Update dependency turbo to v2.9.18

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
turbo (source)	2.9.14 → 2.9.18

---

Release Notes

vercel/turborepo (turbo)

v2.9.18: Turborepo v2.9.18

Compare Source

What's Changed

Changelog

• release(turborepo): 2.9.17 by @​github-actions[bot] in #​13047
• ci: Fetch version.txt via API in docs alias failure notification by @​anthonyshew in #​13050
• fix: Harden cache archive symlink restore by @​anthonyshew in #​13051
• chore: Remove web UI mode by @​anthonyshew in #​13052
• fix: Harden query server file access by @​anthonyshew in #​13053
• fix: Confine prune patch paths by @​anthonyshew in #​13054
• fix: Prevent git argument injection in SCM refs by @​anthonyshew in #​13055
• fix: Strip special mode bits from cache restore by @​anthonyshew in #​13056
• fix: Contain incremental cache outputs by @​anthonyshew in #​13057
• fix(turborepo): Normalize Windows daemon path hash by @​Balance8 in #​13020
• fix: Preserve vt100 cell byte counts by @​anthonyshew in #​13058
• fix: Separate artifact signature fields by @​anthonyshew in #​13059
• fix: Validate OidHash hex buffers by @​anthonyshew in #​13060
• fix: Block self-hosted login URLs from attempting to use Vercel's SSO by @​anthonyshew in #​13061

New Contributors

• @​Balance8 made their first contribution in #​13020

Full Changelog: vercel/turborepo@v2.9.17...v2.9.18

v2.9.17: Turborepo v2.9.17

Compare Source

What's Changed

Changelog

• fix: Keep non-PTY stdin alive for persistent tasks by @​anthonyshew in #​12972
• release(turborepo): 2.9.16 by @​github-actions[bot] in #​12970
• release(turborepo): 2.9.17-canary.1 by @​github-actions[bot] in #​12973
• fix: Add auth HTTP timeouts by @​anthonyshew in #​12976
• fix: Detect affected root tasks in query by @​anthonyshew in #​12977
• fix: Wait for Windows graceful shutdown by @​anthonyshew in #​12979
• release(turborepo): 2.9.17-canary.2 by @​github-actions[bot] in #​12980
• test: Skip installs for JSON output fixtures by @​anthonyshew in #​12981
• feat: Add Rsbuild examples by @​Nsttt in #​12942
• test: Skip installs for single package dry runs by @​anthonyshew in #​12982
• test: Skip Corepack setup without installs by @​anthonyshew in #​12983
• test: Skip installs for metadata-only Rust tests by @​anthonyshew in #​12985
• test: Skip remaining unnecessary fixture installs by @​anthonyshew in #​12986
• test: Add final hash contract snapshots by @​anthonyshew in #​12984
• test: Trim run logging integration matrix by @​anthonyshew in #​12987
• test: Trim affected query integration matrix by @​anthonyshew in #​12988
• test: Narrow Windows integration test group by @​anthonyshew in #​12989
• test: Trim task dependency integration coverage by @​anthonyshew in #​12990
• test: Trim affected integration coverage by @​anthonyshew in #​12991
• test: Collapse integration test matrices by @​anthonyshew in #​12992
• test: Collapse non-watch integration matrices by @​anthonyshew in #​12993
• test: Collapse summary and caching test setup by @​anthonyshew in #​12994
• test: Trim lockfile-aware caching integration matrix by @​anthonyshew in #​12995
• test: Move inference, env, and otel coverage lower by @​anthonyshew in #​12996
• test: Trim turborepo-scm subprocess tests by @​anthonyshew in #​12998
• test: Remove Windows nextest thread cap by @​anthonyshew in #​12999
• test: Trim workspace config integration tests by @​anthonyshew in #​13000
• test: Trim run logging integration coverage by @​anthonyshew in #​13001
• test: Trim summary inference and single package tests by @​anthonyshew in #​13002
• test: Trim continue and persistent integration tests by @​anthonyshew in #​13004
• test: Trim force and workspace inheritance tests by @​anthonyshew in #​13005
• test: Trim SCM regression matrix by @​anthonyshew in #​13006
• test: Trim miscellaneous integration tests by @​anthonyshew in #​13007
• test: Trim affected and cache integration coverage by @​anthonyshew in #​13008
• refactor: Split engine builder modules by @​anthonyshew in #​13009
• refactor: Split process child module by @​anthonyshew in #​13014
• refactor: Split CLI module by @​anthonyshew in #​13013
• refactor: Split Bun lockfile module by @​anthonyshew in #​13012
• Fix typo in .gitignore comment by @​saiteja-madha in #​13010
• fix: Preserve Bun nested dependency versions by @​anthonyshew in #​13016
• docs: Exclude Next.js dev server output from cache examples by @​anthonyshew in #​13019
• release(turborepo): 2.9.17-canary.3 by @​github-actions[bot] in #​13017
• fix: Highlight active docs sidebar item by @​anthonyshew in #​13023
• fix: Ignore peer dependencies in package graph by @​kitten in #​13025
• release(turborepo): 2.9.17-canary.4 by @​github-actions[bot] in #​13032
• fix: Preserve pnpm override-resolved prune deps by @​anthonyshew in #​13031
• fix: Keep PTY stdin open for tasks by @​anthonyshew in #​13033
• fix: Add TUI pane padding before logs by @​anthonyshew in #​13034
• fix(api-client): Support P-521 ECDSA certificate chains over rustls by @​anthonyshew in #​13036
• chore: Restore aarch64 musl release builds by @​anthonyshew in #​13037
• release(turborepo): 2.9.17-canary.5 by @​github-actions[bot] in #​13038
• docs: Remove ESM warning from gen page by @​anthonyshew in #​13039
• fix: Bypass npm command shim on Windows by @​anthonyshew in #​13040
• feat: Add JIT task input hashing by @​anthonyshew in #​13043
• fix: Defer hashes for JIT task dependents by @​anthonyshew in #​13045
• release(turborepo): 2.9.17-canary.6 by @​github-actions[bot] in #​13044
• release(turborepo): 2.9.17-canary.7 by @​github-actions[bot] in #​13046
• fix: Send Ctrl+C to Windows PTY tasks by @​anthonyshew in #​13041

New Contributors

• @​Nsttt made their first contribution in #​12942
• @​saiteja-madha made their first contribution in #​13010
• @​kitten made their first contribution in #​13025

Full Changelog: vercel/turborepo@v2.9.16...v2.9.17

v2.9.16: Turborepo v2.9.16

Compare Source

What's Changed

Changelog

• release(turborepo): 2.9.15 by @​github-actions[bot] in #​12955
• fix: Avoid hanging PTY shutdown by @​anthonyshew in #​12958
• fix: Retry npm tlog publish failures by @​anthonyshew in #​12959
• release(turborepo): 2.9.16-canary.1 by @​anthonyshew in #​12960
• fix: Preserve nested Bun dependency versions by @​anthonyshew in #​12963
• Revert "fix: Preserve nested Bun dependency versions" by @​anthonyshew in #​12964
• release(turborepo): 2.9.16-canary.2 by @​github-actions[bot] in #​12961
• fix: Preserve nested Bun dependency versions by @​anthonyshew in #​12965
• fix: Don't delete existing .git when using --no-git flag by @​anthonyshew in #​12968

Full Changelog: vercel/turborepo@v2.9.15...v2.9.16

v2.9.15: Turborepo v2.9.15

Compare Source

What's Changed

Changelog

• release(turborepo): 2.9.14 by @​github-actions[bot] in #​12805
• fix: Prune package.json workspaces by @​anthonyshew in #​12808
• fix: Wait for process trees before task completion by @​anthonyshew in #​12809
• release(turborepo): 2.9.15-canary.1 by @​github-actions[bot] in #​12810
• ci: Sign macOS release binaries by @​anthonyshew in #​12811
• release(turborepo): 2.9.15-canary.2 by @​github-actions[bot] in #​12812
• fix: Prevent cache archive symlink reads by @​anthonyshew in #​12813
• release(turborepo): 2.9.15-canary.3 by @​github-actions[bot] in #​12814
• fix: Avoid path-racy chmod during directory restore by @​anthonyshew in #​12815
• fix: Prevent cache restore symlink race writes by @​anthonyshew in #​12817
• chore: Deny Rust panic extraction by default by @​anthonyshew in #​12818
• fix: Make structured log symlink defense race-safe by @​anthonyshew in #​12821
• fix: Preserve Bun alias child packages by @​anthonyshew in #​12822
• fix: Avoid UTF-8 panics at boundaries by @​anthonyshew in #​12823
• fix: Preserve non-UTF-8 Git path boundaries by @​anthonyshew in #​12826
• fix: Create daemon dirs with private permissions by @​anthonyshew in #​12827
• fix: Return Berry lockfile errors instead of panicking by @​anthonyshew in #​12828
• fix: Isolate Corepack state in integration tests by @​anthonyshew in #​12831
• ci: Use larger Windows runners for Rust tests by @​anthonyshew in #​12832
• docs: Add with-vite-module-federation example by @​gioboa in #​12794
• test: Run Rust tests without partitioning by @​anthonyshew in #​12833
• chore: Remove TaskHashTracker-based expect() calls by @​anthonyshew in #​12836
• chore: Deduplicate hash canonicalization by @​anthonyshew in #​12837
• fix: Prevent Windows process drain hangs by @​anthonyshew in #​12838
• fix: Refactor execsync to execfilesync for Shell command built from environment values by @​bjormgyg in #​12829
• test: Bound vt100 random quickcheck by @​anthonyshew in #​12839
• fix: Validate daemon discovery responses by @​anthonyshew in #​12840
• fix: Store PackageGraph root invariants by @​anthonyshew in #​12841
• chore: Avoid engine graph node expects by @​anthonyshew in #​12842
• test: Make Rust tests parallel-safe by @​anthonyshew in #​12843
• fix: Avoid graph utility node lookup panics by @​anthonyshew in #​12844
• fix: Avoid graph walker expect() calls by @​anthonyshew in #​12845
• fix: Remove fs panic extraction lints by @​anthonyshew in #​12846
• fix: Remove fixed map panic extraction calls by @​anthonyshew in #​12847
• fix: Remove devtools WebSocket panics by @​anthonyshew in #​12850
• fix: Remove json rewrite panic lint allow by @​anthonyshew in #​12848
• fix: Remove turborepo-types panic lint allows by @​anthonyshew in #​12849
• chore: Remove turborepo-hash build expect by @​anthonyshew in #​12851
• fix: Remove napi panic lint allows by @​anthonyshew in #​12852
• fix: Avoid globwatch expect calls by @​anthonyshew in #​12853
• fix: Remove LSP expect callsites by @​anthonyshew in #​12854
• fix: Remove scope panic lint allows by @​anthonyshew in #​12855
• fix: Remove task hash panic lints by @​anthonyshew in #​12856
• fix: Remove frameworks panic lint allows by @​anthonyshew in #​12857
• fix: Remove microfrontends proxy expect lint allow by @​anthonyshew in #​12859
• fix: Avoid API client expect calls by @​anthonyshew in #​12858
• fix: Avoid task executor expect calls by @​anthonyshew in #​12860
• fix: Remove turbo-trace unwrap callsite by @​anthonyshew in #​12863
• fix: Remove Vercel API mock expect usage by @​anthonyshew in #​12862
• fix: Remove vt100 expect lint allow by @​anthonyshew in #​12861
• fix: Remove turborepo-shim expect callsites by @​anthonyshew in #​12864
• test: Deflake daemon existing process test by @​anthonyshew in #​12865
• fix: Avoid repository NAPI unwrap calls by @​anthonyshew in #​12866
• fix: Remove pidlock panic callsites by @​anthonyshew in #​12867
• fix: Remove telemetry panic callsites by @​anthonyshew in #​12868
• chore: Remove Rust re-export shims by @​anthonyshew in #​12870
• fix: Remove turbo-json panic lint allows by @​anthonyshew in #​12869
• fix: Remove globwalk's expect() callsites by @​anthonyshew in #​12871
• fix: Remove turbopath's expect() callsites by @​anthonyshew in #​12872
• test: Deflake Corepack prepare lock on Windows by @​anthonyshew in #​12873
• fix: Remove signals panic callsites by @​anthonyshew in #​12874
• fix: Remove turbo-trace's expect() allow by @​anthonyshew in #​12876
• fix: Remove Vercel API mock unwrap usage by @​anthonyshew in #​12877
• fix: Remove task executor unwrap usage by @​anthonyshew in #​12878
• fix: Remove run summary expect usage by @​anthonyshew in #​12879
• fix: Remove microfrontends proxy unwrap usage by @​anthonyshew in #​12880
• fix: Remove api client unwrap usage by @​anthonyshew in #​12881
• fix: Remove globwalk unwrap usage by @​anthonyshew in #​12883
• fix: Remove UI expect() usage by @​anthonyshew in #​12882
• fix: Remove microfrontends expect usage by @​anthonyshew in #​12885
• fix: Remove boundaries's expect() usage by @​anthonyshew in #​12887
• fix: Remove turborepo-process's unwrap() usage by @​anthonyshew in #​12888
• fix: Remove UI unwrap usage by @​anthonyshew in #​12889
• fix: Remove microfrontends unwrap allow by @​anthonyshew in #​12890
• fix: Remove turborepo-process's expect() usage by @​anthonyshew in #​12891
• fix: Remove scm expect usage by @​anthonyshew in #​12893
• fix: Remove auth unwrap usage by @​anthonyshew in #​12886
• fix: Remove turbopath's unwrap() usage by @​anthonyshew in #​12884
• fix: Remove auth's expect() usage by @​anthonyshew in #​12895
• fix: Remove wax unwrap usage by @​anthonyshew in #​12899
• fix: Remove scm unwrap usage by @​anthonyshew in #​12897
• fix: Remove turborepo-boundaries's unwrap() usage by @​anthonyshew in #​12896
• fix: Remove daemon unwrap usage by @​anthonyshew in #​12898
• fix: Include lockfile-changed packages in affected tasks by @​anthonyshew in #​12900
• fix: Remove turborepo-wax's expect() usage by @​anthonyshew in #​12901
• fix: Remove turborepo-filewatch's expect() usage by @​anthonyshew in #​12903
• fix: Remove turborepo-cache's expect() usage by @​anthonyshew in #​12902
• fix: Remove turborepo-daemon's expect() usage by @​anthonyshew in #​12904
• fix: Remove turborepo-engine's unwrap() usage by @​anthonyshew in #​12906
• fix: Remove filewatch unwrap usage by @​anthonyshew in #​12907
• fix: Remove engine expect usage by @​anthonyshew in #​12908
• fix: Remove cache unwrap usage by @​anthonyshew in #​12909
• fix: Remove turborepo-lockfiles expect() usage by @​anthonyshew in #​12910
• chore: Set pnpm minimum release age by @​anthonyshew in #​12912
• fix: Remove turborepo-lockfiles's unwrap() usage by @​anthonyshew in #​12911
• fix: Remove turborepo-vt100's unwrap() usage by @​anthonyshew in #​12913
• release(turborepo): 2.9.15-canary.4 by @​github-actions[bot] in #​12905
• fix: Remove turborepo-lib's unwrap() usage by @​anthonyshew in #​12915
• fix: Remove turborepo-lib's expect() usage by @​anthonyshew in #​12914
• fix: Remove shim test unwrap usage by @​anthonyshew in #​12917
• fix: Remove turbo json test unwrap allowance by @​anthonyshew in #​12918
• fix: Remove run summary test unwrap usage by @​anthonyshew in #​12916
• release(turborepo): 2.9.15-canary.5 by @​github-actions[bot] in #​12919
• fix: Restore task completion semantics by @​anthonyshew in #​12923
• fix: Preserve nested Bun workspace dependency versions by @​anthonyshew in #​12924
• release(turborepo): 2.9.15-canary.6 by @​github-actions[bot] in #​12925
• fix: Restore release PR auto-merge by @​anthonyshew in #​12927
• perf: Index repo gitignore matchers by @​anthonyshew in #​12928
• ci: Disable incremental Rust test builds by @​anthonyshew in #​12929
• perf: Trim OpenTelemetry crate features by @​anthonyshew in #​12930
• perf: Trim microfrontends proxy HTTP features by @​anthonyshew in #​12931
• fix: Accept experimentalCI object config by @​anthonyshew in #​12934
• release(turborepo): 2.9.15-canary.7 by @​github-actions[bot] in #​12935
• fix: Restore a few internal invariant checks by @​anthonyshew in #​12933
• fix: Improve profile tracing coverage by @​anthonyshew in #​12936
• fix: Use build-scale OTel duration buckets by @​anthonyshew in #​12939
• fix: Preserve pnpm injected peer package entries by @​anthonyshew in #​12940
• feat: Add heap allocation profiling by @​anthonyshew in #​12943
• release(turborepo): 2.9.15-canary.8 by @​anthonyshew in #​12945
• docs: Correct attribute presence claims in turborepo-otel by @​adityasingh2400 in #​12932
• chore(turbo-codemod): Remove duplicate "in" in transforms path comment by @​mvanhorn in #​12948
• chore: Switch Geist font imports to npm geist package by @​christopherkindl in #​12952
• fix: Respect root gitignore during prune by @​anthonyshew in #​12953
• fix: Harden OTEL endpoint validation by @​anthonyshew in #​12954

New Contributors

• @​gioboa made their first contribution in #​12794
• @​bjormgyg made their first contribution in #​12829
• @​adityasingh2400 made their first contribution in #​12932
• @​mvanhorn made their first contribution in #​12948
• @​christopherkindl made their first contribution in #​12952

Full Changelog: vercel/turborepo@v2.9.14...v2.9.15

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.