# Turborepo v2.9.0 — Release & Upgrade Intelligence
- **Product:** Turborepo (https://turbo.build)
- **Version:** v2.9.0
- **Released:** Mar 30, 2026
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/turborepo/updates/v2.9.0/

## Executive Summary (TL;DR)
Turborepo v2.9.0. Source highlight: docs: Release post for 2.8

## New Features
- feat: Add requestType tracking for header-negotiated markdown
- feat: Migrate from tsup to tsdown
- feat: Add `affectedUsingTaskInputs` future flag for task-level `--affected` detection
- feat: Deprecate `turbo-ignore` in favor of `turbo query affected`
- feat: Add experimentalObservability with an OTel backend
- feat: Add `packagesFromLockfile()` NAPI binding to `@turbo/repository`

## Improvements
- perf: Defer TLS initialization to a background thread
- perf: Replace third-party crates with Rust std lib equivalents
- perf: Reduce duplicate dependency versions
- perf: Optimize hot-path hash computation by avoiding clones and using unstable sorts
- perf: Replace twox-hash with xxhash-rust and optimize file hashing
- perf: Reduce allocations in globwalk

## Bug Fixes
- docs: Fix curl markdown Accept header syntax in 2.8 release blog
- docs: Fix worktree command in blog post
- fix: Upgrade next to fix HTTP deserialization DoS
- fix: Upgrade mermaid to fix lodash-es vulnerability
- fix: Upgrade recharts to fix lodash vulnerability
- fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability

## Upgrade Command
```bash
npm install --save-dev --save-exact turbo@2.9.0
```