Impact Score: 5/10
Turborepo v2.9.10
Source available — automated, not human-reviewed
Component: turbo · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Turborepo v2.9.10. Source highlight: release(turborepo): 2.9.9-canary.4 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12716
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
🔧 Bug Fixes & Patches (6)
- fix: Respect SCM env vars in `turbo query affected`
- fix: Avoid some raw `create-turbo` example telemetry
- fix: Escape graph HTML payloads
- fix: Prevent OTEL token injection to spoofed origins
- fix: Retry HTTP status failures
- fix: Validate microfrontend proxy Host header
📄 View Raw Release Notes (Original Developer Log)
<!-- Release notes generated using configuration in .github/release.yml at v2.9.10 -->
## What's Changed
### Changelog
* release(turborepo): 2.9.9-canary.4 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12716
* release(turborepo): 2.9.9 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12719
* fix: Respect SCM env vars in `turbo query affected` by @anthonyshew in https://github.com/vercel/turborepo/pull/12722
* ci: Package VSCode extension in release workflow by @anthonyshew in https://github.com/vercel/turborepo/pull/12723
* fix: Avoid some raw `create-turbo` example telemetry by @anthonyshew in https://github.com/vercel/turborepo/pull/12725
* fix: Escape graph HTML payloads by @anthonyshew in https://github.com/vercel/turborepo/pull/12726
* fix: Prevent OTEL token injection to spoofed origins by @anthonyshew in https://github.com/vercel/turborepo/pull/12727
* fix: Retry HTTP status failures by @anthonyshew in https://github.com/vercel/turborepo/pull/12728
* fix: Validate microfrontend proxy Host header by @anthonyshew in https://github.com/vercel/turborepo/pull/12730
* fix: Redact task hash env debug logs by @anthonyshew in https://github.com/vercel/turborepo/pull/12733
* fix: Filter microfrontend proxy environments by @anthonyshew in https://github.com/vercel/turborepo/pull/12732
* fix: Preserve FSEvents mount points for device-relative paths by @anthonyshew in https://github.com/vercel/turborepo/pull/12729
* fix: Validate proxy Host headers by @anthonyshew in https://github.com/vercel/turborepo/pull/12731
* fix: Resolve TypeScript `.js` extension imports to `.ts` files in boundaries by @maschwenk in https://github.com/vercel/turborepo/pull/12644
* fix: Use random temp path for repo downloads by @anthonyshew in https://github.com/vercel/turborepo/pull/12736
* release(turborepo): 2.9.10-canary.1 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/12734
* fix: Reject OTel endpoints with userinfo by @anthonyshew in https://github.com/vercel/turborepo/pull/12737
* fix: Authenticate local devtools WebSocket by @anthonyshew in https://github.com/vercel/turborepo/pull/12738
* fix: Handle clipboard exec errors by @anthonyshew in https://github.com/vercel/turborepo/pull/12739
* fix: Restrict Vercel token reuse to trusted API origins by @anthonyshew in https://github.com/vercel/turborepo/pull/12740
* fix: Keep workspace config discovery inside root by @anthonyshew in https://github.com/vercel/turborepo/pull/12741
* fix: Hardening for daemon IPC endpoints by @anthonyshew in https://github.com/vercel/turborepo/pull/12742
* fix: Enforce cache filesystem boundaries by @anthonyshew in https://github.com/vercel/turborepo/pull/12743
**Full Changelog**: https://github.com/vercel/turborepo/compare/v2.9.9...v2.9.10