causes create-turbo to hang.
File watching now works for non-root volumes on macOS.
Mouse mode is properly disabled when the TUI exits or panics.
The pnpm turbo script no longer enters an infinite loop.
Text selection works correctly when the TUI sidebar is hidden.
Workspace globs with a leading ./ are normalized.
Bun support now includes GitHub and Git packages.
The TUI is now shown when using --output-logs=errors-only or --output-logs=none.
Loader UI states in create-turbo were fixed.
Transit nodes in Devtools were fixed.
The TUI no longer flashes on a >>> FULL TURBO.
Fixes overly aggressive path checking during microfrontends loading.
Correctly validates the workspace root as a package.
Exit codes are preserved in notifyUpdate functions.
Quoting in turbo-ignore commands is fixed.
A crash during column wrapping in the vt100 TUI was prevented.
Relative paths are resolved before validation, so valid relative values are handled correctly.
Git commands use the
-zoption to handle Unicode file paths.The
execacall uses theshelloption on Windows.Boundary analysis now parses import attributes.
Graceful shutdown behavior is more deterministic.
Bun lockfile pruning better matches the real Bun lockfile format, handles patchedDependencies, includes bunfig.toml among copied files, and improves version resolution.
Adds Linux environment variables to global passthroughs.
Exporting a graph to a .dot file no longer requires Graphviz to be installed.
Fixes the binary call used by the microfrontends proxy on Windows.
Fixes recursive transitive closure analysis in the npm lockfile parser.
Fixes handling of injectWorkspacePackages when pruning with pnpm.
Fixes a symlinking bug on Windows.