Starstruk Logo MarkStarstruk

v2.9.18

feder-cr/AIHawkv2.9.18Jun 10, 2026by github-actions[bot]

AI Summary

Turborepo v2.9.18 focuses on critical security hardening, including fixes for cache archive symlink restore, query server file access, and prevention of git argument injection in SCM refs. The release also removes the web UI mode and introduces various internal security validations.

Key Highlights

  • Harden cache archive symlink restore
  • Harden query server file access
  • Prevent git argument injection in SCM refs
  • Block self-hosted login URLs from attempting to use Vercel's SSO
  • Remove web UI mode

Full Release Notes

<!-- Release notes generated using configuration in .github/release.yml at v2.9.18 -->

## What's Changed
### Changelog
* release(turborepo): 2.9.17 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/13047
* ci: Fetch version.txt via API in docs alias failure notification by @anthonyshew in https://github.com/vercel/turborepo/pull/13050
* fix: Harden cache archive symlink restore by @anthonyshew in https://github.com/vercel/turborepo/pull/13051
* chore: Remove web UI mode by @anthonyshew in https://github.com/vercel/turborepo/pull/13052
* fix: Harden query server file access by @anthonyshew in https://github.com/vercel/turborepo/pull/13053
* fix: Confine prune patch paths by @anthonyshew in https://github.com/vercel/turborepo/pull/13054
* fix: Prevent git argument injection in SCM refs by @anthonyshew in https://github.com/vercel/turborepo/pull/13055
* fix: Strip special mode bits from cache restore by @anthonyshew in https://github.com/vercel/turborepo/pull/13056
* fix: Contain incremental cache outputs by @anthonyshew in https://github.com/vercel/turborepo/pull/13057
* fix(turborepo): Normalize Windows daemon path hash by @Balance8 in https://github.com/vercel/turborepo/pull/13020
* fix: Preserve vt100 cell byte counts by @anthonyshew in https://github.com/vercel/turborepo/pull/13058
* fix: Separate artifact signature fields by @anthonyshew in https://github.com/vercel/turborepo/pull/13059
* fix: Validate OidHash hex buffers by @anthonyshew in https://github.com/vercel/turborepo/pull/13060
* fix: Block self-hosted login URLs from attempting to use Vercel's SSO by @anthonyshew in https://github.com/vercel/turborepo/pull/13061

## New Contributors
* @Balance8 made their first contribution in https://github.com/vercel/turborepo/pull/13020

**Full Changelog**: https://github.com/vercel/turborepo/compare/v2.9.17...v2.9.18