[inversify-app]

This PR contains the following updates:

Package	Change	Age	Confidence
turbo (source)	2.11.7 → 2.11.8

---

Release Notes

vercel/turborepo (turbo)

v2.11.8: Turborepo v2.11.8

Compare Source

What's Changed

Changelog

• chore: Release Turborepo 2.11.7 by @​github-actions[bot] in #​14357
• chore: Update with-vitest example by @​vercel-gh-bot-3[bot] in #​14355
• feat: Add experimental setup future flag by @​anthonyshew in #​14361
• fix: Remove Bash dependency from strict environment tests by @​vercel-gh-bot-3[bot] in #​14362
• fix: Use repository package manager for automatic Turbo downloads by @​vercel-gh-bot-3[bot] in #​14360
• chore: Improve Factory chat and model controls by @​vercel-gh-bot-3[bot] in #​14368
• chore: Add Linear connector to Factory by @​vercel-gh-bot-3[bot] in #​14369
• chore: Remove HarnessAgent from Factory by @​vercel-gh-bot-3[bot] in #​14370
• chore: Remove Factory UI clutter by @​vercel-gh-bot-2[bot] in #​14371
• feat: Add shared platform primitives for setup and shim by @​anthonyshew in #​14363
• fix: Populate task graphs for affected and filtered listings by @​sahyl in #​14366
• feat: Add bounded checksum-verifying downloads by @​anthonyshew in #​14374
• feat: Validate setup npm version requests by @​anthonyshew in #​14375
• fix: Prune unused pnpm catalog snapshots by @​vercel-gh-bot-3[bot] in #​14376
• feat: Resolve Node versions from native declarations by @​anthonyshew in #​14378
• feat: Honor tool-download proxy and certificate settings by @​anthonyshew in #​14379
• feat: Check bounded setup version-request overlap by @​anthonyshew in #​14381
• feat: Discover setup JavaScript package-manager declarations by @​anthonyshew in #​14382
• feat: Verify local artifact bytes without HTTP by @​anthonyshew in #​14383
• fix: Deflake concurrent agent guidance updates by @​anthonyshew in #​14388
• chore: Remove Linear from factory by @​anthonyshew in #​14389
• feat: Extract verified TAR archives into private staging by @​anthonyshew in #​14384
• feat: Add experimental setup command surface by @​anthonyshew in #​14385
• chore: Remove Factory branch naming restrictions by @​vercel-gh-bot-4[bot] in #​14391
• chore: Consolidate CI into one required summary by @​anthonyshew in #​14390
• docs: Clarify task graph filter traversal by @​vercel-gh-bot-2[bot] in #​14392
• feat: Extract safe Node TAR symlinks by @​anthonyshew in #​14393
• feat: Infer setup roots without package managers by @​anthonyshew in #​14395
• feat: Add atomic managed tool installation inventory by @​anthonyshew in #​14398
• fix: Invalidate managed repositories when turbo.lock changes by @​anthonyshew in #​14396
• feat: Safely extract verified ZIP archives by @​anthonyshew in #​14394
• test: Add installed-wrapper process launcher by @​anthonyshew in #​14401
• fix: Avoid duplicate code CI on pull request reviews by @​anthonyshew in #​14414
• chore(deps): Update dependency @​vercel/geistdocs to v1.28.1 by @​vercel-gh-bot-4[bot] in #​14416
• docs: Remove premature setup guidance by @​anthonyshew in #​14409
• feat: Validate portable setup tool resolutions by @​anthonyshew in #​14400
• fix: Preserve scoped tool paths and owner-executable exports by @​anthonyshew in #​14403
• fix: Preserve Node runtime failure policy provenance by @​anthonyshew in #​14406
• feat: Add an internal managed-run capability query by @​anthonyshew in #​14408
• feat: Verify bounded SHA-512 tool artifacts by @​anthonyshew in #​14411
• test: Stabilize lockfile closure parity coverage by @​anthonyshew in #​14420
• fix: Repair missing install generations and share tool readiness by @​anthonyshew in #​14404
• feat: Add secure ignored setup writer storage by @​anthonyshew in #​14407
• feat: Parse bounded Node release metadata by @​anthonyshew in #​14410
• feat: Write setup locks atomically by @​anthonyshew in #​14399
• feat: Parse bounded npm registry release metadata by @​anthonyshew in #​14412
• chore: Update with-yarn example by @​vercel-gh-bot-2[bot] in #​14364
• fix: Preserve unknown pnpm lockfile settings through prune by @​dnalborczyk in #​14423
• fix: Preserve symlinked AGENTS.md when updating agent guidance by @​drakeo338 in #​14418
• feat: Compare setup source snapshots before lock publication by @​anthonyshew in #​14428
• refactor: Add fail-closed managed CLI selection by @​anthonyshew in #​14413
• test: Isolate optional root initialization from watcher services by @​anthonyshew in #​14427
• feat: Provision locked pnpm with managed Node launchers by @​anthonyshew in #​14431
• feat: Resolve native Node.js declarations into lock selections by @​anthonyshew in #​14432
• fix: Reuse healthy Node.js across managed inventory changes by @​anthonyshew in #​14429
• fix: Support npm patches in pruned workspaces by @​vercel-gh-bot-3[bot] in #​14434
• feat: Project selected managed execution identity by @​anthonyshew in #​14430
• perf: Skip ignored directories when discovering nested .gitignore files by @​withkarann in #​14442
• test: Avoid Windows CLI teardown deadlocks by @​anthonyshew in #​14435
• test: Cover pnpm release-age exclusions during prune by @​anthonyshew in #​14440
• feat: Provision independently pinned npm with managed Node by @​anthonyshew in #​14437
• fix: Capture setup discovery context for revalidation by @​anthonyshew in #​14439
• chore: Upgrade Ghostty for Zig 0.17 by @​Mearman in #​14419
• fix: Stop add-package-names codemod from generating duplicate names by @​irontaek in #​14433
• feat: Reconcile captured JavaScript tool selections by @​anthonyshew in #​14436
• chore: Release Turborepo 2.11.8-canary.1 by @​github-actions[bot] in #​14453
• fix: Share setup TLS and guard official source policy by @​anthonyshew in #​14438
• chore: Upgrade Next.js to 16.3.8 repo-wide for CVE-2026-94483 by @​anthonyshew in #​14451
• chore: Release Turbo repository packages 0.0.1-canary.31 by @​github-actions[bot] in #​14455
• ci: Use GitHub OIDC for versioned docs aliases by @​anthonyshew in #​14454
• test: Add owned setup policy fixtures for CLI tests by @​anthonyshew in #​14456
• feat: Represent matching Node-bundled npm ownership by @​anthonyshew in #​14457
• feat: Preserve setup lock declarations during prune by @​anthonyshew in #​14459
• refactor: Add guarded setup publication primitives by @​anthonyshew in #​14460
• chore: Release Turborepo 2.11.8-canary.2 by @​github-actions[bot] in #​14458
• chore: Update non-monorepo example by @​vercel-gh-bot-4[bot] in #​14452
• feat: Provision frozen Node and pnpm through setup by @​anthonyshew in #​14462
• fix: Exclude optional npm peers from pruned lockfiles by @​anthonyshew in #​14470
• feat: Validate managed Node and pnpm readiness by @​anthonyshew in #​14464
• feat: Resolve exact verified registry artifacts for setup locks by @​anthonyshew in #​14465
• feat: Check installed setup tools without mutation by @​anthonyshew in #​14467
• feat: Resolve captured Node and pnpm lock cohorts by @​anthonyshew in #​14466
• fix: Guard setup publication plans and discovery indirections by @​anthonyshew in #​14468
• fix: Release setup locks in their acquiring process by @​anthonyshew in #​14472
• feat: Create and reconcile local setup locks by @​anthonyshew in #​14473
• feat: Refresh managed setup locks explicitly by @​anthonyshew in #​14474
• feat: Force reinstall locked setup tools by @​anthonyshew in #​14475
• feat: Bind setup records to installation generations by @​anthonyshew in #​14476
• chore: Update with-berry example by @​vercel-gh-bot-3[bot] in #​14487
• fix: Generalize repository bootstrap across toolchains by @​PedroRosalba in #​14444
• fix: Keep Go discovery stable when the repository is reached through a symlink by @​PedroRosalba in #​14445
• fix: Reject non-member local sources in the uv manifest fallback by @​PedroRosalba in #​14446
• fix: Hash ruff and pytest configuration between the root and uv members by @​PedroRosalba in #​14447
• fix: Hash Clippy configuration for Cargo lint tasks by @​PedroRosalba in #​14448
• fix: Carry uv tool configuration into pruned workspaces by @​PedroRosalba in #​14449
• fix: Report inferred framework env vars for deferred tasks in dry runs by @​PedroRosalba in #​14478
• docs: Explain declaring Cargo sources read from outside the crate by @​PedroRosalba in #​14480
• fix: Upgrade turbo-gen Handlebars to 4.7.10 by @​anthonyshew in #​14471
• chore: Add copyable Factory snapshot command by @​anthonyshew in #​14481
• feat: Validate sealed native setup baselines by @​anthonyshew in #​14482
• fix: Prevent Git index refresh during dirty hash collection by @​anthonyshew in #​14489
• fix: Disable agent guidance by default by @​anthonyshew in #​14490

New Contributors

• @​dnalborczyk made their first contribution in #​14423
• @​drakeo338 made their first contribution in #​14418
• @​withkarann made their first contribution in #​14442
• @​Mearman made their first contribution in #​14419
• @​irontaek made their first contribution in #​14433
• @​PedroRosalba made their first contribution in #​14444

Full Changelog: vercel/turborepo@v2.11.7...v2.11.8

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[changeset-bot]

⚠️ No Changeset found

Latest commit: c1aff8f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a79b786f-3beb-4e5a-ac9e-e9dbcbe40cbd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}