Repository navigation
chore(deps-dev): bump turbo from 2.11.3 to 2.11.7 - #483
Conversation
Bumps [turbo](https://github.com/vercel/turborepo) from 2.11.3 to 2.11.7. - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.11.3...v2.11.7) --- updated-dependencies: - dependency-name: turbo dependency-version: 2.11.7 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 2d869d5. Configure here.
|
|
||
| xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz: | ||
| resolution: {integrity: sha512-oLDq3jw7AcLqKWH2AhCpVTZl8mf6X2YReP+Neh0SJUzV/BdZYjth94tG5toiMB1PPrYtxOCfaoUCkvtuH+3AJA==, tarball: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz} | ||
| resolution: {tarball: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz} |
There was a problem hiding this comment.
Lockfile drops xlsx tarball integrity
Medium Severity
The lockfile rewrite dropped the integrity hash from the xlsx tarball fetched from cdn.sheetjs.com. pnpm can no longer verify that package, and newer pnpm versions fail install with ERR_PNPM_MISSING_TARBALL_INTEGRITY.
Reviewed by Cursor Bugbot for commit 2d869d5. Configure here.
1 participant
Bumps turbo from 2.11.3 to 2.11.7.
Release notes
Sourced from turbo's releases.
... (truncated)
Commits
547747fpublish 2.11.7 to registry3ce82f5fix: Ignore Vercel OIDC token rotation in .env.local cache inputs (#14356)8cc3ccechore: Update with-vite-module-federation example (#14349)41387defix: Pass SDKROOT through to repository tasks (#14353)3a2072cchore: Release Turborepo 2.11.6 (#14352)90718d1fix: Infer single-package mode for query commands (#14351)a409ce5fix: Complete taskquerymetadata for non-script entrypoints (#14350)bc7c148feat: Filter tasks by tags in the CLI (#14345)49d1607feat: Filterquerytasks and packages by tags (#14344)fba5351feat: Expose task and package tags inquery(#14343)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Dev-only dependency bump with lockfile refresh; no application runtime or auth/data path changes.
Overview
Bumps the Turborepo dev dependency from 2.11.3 to 2.11.7 in the root
package.jsonandsites/mainweb/package.json, withpnpm-lock.yamlupdated forturbo, its platform-specific@turbo/*binaries, andeslint-plugin-turbo’s peer resolution.This is a patch/minor tooling upgrade only; monorepo scripts (
dev,build,lint,typecheck) still run throughturbowith no config changes in this PR.Reviewed by Cursor Bugbot for commit 2d869d5. Bugbot is set up for automated code reviews on this repo. Configure here.