Starstruk Logo MarkStarstruk

v2.9.18

Significant-Gravitas/AutoGPTv2.9.18Jun 10, 2026by github-actions[bot]

AI Summary

This Turborepo release focuses on security hardening and CI/CD improvements, including the removal of the web UI mode. It addresses file access permissions, cache restoration, and prevents git argument injection.

Key Highlights

  • Removal of web UI mode
  • Security hardening for cache archive symlink restore
  • Prevention of git argument injection in SCM refs
  • Harden query server file access
  • Normalize Windows daemon path hash

Breaking Changes

  • Remove web UI mode

New Features

  • Harden cache archive symlink restore
  • Harden query server file access
  • Confine prune patch paths
  • Prevent git argument injection
  • Normalize Windows daemon path hash
  • Preserve vt100 cell byte counts
  • Block self-hosted login URLs

Full Release Notes

<!-- Release notes generated using configuration in .github/release.yml at v2.9.18 -->

## What's Changed
### Changelog
* release(turborepo): 2.9.17 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/13047
* ci: Fetch version.txt via API in docs alias failure notification by @anthonyshew in https://github.com/vercel/turborepo/pull/13050
* fix: Harden cache archive symlink restore by @anthonyshew in https://github.com/vercel/turborepo/pull/13051
* chore: Remove web UI mode by @anthonyshew in https://github.com/vercel/turborepo/pull/13052
* fix: Harden query server file access by @anthonyshew in https://github.com/vercel/turborepo/pull/13053
* fix: Confine prune patch paths by @anthonyshew in https://github.com/vercel/turborepo/pull/13054
* fix: Prevent git argument injection in SCM refs by @anthonyshew in https://github.com/vercel/turborepo/pull/13055
* fix: Strip special mode bits from cache restore by @anthonyshew in https://github.com/vercel/turborepo/pull/13056
* fix: Contain incremental cache outputs by @anthonyshew in https://github.com/vercel/turborepo/pull/13057
* fix(turborepo): Normalize Windows daemon path hash by @Balance8 in https://github.com/vercel/turborepo/pull/13020
* fix: Preserve vt100 cell byte counts by @anthonyshew in https://github.com/vercel/turborepo/pull/13058
* fix: Separate artifact signature fields by @anthonyshew in https://github.com/vercel/turborepo/pull/13059
* fix: Validate OidHash hex buffers by @anthonyshew in https://github.com/vercel/turborepo/pull/13060
* fix: Block self-hosted login URLs from attempting to use Vercel's SSO by @anthonyshew in https://github.com/vercel/turborepo/pull/13061

## New Contributors
* @Balance8 made their first contribution in https://github.com/vercel/turborepo/pull/13020

**Full Changelog**: https://github.com/vercel/turborepo/compare/v2.9.17...v2.9.18