Impact Score: 5/10
Turborepo v2.8.2
Source available โ automated, not human-reviewed
Component: turbo ยท Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
โก Executive Summary (TL;DR)
Turborepo v2.8.2. Source highlight: fix: Upgrade next to fix HTTP deserialization DoS
Who Does This Impact? (Role-Based Analysis)
๐ป Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
๐ Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
โ๏ธ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
โจ New Features & Capabilities (2)
- feat: Migrate from tsup to tsdown
- Update README.md title and remove features section
๐ง Bug Fixes & Patches (6)
- fix: Upgrade next to fix HTTP deserialization DoS
- fix: Upgrade mermaid to fix lodash-es vulnerability
- fix: Upgrade recharts to fix lodash vulnerability
- fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability
- fix: Upgrade tsup to fix rollup and glob vulnerabilities
- fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability
๐ View Raw Release Notes (Original Developer Log)
<!-- Release notes generated using configuration in .github/release.yml at v2.8.2 -->
## What's Changed
### Docs
* fix: Upgrade next to fix HTTP deserialization DoS by @anthonyshew in https://github.com/vercel/turborepo/pull/11597
* fix: Upgrade mermaid to fix lodash-es vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11611
* fix: Upgrade recharts to fix lodash vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11606
* chore: Move applications to apps/ directory by @anthonyshew in https://github.com/vercel/turborepo/pull/11613
* fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11616
### create-turbo
* fix: Upgrade tsup to fix rollup and glob vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11601
* fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11622
* fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11623
* feat: Migrate from tsup to tsdown by @anthonyshew in https://github.com/vercel/turborepo/pull/11649
### @turbo/codemod
* fix: Upgrade axios to fix SSRF vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11599
* fix: Replace axios with native fetch in turbo-codemod by @anthonyshew in https://github.com/vercel/turborepo/pull/11600
* fix: Upgrade diff to fix DoS vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11621
### eslint
* fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11610
* fix: Upgrade esbuild to fix arbitrary request vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11615
### Examples
* examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in https://github.com/vercel/turborepo/pull/11591
* fix: escaping for link titles in LinksService by @odaysec in https://github.com/vercel/turborepo/pull/11632
### Changelog
* fix: Add `allowComments` and `allowTrailingCommas` to turbo.json schema by @ddmoney420 in https://github.com/vercel/turborepo/pull/11579
* chore: Eliminate ts-rs serde attribute parse warnings by @anthonyshew in https://github.com/vercel/turborepo/pull/11589
* fix: Extract git argument validation into reusable helper by @anthonyshew in https://github.com/vercel/turborepo/pull/11593
* fix: Upgrade fast-xml-parser to fix RangeError DoS by @anthonyshew in https://github.com/vercel/turborepo/pull/11598
* fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11596
* fix: Upgrade tar to fix security vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11602
* fix: Upgrade @actions/github to fix @octokit vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11607
* fix: Upgrade @vercel/blob and @actions packages to fix undici vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11608
* docs: Running Root Tasks by @Netail in https://github.com/vercel/turborepo/pull/11630
* Update README.md title and remove features section by @anthonyshew in https://github.com/vercel/turborepo/pull/11651
* docs: Update using-environment-variables.mdx by @anthonyshew in https://github.com/vercel/turborepo/pull/11652
* fix: Upgrade js-yaml to address CVE-2025-64718 by @alexmkio in https://github.com/vercel/turborepo/pull/11650
* fix: Remove smooth scrolling from docs by @anthonyshew in https://github.com/vercel/turborepo/pull/11654
* fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @anthonyshew in https://github.com/vercel/turborepo/pull/11655
## New Contributors
* @ddmoney420 made their first contribution in https://github.com/vercel/turborepo/pull/11579
* @i5d6 made their first contribution in https://github.com/vercel/turborepo/pull/11591
* @Netail made their first contribution in https://github.com/vercel/turborepo/pull/11630
* @alexmkio made their first contribution in https://github.com/vercel/turborepo/pull/11650
**Full Changelog**: https://github.com/vercel/turborepo/compare/v2.8.1...v2.8.2