Skip to content

🚨 [security] Update turbo 2.9.6 → 2.9.14 (patch)#20066

Closed
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/pnpm/turbo-2.9.14
Closed

🚨 [security] Update turbo 2.9.6 → 2.9.14 (patch)#20066
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/pnpm/turbo-2.9.14

Conversation

@depfu
Copy link
Copy Markdown
Contributor

@depfu depfu Bot commented May 16, 2026 •
edited
Loading

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ turbo (2.9.6 → 2.9.14) · Repo · Changelog

Security Advisories 🚨

🚨 Turbo: Unexpected local code execution during Yarn Berry detection

Impact

Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed yarn --version from the project directory, which could cause Yarn to load and execute a project-controlled yarnPath from .yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affected turbo, @turbo/codemod, or @turbo/workspace conversion commands.

Fix

Turbo now avoids executing project-local Yarn during package manager detection. Yarn versions and paths are inferred from metadata such as package.json, parsing the value of yarnPath in .yarnrc.yml rather than executing it, and yarn.lock, and unrecognized Yarn lockfile formats are rejected instead of falling back to executing yarn.

Workarounds

If you cannot upgrade immediately, do not run Turborepo commands in untrusted repositories. Review or remove .yarnrc.yml files that define yarnPath before running Turborepo, especially in CI or automated tooling that processes external projects.

🚨 Trubo: Login callback CSRF/session fixation

Impact

Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitimate callback, the CLI could complete login with the wrong credentials.

This affects users authenticating the turbo CLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not affected.

Fix

The login and SSO redirect flows now generate a random state value, include it in the browser authentication URL, and require the same value on the localhost callback before accepting a token. Callbacks with a missing or mismatched state are rejected.

Workarounds

If you cannot upgrade immediately, avoid browser-based self-hosted turbo login or SSO flows on machines that may load untrusted web content during authentication. Use a pre-provisioned token or environment-based authentication instead.

Release Notes

2.9.14

Note

This release contains important security fixes.

High:

Low:

What's Changed

Changelog

New Contributors

Full Changelog: v2.9.12...v2.9.14

2.9.12

What's Changed

Changelog

  • release(turborepo): 2.9.11 by @github-actions[bot] in #12771
  • fix: Allow transit nodes in LSP diagnostics by @anthonyshew in #12773

Full Changelog: v2.9.11...v2.9.12

2.9.11

What's Changed

Changelog

Full Changelog: v2.9.10...v2.9.11

2.9.10

What's Changed

Changelog

Full Changelog: v2.9.9...v2.9.10

2.9.9

What's Changed

Changelog

New Contributors

Full Changelog: v2.9.8...v2.9.9

2.9.8

What's Changed

@turbo/repository

Changelog

  • release(turborepo): 2.9.7 by @github-actions[bot] in #12679
  • test: Add regression for gitignored output restore by @anthonyshew in #12681
  • docs: Clarify root task guidance by @anthonyshew in #12683
  • fix: Preserve concrete dependency precedence by @anthonyshew in #12682
  • release(turborepo): 2.9.8-canary.1 by @github-actions[bot] in #12685
  • fix: Resolve Yarn catalog affected packages by @anthonyshew in #12684
  • release(turborepo): 2.9.8-canary.2 by @github-actions[bot] in #12687
  • fix: Preserve Bun prune lockfile validity by @anthonyshew in #12686
  • release(turborepo): 2.9.8-canary.3 by @github-actions[bot] in #12689
  • fix: Create prune docker bin stubs by @anthonyshew in #12688
  • release(turborepo): 2.9.8-canary.4 by @github-actions[bot] in #12690
  • fix: Keep tbx shell connections stable by @anthonyshew in #12692
  • perf: Reduce turbo watch hash memory spikes by @anthonyshew in #12695
  • release(turborepo): 2.9.8-canary.5 by @github-actions[bot] in #12696
  • fix: Reduce parent-death watchdog CPU usage by @anthonyshew in #12697
  • release(turborepo): 2.9.8-canary.6 by @github-actions[bot] in #12698

Full Changelog: v2.9.7...v2.9.8

2.9.7

What's Changed

eslint

  • chore: Upgrade dependencies to resolve their known vulnerabilities by @anthonyshew in #12604

Examples

Changelog

New Contributors

Full Changelog: v2.9.6...v2.9.7

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu Bot requested a review from a team as a code owner May 16, 2026 13:40
@depfu depfu Bot added the depfu label May 16, 2026
@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented May 16, 2026

Confidence Score: 5/5

Safe to merge — this is a clean, mechanical version bump with no logic changes.

The only changes are version strings and integrity hashes in package.json and pnpm-lock.yaml. All six platform binaries are updated in lockstep, the lockfile is consistent, and the update brings in important security patches without touching any application code.

No files require special attention.

Reviews (1): Last reviewed commit: "Update turbo to version 2.9.14" | Re-trigger Greptile

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 16, 2026 •
edited
Loading

Review Change Stack

Walkthrough

This pull request updates the turbo development dependency in package.json from version ^2.9.6 to ^2.9.14. This is a minor version bump within the 2.9.x release series that brings in recent updates and fixes to the turbo build tool used by the project's development environment.

🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly identifies the dependency update from turbo 2.9.6 to 2.9.14 and emphasizes it as a security patch, directly matching the main change in the PR.
Description check ✅ Passed The pull request description clearly relates to the changeset, describing a dependency update from turbo 2.9.6 to 2.9.14 with details about security vulnerabilities, release notes, and changes.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Comment @coderabbitai help to get the list of available commands and usage tips.

@depfu
Copy link
Copy Markdown
Contributor Author

depfu Bot commented May 16, 2026

Sorry, but the merge failed with:

At least 1 approving review is required by reviewers with write access.

@depfu depfu Bot changed the title Update turbo 2.9.6 → 2.9.14 (patch) 🚨 [security] Update turbo 2.9.6 → 2.9.14 (patch) May 19, 2026
@RobinMalfait RobinMalfait mentioned this pull request May 21, 2026
Merged
@depfu depfu Bot deleted the depfu/update/pnpm/turbo-2.9.14 branch May 21, 2026 15:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants