Impact Score: 5/10
Turborepo v2.9.18
Source available — automated, not human-reviewed
Component: turbo · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Turborepo v2.9.18. Source highlight: release(turborepo): 2.9.17 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/13047
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
🔧 Bug Fixes & Patches (6)
- fix: Harden cache archive symlink restore
- fix: Harden query server file access
- fix: Confine prune patch paths
- fix: Prevent git argument injection in SCM refs
- fix: Strip special mode bits from cache restore
- fix: Contain incremental cache outputs
📄 View Raw Release Notes (Original Developer Log)
<!-- Release notes generated using configuration in .github/release.yml at v2.9.18 -->
## What's Changed
### Changelog
* release(turborepo): 2.9.17 by @github-actions[bot] in https://github.com/vercel/turborepo/pull/13047
* ci: Fetch version.txt via API in docs alias failure notification by @anthonyshew in https://github.com/vercel/turborepo/pull/13050
* fix: Harden cache archive symlink restore by @anthonyshew in https://github.com/vercel/turborepo/pull/13051
* chore: Remove web UI mode by @anthonyshew in https://github.com/vercel/turborepo/pull/13052
* fix: Harden query server file access by @anthonyshew in https://github.com/vercel/turborepo/pull/13053
* fix: Confine prune patch paths by @anthonyshew in https://github.com/vercel/turborepo/pull/13054
* fix: Prevent git argument injection in SCM refs by @anthonyshew in https://github.com/vercel/turborepo/pull/13055
* fix: Strip special mode bits from cache restore by @anthonyshew in https://github.com/vercel/turborepo/pull/13056
* fix: Contain incremental cache outputs by @anthonyshew in https://github.com/vercel/turborepo/pull/13057
* fix(turborepo): Normalize Windows daemon path hash by @Balance8 in https://github.com/vercel/turborepo/pull/13020
* fix: Preserve vt100 cell byte counts by @anthonyshew in https://github.com/vercel/turborepo/pull/13058
* fix: Separate artifact signature fields by @anthonyshew in https://github.com/vercel/turborepo/pull/13059
* fix: Validate OidHash hex buffers by @anthonyshew in https://github.com/vercel/turborepo/pull/13060
* fix: Block self-hosted login URLs from attempting to use Vercel's SSO by @anthonyshew in https://github.com/vercel/turborepo/pull/13061
## New Contributors
* @Balance8 made their first contribution in https://github.com/vercel/turborepo/pull/13020
**Full Changelog**: https://github.com/vercel/turborepo/compare/v2.9.17...v2.9.18