v2.11.5
vercel/turborepov2.11.5Sep 28, 2026by github-actions[bot]
Upgrading?
AI Summary
This release focuses on dependency management, security updates, and code cleanup. It includes fixes for package manager lockfile handling, remote artifact resilience, and security patches for js-yaml. Additionally, it introduces documentation bundling into the npm package and refactors several Rust-based components to remove unused code and dependencies.
Key Highlights
- Bundle documentation directly in the `turbo` npm package.
- Upgrade Next.js and patch js-yaml to address security vulnerabilities (CVEs).
- Replace CLI frameworks (clap) with `usage-rs` and remove unused Rust dependencies.
- Improve stability of pnpm per-workspace lockfile hashes.
- Enhance resilience for remote artifact requests during outages.
New Features
- Bundle docs in `turbo` npm package
Full Release Notes
<!-- Release notes generated using configuration in .github/release.yml at v2.11.5 --> ## What's Changed ### Changelog * chore: Release Turborepo 2.11.4 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/14231 * test: Move Python opt-in hint into filter contracts by @anthonyshew in https://github.com/vercel/turborepo/pull/14228 * test: Move dependency-output summary assertion into contract by @anthonyshew in https://github.com/vercel/turborepo/pull/14230 * test: Move dependency-output selection and validation cases to engine contracts by @anthonyshew in https://github.com/vercel/turborepo/pull/14232 * test: Move Cargo exclude-only scope coverage by @anthonyshew in https://github.com/vercel/turborepo/pull/14238 * test: Move Cargo cache-authority cases to contracts by @anthonyshew in https://github.com/vercel/turborepo/pull/14240 * test: Move JIT dependency graph scenario into engine contract by @anthonyshew in https://github.com/vercel/turborepo/pull/14235 * test: Move dependency-output hash cases into task-hash contracts by @anthonyshew in https://github.com/vercel/turborepo/pull/14233 * test: Move Cargo task-filter cases into crate contracts by @anthonyshew in https://github.com/vercel/turborepo/pull/14239 * test: Move JIT input hash timing cases into task-hash contracts by @anthonyshew in https://github.com/vercel/turborepo/pull/14234 * test: Move package input normalization cases into engine contracts by @anthonyshew in https://github.com/vercel/turborepo/pull/14236 * test: Move structured startup and JIT input cases into contracts by @anthonyshew in https://github.com/vercel/turborepo/pull/14237 * fix: Back off remote artifact requests during outages by @anthonyshew in https://github.com/vercel/turborepo/pull/14222 * chore: Release Turborepo 2.11.5-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/14245 * test: Make new-package lockfile filter deterministic by @anthonyshew in https://github.com/vercel/turborepo/pull/14241 * test: Trim redundant Go cache builds by @anthonyshew in https://github.com/vercel/turborepo/pull/14242 * test: Reduce Go versioned-name test matrix by @anthonyshew in https://github.com/vercel/turborepo/pull/14243 * test: Move Go binary checks into contracts by @anthonyshew in https://github.com/vercel/turborepo/pull/14246 * test: Consolidate Go format smokes by @anthonyshew in https://github.com/vercel/turborepo/pull/14244 * test: Reuse Cargo build artifacts safely by @anthonyshew in https://github.com/vercel/turborepo/pull/14247 * test: Separate prune planning matrix from buildability smoke by @anthonyshew in https://github.com/vercel/turborepo/pull/14248 * feat: Bundle docs in `turbo` npm package by @anthonyshew in https://github.com/vercel/turborepo/pull/14108 * chore: Release Turborepo 2.11.5-canary.2 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/14249 * fix: Stabilize pnpm per-workspace lockfile hashes by @anthonyshew in https://github.com/vercel/turborepo/pull/14253 * chore: Upgrade factory Next.js to 16.3.3 by @anthonyshew in https://github.com/vercel/turborepo/pull/14254 * fix: Update js-yaml to address CVE-2026-84375 by @anthonyshew in https://github.com/vercel/turborepo/pull/14255 * chore: Upgrade Next.js in docs and factory for CVE-2026-94545 by @anthonyshew in https://github.com/vercel/turborepo/pull/14256 * fix: Remove unmaintained proc-macro-error2 by @anthonyshew in https://github.com/vercel/turborepo/pull/14257 * refactor: Replace clap in production CLIs with usage-rs by @anthonyshew in https://github.com/vercel/turborepo/pull/14259 * chore: Remove tiny-gradient dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/14260 * refactor: Replace human-panic with local crash reporting by @anthonyshew in https://github.com/vercel/turborepo/pull/14261 * chore: Remove unused struct_iterable dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/14258 * fix: Sign complete on-disk artifacts after local cache writes by @anthonyshew in https://github.com/vercel/turborepo/pull/14265 * chore: Remove `derive_setters` dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/14266 * chore: Remove port_scanner dependency by @anthonyshew in https://github.com/vercel/turborepo/pull/14267 * chore: Remove unused Rust dependency declarations by @anthonyshew in https://github.com/vercel/turborepo/pull/14268 * refactor: Remove unused public Rust APIs by @anthonyshew in https://github.com/vercel/turborepo/pull/14269 * refactor: Use workspace Rust edition across crates by @anthonyshew in https://github.com/vercel/turborepo/pull/14270 * chore: Clean up Rust Clippy exceptions by @anthonyshew in https://github.com/vercel/turborepo/pull/14271 * refactor: Group task-hash and uv generation context by @anthonyshew in https://github.com/vercel/turborepo/pull/14279 * refactor: Remove unused global hash wrapper by @anthonyshew in https://github.com/vercel/turborepo/pull/14281 * refactor: Remove unused file-hash telemetry argument by @anthonyshew in https://github.com/vercel/turborepo/pull/14282 * refactor: Remove dead CLI code and crate-wide allowance by @anthonyshew in https://github.com/vercel/turborepo/pull/14283 * refactor: Remove dead Microfrontends config code by @anthonyshew in https://github.com/vercel/turborepo/pull/14284 * refactor: Remove unused UI task types and dead-code allowance by @anthonyshew in https://github.com/vercel/turborepo/pull/14286 * refactor: Remove unused Cache archive test helper and dead code allowance by @anthonyshew in https://github.com/vercel/turborepo/pull/14287 * chore: Narrow Run dead-code allowances by @anthonyshew in https://github.com/vercel/turborepo/pull/14285 * chore: Remove resolved TODO markers by @anthonyshew in https://github.com/vercel/turborepo/pull/14288 * fix: Use map_while for invariant text prefixes by @anthonyshew in https://github.com/vercel/turborepo/pull/14289 * test: Cover globwalk parent traversal by @anthonyshew in https://github.com/vercel/turborepo/pull/14290 * fix: Wait for watcher setup with Tokio wait_for by @anthonyshew in https://github.com/vercel/turborepo/pull/14292 * test: Exercise SCM package hashing for symlinks by @anthonyshew in https://github.com/vercel/turborepo/pull/14291 * fix: Reject empty tokens when reading token files by @anthonyshew in https://github.com/vercel/turborepo/pull/14293 * test: Verify Yarn transparent workspace handling by @anthonyshew in https://github.com/vercel/turborepo/pull/14294 * fix: Format pnpm v5 package names by @anthonyshew in https://github.com/vercel/turborepo/pull/14295 * fix: Report package manager error source paths by @anthonyshew in https://github.com/vercel/turborepo/pull/14296 * fix: Resolve LSP task references with JSONC AST by @anthonyshew in https://github.com/vercel/turborepo/pull/14298 * chore: Remove stale package watcher TODO by @anthonyshew in https://github.com/vercel/turborepo/pull/14299 * fix: Validate scope selector glob bases by @anthonyshew in https://github.com/vercel/turborepo/pull/14300 * fix: Add path context to globwatch errors by @anthonyshew in https://github.com/vercel/turborepo/pull/14301 * docs: Document wax pattern and walk semantics by @anthonyshew in https://github.com/vercel/turborepo/pull/14302 * chore: Remove resolved filewatch input-set TODO by @anthonyshew in https://github.com/vercel/turborepo/pull/14303 * docs: Document FSEvents event translation by @anthonyshew in https://github.com/vercel/turborepo/pull/14305 * refactor: Group run-cache task context by @anthonyshew in https://github.com/vercel/turborepo/pull/14304 * chore: Document package watcher task-input filtering by @anthonyshew in https://github.com/vercel/turborepo/pull/14306 * chore: Remove stale const_format lint workaround by @anthonyshew in https://github.com/vercel/turborepo/pull/14307 * refactor: Route regex groups through Grouping by @anthonyshew in https://github.com/vercel/turborepo/pull/14308 * perf: Parse character classes without compiling regex by @anthonyshew in https://github.com/vercel/turborepo/pull/14310 * chore: Drop unused Biome dependencies from turbopath by @anthonyshew in https://github.com/vercel/turborepo/pull/14311 * chore: Unify jsonc-parser versions by @anthonyshew in https://github.com/vercel/turborepo/pull/14312 * chore: Remove error-only dependency edges by @anthonyshew in https://github.com/vercel/turborepo/pull/14313 * perf: Emit casing flags only when they change by @anthonyshew in https://github.com/vercel/turborepo/pull/14309 * perf: Avoid formatting Bun lockfiles during parsing by @anthonyshew in https://github.com/vercel/turborepo/pull/14314 * test: Assert process manager stop postconditions by @anthonyshew in https://github.com/vercel/turborepo/pull/14297 * perf: Serve a static GraphiQL page by @anthonyshew in https://github.com/vercel/turborepo/pull/14315 * perf: Upgrade serde_json to reduce CLI size by @anthonyshew in https://github.com/vercel/turborepo/pull/14316 * perf: Upgrade Ratatui to reduce TUI allocations by @anthonyshew in https://github.com/vercel/turborepo/pull/14317 * fix: Restore TUI log streaming after Ratatui upgrade by @anthonyshew in https://github.com/vercel/turborepo/pull/14318 * feat: Add version-matched agent guidance by @anthonyshew in https://github.com/vercel/turborepo/pull/14250 * fix: Restore Rust builds after agent guidance changes by @anthonyshew in https://github.com/vercel/turborepo/pull/14319 * chore: Release Turborepo 2.11.5-canary.3 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/14320 * docs: Update Turborepo schema URL example by @yousefdawood7 in https://github.com/vercel/turborepo/pull/14321 * feat: Publish versioned standalone turbo archives by @anthonyshew in https://github.com/vercel/turborepo/pull/14322 * fix: Run standalone archive job on manual releases by @anthonyshew in https://github.com/vercel/turborepo/pull/14323 * chore: Release Turborepo 2.11.5-canary.4 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/14324 * feat: Add standalone installers URLs for `curl | bash` by @anthonyshew in https://github.com/vercel/turborepo/pull/14325 * fix: Isolate installer test environment by @anthonyshew in https://github.com/vercel/turborepo/pull/14326 * fix: Pass repository to release asset commands by @anthonyshew in https://github.com/vercel/turborepo/pull/14327 * chore: Release Turborepo 2.11.5-canary.5 by @anthonyshew in https://github.com/vercel/turborepo/pull/14328 ## New Contributors * @yousefdawood7 made their first contribution in https://github.com/vercel/turborepo/pull/14321 **Full Changelog**: https://github.com/vercel/turborepo/compare/v2.11.4...v2.11.5
Related Repositories
farion1231/cc-switch★ 147,223
A cross-platform desktop All-in-One assistant for Claude Code, Codex, OpenCode, OpenClaw, Grok Build & Hermes Agent. Only official website: ccswitch.io
rustdesk/rustdesk★ 126,546
An open-source remote desktop application designed for self-hosting, as an alternative to TeamViewer.
tauri-apps/tauri★ 112,094
Build smaller, faster, and more secure desktop and mobile applications with a web frontend.
ruvnet/RuView★ 99,052
π RuView turns commodity WiFi signals into real-time spatial intelligence, vital sign monitoring, and presence detection — all without a single pixel of video.
oven-sh/bun★ 96,338
Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one