# Turborepo v2.8.4 — Release & Upgrade Intelligence
- **Product:** Turborepo (https://turbo.build)
- **Version:** v2.8.4
- **Released:** Feb 10, 2026
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/turborepo/updates/v2.8.4/

## Executive Summary (TL;DR)
Turborepo v2.8.4. Source highlight: fix: Upgrade semver to fix ReDoS vulnerability

## Bug Fixes
- fix: Upgrade semver to fix ReDoS vulnerability
- fix: Upgrade inquirer to remove lodash dependency
- fix: Upgrade tsdown in create-turbo to resolve valibot ReDoS vulnerability
- fix: Upgrade jest to v30 to resolve brace-expansion ReDoS vulnerability
- fix: Upgrade Next.js to 16.1.5 to fix DoS vulnerabilities
- fix: Upgrade eslint to v10 to resolve @eslint/plugin-kit ReDoS vulnerability

## Upgrade Command
```bash
npm install --save-dev --save-exact turbo@2.8.4
```