chore(deps): update dependency turbo to v2.11.7

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
turbo (source)	2.11.3 → 2.11.7

---

Release Notes

vercel/turborepo (turbo)

v2.11.7: Turborepo v2.11.7

Compare Source

What's Changed

Changelog

• chore: Release Turborepo 2.11.6 by @​github-actions[bot] in #​14352
• fix: Pass SDKROOT through to repository tasks by @​anthonyshew in #​14353
• chore: Update with-vite-module-federation example by @​vercel-gh-bot-5[bot] in #​14349
• fix: Ignore Vercel OIDC token rotation in .env.local cache inputs by @​anthonyshew in #​14356

Full Changelog: vercel/turborepo@v2.11.6...v2.11.7

v2.11.6: Turborepo v2.11.6

Compare Source

What's Changed

Changelog

• chore: Release Turborepo 2.11.5 by @​github-actions[bot] in #​14329
• fix: Upgrade standalone turbo on installer reruns by @​anthonyshew in #​14330
• test: Deflake OpenTelemetry and PTY shutdown tests by @​anthonyshew in #​14331
• docs: Document standalone turbo installation by @​anthonyshew in #​14332
• ci: Install standalone turbo on Windows with PowerShell by @​anthonyshew in #​14334
• fix: Keep Yarn patch resolutions with npm protocol selectors in prune by @​anthonyshew in #​14337
• chore: Update with-tailwind example by @​vercel-gh-bot-5[bot] in #​14264
• ci: Resolve latest turbo release with workflow token by @​anthonyshew in #​14339
• chore: Update with-ultracite example by @​vercel-gh-bot-5[bot] in #​14335
• fix: Match production MFE negative lookaheads locally by @​kitfoster in #​13496
• docs: Add missing system environment variables and run flags by @​BABTUNA in #​13811
• fix: Normalize task inputs consistently for affected detection and hashing by @​anthonyshew in #​14341
• feat: Add task tags with configuration inheritance by @​anthonyshew in #​14342
• fix: Upgrade brace-expansion to latest compatible releases by @​anthonyshew in #​14347
• docs: Point security.txt to Vercel HackerOne program by @​swarnava in #​14346
• test: Deflake untracked scan-scope assertions by @​anthonyshew in #​14348
• feat: Expose task and package tags in query by @​anthonyshew in #​14343
• feat: Filter query tasks and packages by tags by @​anthonyshew in #​14344
• feat: Filter tasks by tags in the CLI by @​anthonyshew in #​14345
• fix: Complete task query metadata for non-script entrypoints by @​anthonyshew in #​14350
• fix: Infer single-package mode for query commands by @​anthonyshew in #​14351

New Contributors

• @​swarnava made their first contribution in #​14346

Full Changelog: vercel/turborepo@v2.11.5...v2.11.6

v2.11.5: Turborepo v2.11.5

Compare Source

What's Changed

Changelog

• chore: Release Turborepo 2.11.4 by @​github-actions[bot] in #​14231
• test: Move Python opt-in hint into filter contracts by @​anthonyshew in #​14228
• test: Move dependency-output summary assertion into contract by @​anthonyshew in #​14230
• test: Move dependency-output selection and validation cases to engine contracts by @​anthonyshew in #​14232
• test: Move Cargo exclude-only scope coverage by @​anthonyshew in #​14238
• test: Move Cargo cache-authority cases to contracts by @​anthonyshew in #​14240
• test: Move JIT dependency graph scenario into engine contract by @​anthonyshew in #​14235
• test: Move dependency-output hash cases into task-hash contracts by @​anthonyshew in #​14233
• test: Move Cargo task-filter cases into crate contracts by @​anthonyshew in #​14239
• test: Move JIT input hash timing cases into task-hash contracts by @​anthonyshew in #​14234
• test: Move package input normalization cases into engine contracts by @​anthonyshew in #​14236
• test: Move structured startup and JIT input cases into contracts by @​anthonyshew in #​14237
• fix: Back off remote artifact requests during outages by @​anthonyshew in #​14222
• chore: Release Turborepo 2.11.5-canary.1 by @​github-actions[bot] in #​14245
• test: Make new-package lockfile filter deterministic by @​anthonyshew in #​14241
• test: Trim redundant Go cache builds by @​anthonyshew in #​14242
• test: Reduce Go versioned-name test matrix by @​anthonyshew in #​14243
• test: Move Go binary checks into contracts by @​anthonyshew in #​14246
• test: Consolidate Go format smokes by @​anthonyshew in #​14244
• test: Reuse Cargo build artifacts safely by @​anthonyshew in #​14247
• test: Separate prune planning matrix from buildability smoke by @​anthonyshew in #​14248
• feat: Bundle docs in turbo npm package by @​anthonyshew in #​14108
• chore: Release Turborepo 2.11.5-canary.2 by @​github-actions[bot] in #​14249
• fix: Stabilize pnpm per-workspace lockfile hashes by @​anthonyshew in #​14253
• chore: Upgrade factory Next.js to 16.3.3 by @​anthonyshew in #​14254
• fix: Update js-yaml to address CVE-2026-84375 by @​anthonyshew in #​14255
• chore: Upgrade Next.js in docs and factory for CVE-2026-94545 by @​anthonyshew in #​14256
• fix: Remove unmaintained proc-macro-error2 by @​anthonyshew in #​14257
• refactor: Replace clap in production CLIs with usage-rs by @​anthonyshew in #​14259
• chore: Remove tiny-gradient dependency by @​anthonyshew in #​14260
• refactor: Replace human-panic with local crash reporting by @​anthonyshew in #​14261
• chore: Remove unused struct_iterable dependency by @​anthonyshew in #​14258
• fix: Sign complete on-disk artifacts after local cache writes by @​anthonyshew in #​14265
• chore: Remove derive_setters dependency by @​anthonyshew in #​14266
• chore: Remove port_scanner dependency by @​anthonyshew in #​14267
• chore: Remove unused Rust dependency declarations by @​anthonyshew in #​14268
• refactor: Remove unused public Rust APIs by @​anthonyshew in #​14269
• refactor: Use workspace Rust edition across crates by @​anthonyshew in #​14270
• chore: Clean up Rust Clippy exceptions by @​anthonyshew in #​14271
• refactor: Group task-hash and uv generation context by @​anthonyshew in #​14279
• refactor: Remove unused global hash wrapper by @​anthonyshew in #​14281
• refactor: Remove unused file-hash telemetry argument by @​anthonyshew in #​14282
• refactor: Remove dead CLI code and crate-wide allowance by @​anthonyshew in #​14283
• refactor: Remove dead Microfrontends config code by @​anthonyshew in #​14284
• refactor: Remove unused UI task types and dead-code allowance by @​anthonyshew in #​14286
• refactor: Remove unused Cache archive test helper and dead code allowance by @​anthonyshew in #​14287
• chore: Narrow Run dead-code allowances by @​anthonyshew in #​14285
• chore: Remove resolved TODO markers by @​anthonyshew in #​14288
• fix: Use map_while for invariant text prefixes by @​anthonyshew in #​14289
• test: Cover globwalk parent traversal by @​anthonyshew in #​14290
• fix: Wait for watcher setup with Tokio wait_for by @​anthonyshew in #​14292
• test: Exercise SCM package hashing for symlinks by @​anthonyshew in #​14291
• fix: Reject empty tokens when reading token files by @​anthonyshew in #​14293
• test: Verify Yarn transparent workspace handling by @​anthonyshew in #​14294
• fix: Format pnpm v5 package names by @​anthonyshew in #​14295
• fix: Report package manager error source paths by @​anthonyshew in #​14296
• fix: Resolve LSP task references with JSONC AST by @​anthonyshew in #​14298
• chore: Remove stale package watcher TODO by @​anthonyshew in #​14299
• fix: Validate scope selector glob bases by @​anthonyshew in #​14300
• fix: Add path context to globwatch errors by @​anthonyshew in #​14301
• docs: Document wax pattern and walk semantics by @​anthonyshew in #​14302
• chore: Remove resolved filewatch input-set TODO by @​anthonyshew in #​14303
• docs: Document FSEvents event translation by @​anthonyshew in #​14305
• refactor: Group run-cache task context by @​anthonyshew in #​14304
• chore: Document package watcher task-input filtering by @​anthonyshew in #​14306
• chore: Remove stale const_format lint workaround by @​anthonyshew in #​14307
• refactor: Route regex groups through Grouping by @​anthonyshew in #​14308
• perf: Parse character classes without compiling regex by @​anthonyshew in #​14310
• chore: Drop unused Biome dependencies from turbopath by @​anthonyshew in #​14311
• chore: Unify jsonc-parser versions by @​anthonyshew in #​14312
• chore: Remove error-only dependency edges by @​anthonyshew in #​14313
• perf: Emit casing flags only when they change by @​anthonyshew in #​14309
• perf: Avoid formatting Bun lockfiles during parsing by @​anthonyshew in #​14314
• test: Assert process manager stop postconditions by @​anthonyshew in #​14297
• perf: Serve a static GraphiQL page by @​anthonyshew in #​14315
• perf: Upgrade serde_json to reduce CLI size by @​anthonyshew in #​14316
• perf: Upgrade Ratatui to reduce TUI allocations by @​anthonyshew in #​14317
• fix: Restore TUI log streaming after Ratatui upgrade by @​anthonyshew in #​14318
• feat: Add version-matched agent guidance by @​anthonyshew in #​14250
• fix: Restore Rust builds after agent guidance changes by @​anthonyshew in #​14319
• chore: Release Turborepo 2.11.5-canary.3 by @​github-actions[bot] in #​14320
• docs: Update Turborepo schema URL example by @​yousefdawood7 in #​14321
• feat: Publish versioned standalone turbo archives by @​anthonyshew in #​14322
• fix: Run standalone archive job on manual releases by @​anthonyshew in #​14323
• chore: Release Turborepo 2.11.5-canary.4 by @​github-actions[bot] in #​14324
• feat: Add standalone installers URLs for curl | bash by @​anthonyshew in #​14325
• fix: Isolate installer test environment by @​anthonyshew in #​14326
• fix: Pass repository to release asset commands by @​anthonyshew in #​14327
• chore: Release Turborepo 2.11.5-canary.5 by @​anthonyshew in #​14328

New Contributors

• @​yousefdawood7 made their first contribution in #​14321

Full Changelog: vercel/turborepo@v2.11.4...v2.11.5

v2.11.4: Turborepo v2.11.4

Compare Source

What's Changed

Changelog

• fix: Respect negated global dependencies in affected detection by @​anthonyshew in #​14164
• chore: Release Turborepo 2.11.3 by @​github-actions[bot] in #​14165
• test: Share Go compilation caches across integration tests by @​anthonyshew in #​14166
• refactor: Add injectable manifest loading to repository graphs by @​anthonyshew in #​14167
• test: Move Go and Cargo scope planning into crate tests by @​anthonyshew in #​14168
• refactor: Extract subprocess-free Go observation assembly by @​anthonyshew in #​14169
• test: Move Cargo environment hash contracts into crates by @​anthonyshew in #​14170
• test: Move Cargo output layout matrices to repository contracts by @​anthonyshew in #​14171
• test: Cover Go discovery identities in memory by @​anthonyshew in #​14172
• test: Cover Go hash inputs in repository contracts by @​anthonyshew in #​14174
• test: Move uv hash input contracts into crates by @​anthonyshew in #​14175
• test: Cover Go task selection in the engine by @​anthonyshew in #​14173
• test: Inject uv discovery for native task contracts by @​anthonyshew in #​14176
• test: Inject query contracts over repository graphs by @​anthonyshew in #​14177
• test: Inject dry-run task summary contracts by @​anthonyshew in #​14178
• test: Expose prune workspace selection plan by @​anthonyshew in #​14179
• test: Inject change detection at scope entry point by @​anthonyshew in #​14180
• test: Move uv lock affectedness planning into repository contracts by @​anthonyshew in #​14184
• test: Use virtual clock for package watcher events by @​anthonyshew in #​14181
• test: Move Cargo task query and dry-run planning into contracts by @​anthonyshew in #​14185
• test: Move uv quality query and dry-run projections into contracts by @​anthonyshew in #​14186
• test: Move JavaScript hash and framework projections into contracts by @​anthonyshew in #​14188
• test: Cover prune closure and native layout plans in process by @​anthonyshew in #​14189
• test: Cover mixed-toolchain scope filters through injection by @​anthonyshew in #​14190
• test: Make package watcher suppression and rediscovery deterministic by @​anthonyshew in #​14191
• test: Inject watch run lifecycle and event collection by @​anthonyshew in #​14192
• test: Move recursive root-script guard into process-free contract by @​anthonyshew in #​14193
• test: Move Go query and summary parity into crate contracts by @​anthonyshew in #​14187
• test: Remove duplicate CLI filter matrix cases by @​anthonyshew in #​14194
• test: Trim duplicate prune materialization cases by @​anthonyshew in #​14195
• test: Match Go library summary path on Windows by @​anthonyshew in #​14197
• test: Cover mixed-toolchain watch task selection in process by @​anthonyshew in #​14196
• test: Preserve Windows SystemRoot in strict-env fixture by @​anthonyshew in #​14198
• test: Retain real watch smokes after selection migration by @​anthonyshew in #​14199
• fix: Only reject secondary go.work files Go reads for workspace members by @​voiys in #​14183
• test: Split Go north-star cache invalidation into hash contracts by @​anthonyshew in #​14201
• test: Avoid deleting built prune output in cross-toolchain prune test by @​anthonyshew in #​14202
• test: Move turbo.json validation cases into crate contracts by @​anthonyshew in #​14203
• chore: Update with-solid example by @​vercel-gh-bot-2[bot] in #​14200
• refactor: Split RunBuilder execution context construction into phases by @​anthonyshew in #​14204
• refactor: Inject remote cache status probe by @​anthonyshew in #​14205
• refactor: Inject inputs into config resolution by @​anthonyshew in #​14206
• feat: Add affected query APIs to turborepo-query by @​anthonyshew in #​14207
• refactor: Wire CLI through affected query APIs by @​anthonyshew in #​14208
• feat: Add pure microfrontend port resolver by @​anthonyshew in #​14209
• refactor: Inject change detection into affected run paths by @​anthonyshew in #​14210
• test: Move affectedTasks planning cases into query contracts by @​anthonyshew in #​14214
• refactor: Route get-mfe-port through the pure resolver by @​anthonyshew in #​14215
• test: Count native discovery for JavaScript-only selections by @​anthonyshew in #​14216
• fix: Disable remote cache after unrecoverable forbidden responses by @​anthonyshew in #​14218
• perf: Send cache analytics in larger batches by @​anthonyshew in #​14219
• perf: Batch dry-run remote cache existence checks by @​anthonyshew in #​14220
• test: Move config precedence cases into funnel contracts by @​anthonyshew in #​14217
• test: Move affected run planning into RunBuilder contracts by @​anthonyshew in #​14212
• fix: Coordinate artifact requests after rate limiting by @​anthonyshew in #​14221
• fix: Share concurrent remote-cache token recovery by @​anthonyshew in #​14223
• refactor: Make repository context inputs injectable by @​anthonyshew in #​14224
• refactor: Group Run state into execution and services contexts by @​anthonyshew in #​14225
• test: Move Cargo prune layout checks into in-process plan contracts by @​anthonyshew in #​14226
• test: Move Cargo and Go discovery cases into contracts by @​anthonyshew in #​14227
• fix: Put version in turbo query JSON output instead of a separate banner by @​anthonyshew in #​14229

New Contributors

• @​voiys made their first contribution in #​14183

Full Changelog: vercel/turborepo@v2.11.3...v2.11.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3e73d45

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR