Impact Score: 5/10
Turborepo v2.8.10
Source available — automated, not human-reviewed
Component: turbo · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Turborepo v2.8.10. Source highlight: fix: Sanitize git command inputs in create-turbo
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
✨ New Features & Capabilities (2)
- feat: Generate LLM-friendly markdown alongside --profile trace output
- feat: Make `--profile` and `--anon-profile` filename optional
⚡ Performance & Enhancements (6)
- perf: Optimize hot-path hash computation by avoiding clones and using unstable sorts
- perf: Replace twox-hash with xxhash-rust and optimize file hashing
- perf: Reduce allocations in globwalk
- perf: Replace O(V³) Floyd-Warshall with O(V+E) DFS in watch mode subgraph creation
- perf: Batch per-package git subprocess calls into repo-wide index
- perf: Parallelize and pre-build RepoGitIndex
🔧 Bug Fixes & Patches (3)
- fix: Sanitize git command inputs in create-turbo
- fix: Move `node-plop` to dependencies so `PlopTypes` resolves for consumers
- fix: Restrict credential file permissions to owner-only
📄 View Raw Release Notes (Original Developer Log)
<!-- Release notes generated using configuration in .github/release.yml at v2.8.10 -->
## What's Changed
### create-turbo
* fix: Sanitize git command inputs in create-turbo by @anthonyshew in https://github.com/vercel/turborepo/pull/11876
### Changelog
* fix: Move `node-plop` to dependencies so `PlopTypes` resolves for consumers by @anthonyshew in https://github.com/vercel/turborepo/pull/11862
* chore: Use 2024 edition in more packages, do not ignore some clippy l… by @ognevny in https://github.com/vercel/turborepo/pull/11860
* perf: Optimize hot-path hash computation by avoiding clones and using unstable sorts by @anthonyshew in https://github.com/vercel/turborepo/pull/11872
* perf: Replace twox-hash with xxhash-rust and optimize file hashing by @anthonyshew in https://github.com/vercel/turborepo/pull/11874
* fix: Restrict credential file permissions to owner-only by @anthonyshew in https://github.com/vercel/turborepo/pull/11870
* perf: Reduce allocations in globwalk by @anthonyshew in https://github.com/vercel/turborepo/pull/11528
* perf: Replace O(V³) Floyd-Warshall with O(V+E) DFS in watch mode subgraph creation by @anthonyshew in https://github.com/vercel/turborepo/pull/11878
* feat: Generate LLM-friendly markdown alongside --profile trace output by @anthonyshew in https://github.com/vercel/turborepo/pull/11880
* feat: Make `--profile` and `--anon-profile` filename optional by @anthonyshew in https://github.com/vercel/turborepo/pull/11883
* perf: Batch per-package git subprocess calls into repo-wide index by @anthonyshew in https://github.com/vercel/turborepo/pull/11887
* perf: Parallelize and pre-build RepoGitIndex by @anthonyshew in https://github.com/vercel/turborepo/pull/11889
* perf: Pre-compile glob exclusion filter and cache path prefix in file hashing by @anthonyshew in https://github.com/vercel/turborepo/pull/11891
**Full Changelog**: https://github.com/vercel/turborepo/compare/v2.8.9...v2.8.10