chore(deps): refresh turbo security bump

[bntvllnt]

Summary

Closes #503
Supersedes #490

Updates root Turbo from lockfile-resolved 2.8.3 to 2.10.10. Diff is limited to package.json and pnpm-lock.yaml: six renamed platform optional packages and existing ESLint Turbo peer bindings; no unrelated dependency drift.

Independent review

No blocking findings. Reviewed every lockfile hunk. Turbo 2.10.10 exceeds the 2.9.14 fixes for GHSA-hcf7-66rw-9f5r and GHSA-3qcw-2rhx-2726. Package version stays 0.4.0; release workflow unchanged.

Verification at HEAD f5ee000

Quality Gates: frozen installation, pnpm -F @vllnt/ui lint, pnpm -F @vllnt/ui exec tsc --noEmit --project tsconfig.build.json, pnpm build and pnpm test:once all passed. Tests: 327 files / 1718 tests. Registry lint/drift/integrity and story verification/build also passed.

CI ran the synthetic merge; coordinator verified its tree equals the raw PR head tree: 81ea4b8e66ee5224ae294771db07fe1e4e23198d. Current main 38db630 is an ancestor of this head. No local rerun claimed. All currently reported GitHub checks pass, including E2E, React Doctor and CodeQL.

Release and recovery

User authorized landing via PR; preserve automatic 0.4.0 canary behavior. No stable workflow dispatch or latest-tag mutation. Recovery is a normal revert PR if post-merge checks regress. Cross-platform #479/#506 is excluded from this change.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[bntvllnt]

Review — PR #504 @ d972845

BLOCKING

• S1 — lockfile contains unrelated toolchain drift beyond the Turbo security bump
  • Evidence: package.json only changes the root devDependency from turbo: ^2.4.4 to ^2.10.10, but pnpm-lock.yaml also refreshes unrelated Vite/Storybook toolchain resolutions, including vite@7.3.2 dependencies from esbuild 0.27.3 -> 0.27.7, postcss 8.5.10 -> 8.5.26, rollup 4.59.0 -> 4.62.4, and tinyglobby 0.2.15 -> 0.2.17 (pnpm-lock.yaml:16704-16709).
  • Cross-check: from a fresh origin/main worktree, pnpm add -Dw turbo@2.10.10 --lockfile-only produced the same package.json change but only a 130-line lockfile diff; this PR has a 741-line lockfile diff. So the extra lockfile churn is not required for the Turbo bump.
  • Why it matters: this PR is scoped as a security refresh/supersession of Dependabot chore(deps-dev): bump turbo from 2.8.3 to 2.9.14 in the npm_and_yarn group across 1 directory #490. Pulling unrelated build-tool patches into the same lockfile widens the dependency review surface and makes rollback/security attribution harder.
  • Fix: regenerate the branch from current origin/main with a minimal root Turbo update only, e.g. pnpm add -Dw turbo@2.10.10 --lockfile-only, then re-run pnpm install --frozen-lockfile and the existing CI gates. If the Vite/Storybook transitive refresh is intentional, split it into its own dependency PR or state the extra scope explicitly with rationale.

WARN

• W1 — local full react-doctor remains red, although PR-diff CI passes
  • Evidence: current-head CI Scan codebase health passed the PR-diff react-doctor step, but local pnpm doctor:errors on this worktree exits 1 with existing repo-wide errors outside this dependency-only diff.
  • Suggested next step: do not treat the local full-scan failures as introduced by this PR, but keep relying on the PR-diff react-doctor CI result for this dependency-only review.

VERIFIED CLEAN

• Reviewed every changed file and surrounding context: package.json, pnpm-lock.yaml.
• PR metadata is aligned with the refreshed supersession: title/branch are dependency-only, PR body says Related to #503 and Supersedes #490; PR Issue Link CI passes. GitHub closingIssuesReferences is empty because the PR uses Related to, which is allowed by repo rules for partial/dependency tracking.
• Dependency/security rationale is real: origin/main audit reports turbo@2.8.3 advisories GHSA-3qcw-2rhx-2726 and GHSA-hcf7-66rw-9f5r; current head audit no longer reports Turbo advisories. npm view turbo reports latest 2.10.10, matching the PR target.
• Lockfile integrity is mechanically valid: pnpm install --frozen-lockfile passes at head.
• No source/UI/generated registry files are touched.
• Viewed-state coverage marked for both changed files.

VALIDATION

• Current head verified: d9728458e027e2bec214e9bb49738d8c1430d92e.
• Live GitHub checks at current head: Quality Gates pass; E2E (Playwright) pass; react-doctor Scan codebase health pass; CodeQL pass (Analyze (actions), Analyze (javascript-typescript), and summary CodeQL); PR Issue Link pass.
• Local commands run:
  • pnpm install --frozen-lockfile — pass.
  • pnpm audit --dev --json on origin/main — Turbo advisories present for 2.8.3.
  • pnpm audit --dev --json on PR head — no Turbo advisory hits; audit still exits 1 due unrelated existing advisories.
  • pnpm doctor:errors — fail on existing repo-wide non-diff errors, not used as PR-specific blocker.
  • git diff --check origin/main...HEAD — pass.
  • Minimal-update comparison from fresh origin/main: pnpm add -Dw turbo@2.10.10 --lockfile-only — pass, lockfile diff materially smaller than PR.

Recommendation: REQUEST CHANGES before manual approval. Next human action: ask the author/agent to remove the unrelated lockfile drift or explicitly split/justify the additional Vite/Storybook transitive refresh; do not merge PR #504 as-is.

[bntvllnt]

@bntvllnt current-head re-review for PR #504 at f5ee000284484f369af4162fa6e84aec3f7586f9:

Review — clean / manual approval ready

VERIFIED CLEAN

• Changed files are limited to package.json and pnpm-lock.yaml (+38/-38 total).
• package.json only bumps root devDependencies.turbo from ^2.4.4 to ^2.10.10.
• Lockfile drift is limited to Turbo resolution updates: turbo@2.8.3 -> 2.10.10, renamed platform optional packages turbo-* -> @turbo/*, and the expected @vllnt/eslint-config / eslint-plugin-turbo peer snapshot rebinding to turbo@2.10.10.
• Re-checked the prior blocker: changed lockfile lines contain no unrelated Vite / Storybook / Rollup / Esbuild / Babel drift.
• PR body is now truthful for the current head and remains linked via Related to #503 plus Supersedes #490.
• GitHub checks for this head are green: Quality Gates, E2E, CodeQL, issue-link gate, codebase health scan, and CodeQL analysis checks.

VALIDATION

• pnpm install --frozen-lockfile — pass; clean working tree afterward.
• pnpm why turbo --recursive — pass; paths are root turbo plus @vllnt/eslint-config -> eslint-plugin-turbo -> turbo peers.
• pnpm -F @vllnt/ui lint — pass.
• pnpm -F @vllnt/ui exec tsc --noEmit --project tsconfig.build.json — pass.
• pnpm build — pass.
• NODE_OPTIONS='--localstorage-file=/tmp/vllnt-ui-vitest-localstorage-t_78547d91-review.json' pnpm test:once — pass (@vllnt/ui: 318 files / 1671 tests; workspace total 2 tasks successful).

No blocking findings remain from the Turbo scope review. Approval is recommended; final merge/approval remains manual.