Turborepo v2.8.2stable Released Feb 03, 2026
Impact Score: 5/10

Turborepo v2.8.2

Source available โ€” automated, not human-reviewed

Component: turbo ยท Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified โ€” check source notes
$ npm install --save-dev --save-exact [email protected]
๐Ÿ“„ .MD
โšก Executive Summary (TL;DR)

Turborepo v2.8.2. Source highlight: fix: Upgrade next to fix HTTP deserialization DoS

Who Does This Impact? (Role-Based Analysis)

๐Ÿ’ป Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

๐Ÿ“Š Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

โš™๏ธ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

โœจ New Features & Capabilities (2)

  • feat: Migrate from tsup to tsdown
  • Update README.md title and remove features section

๐Ÿ”ง Bug Fixes & Patches (6)

  • fix: Upgrade next to fix HTTP deserialization DoS
  • fix: Upgrade mermaid to fix lodash-es vulnerability
  • fix: Upgrade recharts to fix lodash vulnerability
  • fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability
  • fix: Upgrade tsup to fix rollup and glob vulnerabilities
  • fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability
๐Ÿ“„ View Raw Release Notes (Original Developer Log)
<!-- Release notes generated using configuration in .github/release.yml at v2.8.2 --> ## What's Changed ### Docs * fix: Upgrade next to fix HTTP deserialization DoS by @anthonyshew in https://github.com/vercel/turborepo/pull/11597 * fix: Upgrade mermaid to fix lodash-es vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11611 * fix: Upgrade recharts to fix lodash vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11606 * chore: Move applications to apps/ directory by @anthonyshew in https://github.com/vercel/turborepo/pull/11613 * fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11616 ### create-turbo * fix: Upgrade tsup to fix rollup and glob vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11601 * fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11622 * fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11623 * feat: Migrate from tsup to tsdown by @anthonyshew in https://github.com/vercel/turborepo/pull/11649 ### @turbo/codemod * fix: Upgrade axios to fix SSRF vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11599 * fix: Replace axios with native fetch in turbo-codemod by @anthonyshew in https://github.com/vercel/turborepo/pull/11600 * fix: Upgrade diff to fix DoS vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11621 ### eslint * fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11610 * fix: Upgrade esbuild to fix arbitrary request vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11615 ### Examples * examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @i5d6 in https://github.com/vercel/turborepo/pull/11591 * fix: escaping for link titles in LinksService by @odaysec in https://github.com/vercel/turborepo/pull/11632 ### Changelog * fix: Add `allowComments` and `allowTrailingCommas` to turbo.json schema by @ddmoney420 in https://github.com/vercel/turborepo/pull/11579 * chore: Eliminate ts-rs serde attribute parse warnings by @anthonyshew in https://github.com/vercel/turborepo/pull/11589 * fix: Extract git argument validation into reusable helper by @anthonyshew in https://github.com/vercel/turborepo/pull/11593 * fix: Upgrade fast-xml-parser to fix RangeError DoS by @anthonyshew in https://github.com/vercel/turborepo/pull/11598 * fix: Upgrade semver to fix ReDoS vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11596 * fix: Upgrade tar to fix security vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11602 * fix: Upgrade @actions/github to fix @octokit vulnerabilities by @anthonyshew in https://github.com/vercel/turborepo/pull/11607 * fix: Upgrade @vercel/blob and @actions packages to fix undici vulnerability by @anthonyshew in https://github.com/vercel/turborepo/pull/11608 * docs: Running Root Tasks by @Netail in https://github.com/vercel/turborepo/pull/11630 * Update README.md title and remove features section by @anthonyshew in https://github.com/vercel/turborepo/pull/11651 * docs: Update using-environment-variables.mdx by @anthonyshew in https://github.com/vercel/turborepo/pull/11652 * fix: Upgrade js-yaml to address CVE-2025-64718 by @alexmkio in https://github.com/vercel/turborepo/pull/11650 * fix: Remove smooth scrolling from docs by @anthonyshew in https://github.com/vercel/turborepo/pull/11654 * fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @anthonyshew in https://github.com/vercel/turborepo/pull/11655 ## New Contributors * @ddmoney420 made their first contribution in https://github.com/vercel/turborepo/pull/11579 * @i5d6 made their first contribution in https://github.com/vercel/turborepo/pull/11591 * @Netail made their first contribution in https://github.com/vercel/turborepo/pull/11630 * @alexmkio made their first contribution in https://github.com/vercel/turborepo/pull/11650 **Full Changelog**: https://github.com/vercel/turborepo/compare/v2.8.1...v2.8.2