v2.8.5

vercel/turborepov2.8.5Feb 10, 2026by turbo-orchestrator[bot]

AI Summary

This release focuses on security patching and maintenance updates. Key changes include upgrading tsdown and semver to fix vulnerabilities, renaming a CLI workspace package to avoid false audits, and adding internal agent workflows for repo automation.

Key Highlights

Upgraded tsdown and semver to fix valibot and ReDoS vulnerabilities
Renamed CLI workspace package to avoid false audit matches
Added internal agents app for repo automation

New Features

Agentic workflows app
Internal agents app for repo automation

Full Release Notes

<!-- Release notes generated using configuration in .github/release.yml at v2.8.5 -->

## What's Changed
### @turbo/codemod
* fix: Upgrade tsdown to fix valibot and diff vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11766
* fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11765
### @turbo/repository
* fix: Rename cli workspace package to avoid false audit match by @anthonyshew in https://github.com/vercel/turborepo/pull/11767
### Changelog
* fix: Add Vary: Accept header to docs markdown endpoint by @molebox in https://github.com/vercel/turborepo/pull/11759
* chore: Agentic workflows app by @anthonyshew in https://github.com/vercel/turborepo/pull/11773
* chore: Add internal agents app for repo automation by @anthonyshew in https://github.com/vercel/turborepo/pull/11776
* chore: Update reproduction request message by @anthonyshew in https://github.com/vercel/turborepo/pull/11778
* Revert "fix: Upgrade node-plop to 0.32.3" by @anthonyshew in https://github.com/vercel/turborepo/pull/11780


**Full Changelog**: https://github.com/vercel/turborepo/compare/v2.8.4...v2.8.5