Update tool npm:turbo to v2.10.5

[hash-worker]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
npm:turbo (source)	2.6.3 → 2.10.5

---

Release Notes

vercel/turborepo (npm:turbo)

v2.10.5: Turborepo v2.10.5

Compare Source

What's Changed

Changelog

• perf: Evaluate simple include globs without wax compilation by @​anthonyshew in #​13285
• chore: Dogfood native Cargo support in this repository by @​anthonyshew in #​13283
• release(turborepo): 2.10.4 by @​github-actions[bot] in #​13286
• ci: Remove dead sccache configuration by @​anthonyshew in #​13289
• feat: Serve the Remote Cache as an sccache backend for Cargo tasks by @​anthonyshew in #​13288
• fix: Reject output path traversal by @​anthonyshew in #​13290
• fix: Disable the sccache proxy when remote cache use is off by @​anthonyshew in #​13291
• feat: Embed sccache so the Cargo compile cache needs no installation by @​anthonyshew in #​13293
• release(turborepo): 2.10.5-canary.1 by @​github-actions[bot] in #​13294
• fix: Pin a flag-aware turbo canary for the eve-agent deployment by @​anthonyshew in #​13295
• fix: Make the sccache compile cache actually cache by @​anthonyshew in #​13296
• release(turborepo): 2.10.5-canary.2 by @​github-actions[bot] in #​13297
• fix: Stop ambient CARGO_INCREMENTAL from suppressing compile cache injection by @​anthonyshew in #​13298
• fix: Never let compile cache storage failures fail the build by @​anthonyshew in #​13299
• test: Add outputs path-traversal negative-case regression tests by @​dnukumamras in #​13300
• release(turborepo): 2.10.5-canary.3 by @​github-actions[bot] in #​13302
• ci: Authenticate to Remote Cache via OIDC token exchange by @​anthonyshew in #​13303
• fix: Keep pnpm patches with version range keys during prune by @​anthonyshew in #​13307
• test: Scrub ambient turbo configuration from integration test children by @​anthonyshew in #​13306
• fix: Show toolchain tasks in the TUI and never run in silence by @​anthonyshew in #​13308
• ci: Fix change detection on push events by @​anthonyshew in #​13304
• refactor: Rename the Cargo toolchain id to rust by @​anthonyshew in #​13311
• fix: Remove extraneous bun.lock entries during prune by @​anthonyshew in #​13317
• feat: Require a user-declared name for the Cargo workspace package by @​anthonyshew in #​13312
• feat: Parse and validate the task command field by @​anthonyshew in #​13313
• chore: Harden turbo-vsc to invoke turbo without a shell by @​dnukumamras in #​13319
• feat: Resolve and execute task command overrides by @​anthonyshew in #​13315
• release(turborepo): 2.10.5-canary.4 by @​github-actions[bot] in #​13325
• feat: Run the Rust workspace tests through nextest via command override by @​anthonyshew in #​13316
• feat: Engage the Remote Cache and sccache compile cache for Rust CI by @​anthonyshew in #​13292
• ci: Pin GitHub Actions to full commit SHAs by @​XananasX7 in #​13143
• fix: Make npm prune rehoisting deterministic and complete by @​anthonyshew in #​13323
• feat: Report incremental cache reuse in the run summary by @​anthonyshew in #​13327
• chore: Remove planning docs by @​anthonyshew in #​13329
• docs: Migrate docs site to @​vercel/geistdocs package by @​molebox in #​13320
• ci: Update Remote Cache action by @​anthonyshew in #​13330
• release(turborepo): 2.10.5-canary.5 by @​github-actions[bot] in #​13331
• ci: Remove path-based workflow scheduling by @​anthonyshew in #​13332
• fix: Resolve EADDRINUSE in kitchen-sink api dev script by @​ashusnapx in #​13328
• ci: Disable telemetry messages in workflows by @​anthonyshew in #​13334
• fix: Prevent Cargo run tasks from being cached by @​anthonyshew in #​13335
• fix: Isolate Cargo cache by host platform by @​anthonyshew in #​13337
• fix: Continue TUI text selection beyond viewport by @​anthonyshew in #​13338
• ci: Dogfood Cargo target restoration by @​anthonyshew in #​13336
• fix: Require current Cargo lockfiles for caching by @​anthonyshew in #​13339
• fix: Reject unsupported Cargo local packages by @​anthonyshew in #​13340
• fix: Allow outputs outside package roots by @​anthonyshew in #​13342
• fix: Resolve Cargo lock dependencies by source by @​anthonyshew in #​13343
• docs: Update Cargo workspace support by @​anthonyshew in #​13349
• fix: Build Ghostty for baseline CPUs by @​anthonyshew in #​13352
• fix: Preserve watch rerun semantics for task inputs by @​anthonyshew in #​13351
• fix: Isolate Command Overrides From Toolchain Cache I/O by @​anthonyshew in #​13354
• release(turborepo): 2.10.5-canary.6 by @​github-actions[bot] in #​13355
• fix: Include patched Ghostty crate in Cargo workspace by @​anthonyshew in #​13357
• ci: Shard Rust tests across runners by @​anthonyshew in #​13356
• fix: Hash Cargo build environment inputs by @​anthonyshew in #​13348
• fix: Synchronize Cargo prune Docker lockfile by @​anthonyshew in #​13350
• chore: Update agents app Eve dependency by @​anthonyshew in #​13364
• fix: Preserve Yarn package extension ranges when pruning by @​anthonyshew in #​13363
• refactor: Add Toolchain output availability by @​anthonyshew in #​13360

New Contributors

• @​dnukumamras made their first contribution in #​13300
• @​XananasX7 made their first contribution in #​13143
• @​ashusnapx made their first contribution in #​13328

Full Changelog: vercel/turborepo@v2.10.4...v2.10.5

v2.10.4: Turborepo v2.10.4

Compare Source

What's Changed

Changelog

• release(turborepo): 2.10.3 by @​github-actions[bot] in #​13222
• ci: Retry Windows nextest aborts from transient 0xc0000142 spawn failures by @​anthonyshew in #​13240
• perf: Use mimalloc as the global allocator by @​anthonyshew in #​13237
• perf: Parse yarn v1 lockfiles in a single pass by @​anthonyshew in #​13241
• ci: Fix cache outputs for Eve app by @​anthonyshew in #​13243
• perf: Stop materializing spans for the disabled daemon log layer by @​anthonyshew in #​13244
• fix: Keep ancestor-scoped bun dependencies resolvable after prune renames by @​anthonyshew in #​13236
• perf: Overlap external dependency hashing with package file hashing by @​anthonyshew in #​13234
• perf: Build tracked repo index concurrently with package graph by @​anthonyshew in #​13232
• perf: Release tokio runtime at exit so background DNS lookups never stall the user by @​anthonyshew in #​13231
• perf: Overhaul pnpm lockfile parsing and dependency closure computation by @​anthonyshew in #​13228
• feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) by @​anthonyshew in #​13227
• feat: Introduce toolchain provider abstraction by @​anthonyshew in #​13235
• perf: Parse Berry lockfiles in a single pass by @​anthonyshew in #​13242
• fix: Apply input exclusion globs to the filesystem walk by @​anthonyshew in #​13224
• fix: Stop root-directory packages from claiming every file in change mapping by @​anthonyshew in #​13225
• chore: Rename turborepo-repository napi package to @​turbo/repository by @​anthonyshew in #​13226
• perf: Hash git blobs with hardware-accelerated SHA-1 by @​anthonyshew in #​13245
• release(turborepo): 2.10.4-canary.1 by @​github-actions[bot] in #​13247
• feat: Discover Cargo crates as packages by @​anthonyshew in #​13248
• perf: Reuse per-package external dependency hashes in run summaries by @​anthonyshew in #​13249
• perf: Stat workspace turbo.json files concurrently during discovery by @​anthonyshew in #​13251
• chore: Add tracing spans to workspace discovery and globwalk phases by @​anthonyshew in #​13252
• fix: Avoid non-reentrant libc calls in concurrent shutdown process scans by @​anthonyshew in #​13256
• perf: Memoize resolved task definitions during engine construction by @​anthonyshew in #​13257
• perf: Compute transitive closures and external dependency hashes concurrently with run setup by @​anthonyshew in #​13250
• perf: Probe microfrontends configs in parallel by @​anthonyshew in #​13262
• feat: Execute Cargo crate tasks via cargo by @​anthonyshew in #​13261
• perf: Pre-size engine task collections by @​anthonyshew in #​13265
• feat: Expose resolved experimentalCI task configuration in turbo query by @​anthonyshew in #​13264
• feat: Derive input and output globs for Cargo tasks by @​anthonyshew in #​13263
• perf: Parse large pnpm lockfile sections in parallel by @​anthonyshew in #​13266
• feat: Hash Cargo external dependencies per-crate by @​anthonyshew in #​13267
• ci: Install pnpm 10 in musl containers for Library Release by @​anthonyshew in #​13269
• ci: Force pnpm overwrite in Library Release musl containers by @​anthonyshew in #​13270
• perf: Defer the untracked-scan barrier to first file-hash use by @​anthonyshew in #​13268
• ci: Fetch API-created commit before updating local ref by @​anthonyshew in #​13271
• release(library): 0.0.1-canary.22 by @​github-actions[bot] in #​13272
• perf: Remove lock and dispatch overhead from task hash precomputation by @​anthonyshew in #​13273
• fix: Fall back to lockfile detection in @​turbo/repository when package manager is undeclared by @​anthonyshew in #​13275
• test: Add end-to-end coverage for Cargo workspaces by @​anthonyshew in #​13274
• release(library): 0.0.1-canary.23 by @​github-actions[bot] in #​13276
• release(turborepo): 2.10.4-canary.2 by @​github-actions[bot] in #​13278
• fix: Collapse nested package-manager fallback conditional by @​anthonyshew in #​13279
• feat: Make turbo watch Cargo-aware by @​anthonyshew in #​13280
• perf: Skip dependency-closure assembly for toolchains that derive nothing by @​anthonyshew in #​13277
• feat: Make turbo prune Cargo-aware by @​anthonyshew in #​13281
• fix: Raise the open-file soft limit at startup by @​anthonyshew in #​13282
• fix: Stop flagging relative imports that resolve into node_modules in boundaries by @​anthonyshew in #​13284

Full Changelog: vercel/turborepo@v2.10.3...v2.10.4

v2.10.3: Turborepo v2.10.3

Compare Source

What's Changed

Changelog

• feat: Add nub to create-turbo options by @​anthonyshew in #​13173
• release(turborepo): 2.10.2 by @​github-actions[bot] in #​13174
• release(turborepo): 2.10.3-canary.1 by @​github-actions[bot] in #​13176
• fix: Normalize package manager versions by @​anthonyshew in #​13177
• fix: Use singular workspace in package resolution error by @​anthonyshew in #​13178
• fix: Support nub native lockfiles by @​anthonyshew in #​13179
• perf(build): Enable thin LTO + codegen-units=1 for release builds by @​lukesandberg in #​13160
• release(turborepo): 2.10.3-canary.2 by @​github-actions[bot] in #​13181
• feat: Add aube package manager support by @​anthonyshew in #​13183
• release(turborepo): 2.10.3-canary.3 by @​github-actions[bot] in #​13184
• fix: Normalize package manager version output by @​anthonyshew in #​13185
• release(turborepo): 2.10.3-canary.4 by @​github-actions[bot] in #​13186
• refactor: Richer internal dependency data by @​anthonyshew in #​13188
• fix(repository): honor semver ranges in devEngines.packageManager.version by @​colinhacks in #​13189
• fix: Skip node_modules in boundaries checks by @​anthonyshew in #​13191
• fix: Add token exchange recovery guidance by @​anthonyshew in #​13192
• feat: Add --production flag to turbo prune by @​anthonyshew in #​13190
• release(turborepo): 2.10.3-canary.5 by @​github-actions[bot] in #​13193
• feat: Accept Bun lockfile version 2 by @​tsushanth in #​13119
• fix: Handle task executor join errors as internal errors by @​gwagjiug in #​13148
• fix: Tweaks for nub support by @​colinhacks in #​13187
• release(turborepo): 2.10.3-canary.6 by @​github-actions[bot] in #​13194
• release(turborepo): 2.10.3-canary.7 by @​github-actions[bot] in #​13195
• chore: Upgrade TypeScript to 7.0.1-rc by @​anthonyshew in #​13144
• docs: Add filtered installs to Vercel guide by @​anthonyshew in #​13196
• examples: add with-mcp-servers by @​Nishant-Chaudhary5338 in #​12997
• fix: Report malformed JSON parse errors instead of panicking by @​anthonyshew in #​13198
• fix: Improve error messaging when platform binary is missing by @​anthonyshew in #​13199
• release(turborepo): 2.10.3-canary.8 by @​github-actions[bot] in #​13200
• fix(watch): Recover from slow initial hash instead of timing out by @​lukesandberg in #​13159
• chore: Update vitest example to vitest 4 and use native test merging by @​abhiaagarwal in #​13202
• feat: Toggle between the TUI and streamed logs by @​anthonyshew in #​13203
• fix: Resolve Bun scoped package deps that share a name with a dependency by @​anthonyshew in #​13207
• feat: Select tasks by clicking rows in the TUI task list by @​anthonyshew in #​13206
• perf: Avoid deep-cloning dependency maps in lockfile closure cache by @​anthonyshew in #​13209
• perf: Cache root internal dependencies in package graph by @​anthonyshew in #​13211
• feat: Automatically copy TUI selection to clipboard on mouse release by @​anthonyshew in #​13208
• perf: Cache env wildcard matches across tasks during hashing by @​anthonyshew in #​13210
• perf: Replace per-package graph traversals in scope filtering by @​anthonyshew in #​13212
• perf: Derive dirty hash from repo index by @​anthonyshew in #​13213
• fix: Include untracked symlinks in repo-index dirty hash by @​anthonyshew in #​13218
• refactor: Use upstream libghostty-vt crates instead of vendored bindings by @​anthonyshew in #​13205
• fix: Remove devtools feature flag by @​anthonyshew in #​13219
• fix: Harden TUI terminal restore during shutdown by @​anthonyshew in #​13220
• fix: Correct gitignore precedence in untracked walk and memoize matcher chains by @​anthonyshew in #​13221

New Contributors

• @​lukesandberg made their first contribution in #​13160
• @​tsushanth made their first contribution in #​13119
• @​Nishant-Chaudhary5338 made their first contribution in #​12997
• @​abhiaagarwal made their first contribution in #​13202

Full Changelog: vercel/turborepo@v2.10.2...v2.10.3

v2.10.2: Turborepo v2.10.2

Compare Source

What's Changed

Changelog

• release(turborepo): 2.10.1 by @​github-actions[bot] in #​13156
• docs: Prefer devEngines packageManager by @​anthonyshew in #​13155
• fix: Install Zig for LSP builds by @​anthonyshew in #​13158
• ci: Pin macOS Rust builds to macOS 15 by @​anthonyshew in #​13167
• feat: Recognize nub as a package manager by @​colinhacks in #​13120
• fix: Preserve 3-level nested Bun lockfile entries during prune by @​anthonyshew in #​13168
• fix: Avoid following nested symlinked cache outputs by @​anthonyshew in #​13166
• feat: Add nub package manager support to JavaScript packages by @​anthonyshew in #​13169
• fix: Link ghostty-vt statically on Windows MSVC by @​anthonyshew in #​13171
• release(turborepo): 2.10.2-canary.1 by @​github-actions[bot] in #​13172

New Contributors

• @​colinhacks made their first contribution in #​13120

Full Changelog: vercel/turborepo@v2.10.1...v2.10.2

v2.10.1: Turborepo v2.10.1

Compare Source

What's Changed

Changelog

• release(turborepo): 2.10.0 by @​github-actions[bot] in #​13131
• docs: Add Turborepo 2.10 release post and update docs by @​anthonyshew in #​13096
• perf: Avoid normalizing git index path joins by @​anthonyshew in #​12944
• chore: Remove tbx package by @​anthonyshew in #​13133
• feat: Migrate TUI virtual terminals from vt100 to Ghostty by @​anthonyshew in #​13135
• chore: Add examples maintenance agent by @​anthonyshew in #​13136
• chore: Remove a few pre-push hooks by @​anthonyshew in #​13137
• ci: Making sure Zig works in releases by @​anthonyshew in #​13138
• release(turborepo): 2.10.1-canary.1 by @​github-actions[bot] in #​13139
• fix: Support Corepack packageManager integrity hashes by @​gwagjiug in #​13123
• fix(env): Add XDG_DATA_* to pass-through by @​vercel[bot] in #​13145
• release(turborepo): 2.10.1-canary.2 by @​github-actions[bot] in #​13147
• feat: Support devEngines.packageManager by @​lachieh in #​12388
• feat: Support devEngines packageManager in workspaces by @​anthonyshew in #​13150
• release(turborepo): 2.10.1-canary.3 by @​github-actions[bot] in #​13149
• feat: Update add package manager codemod by @​anthonyshew in #​13151
• feat: Update workspace package manager declarations by @​anthonyshew in #​13154

New Contributors

• @​lachieh made their first contribution in #​12388

Full Changelog: vercel/turborepo@v2.10.0...v2.10.1

v2.10.0: Turborepo v2.10.0

Compare Source

What's Changed

create-turbo

• feat: Replace package manager commands in scaffolded README files by @​DependerKumarSoni in #​6747
• chore: Update dependencies found in audits by @​anthonyshew in #​12586

@​turbo/codemod

• feat: Handle package manager catalogs in migration codemod by @​anthonyshew in #​12496
• fix: Always update $schema URL to versioned format during migration by @​anthonyshew in #​12529
• fix: Support turbo.jsonc in codemod transforms by @​anthonyshew in #​12532
• fix: Preserve prerelease info in schema URL during codemod migration by @​anthonyshew in #​12542

eslint

• chore: Upgrade dependencies to resolve their known vulnerabilities by @​anthonyshew in #​12604

@​turbo/repository

• feat: Add cacheMaxAge and cacheMaxSize for local cache eviction by @​anthonyshew in #​12487
• chore: Update to Rust 1.95.0 by @​ognevny in #​12636

@​turbo/telemetry

• fix: Suppress telemetry alert when running on Vercel by @​anthonyshew in #​12576

Examples

• feat(examples): Add Next.js + Elysia full-stack starter template by @​eastgold15 in #​12414
• build(deps): Bump @​xmldom/xmldom from 0.8.11 to 0.8.12 in /examples/with-react-native-web by @​dependabot[bot] in #​12537
• fix: Add missing @types/node to with-svelte example apps by @​anthonyshew in #​12585
• feat(sandbox): Bump @​vercel/sandbox from v1 to beta by @​marc-vercel in #​12595
• chore: Update examples to Turbo 2.9.6 by @​cursor[bot] in #​12600
• examples: Add Ultracite example by @​haydenbleasel in #​12615

Changelog

• docs: Release post for 2.9 by @​anthonyshew in #​12441
• docs: Add documentation for cacheMaxAge and cacheMaxSize options by @​anthonyshew in #​12500
• fix: Resolve correct nested bun lockfile versions during prune by @​anthonyshew in #​12506
• Revert "fix: Avoid setsid() in PTY spawn to prevent macOS Gatekeeper CPU spikes" by @​anthonyshew in #​12507
• fix: Unblock watch loop so interruptible persistent tasks restart on file changes by @​anthonyshew in #​12509
• fix(api-client): Treat * as wildcard in preflight Access-Control-Allow-Headers by @​bitttttten in #​12503
• docs: Document turbo.* generator variables by @​anthonyshew in #​12511
• fix: Backfill missing pnpm workspace importer entries during prune by @​anthonyshew in #​12514
• fix: Include transitive dependencies in engine graph pruning for affected paths using Task Graph by @​anthonyshew in #​12516
• fix: Update AI-generated response disclaimer to include human attribution by @​anthonyshew with @​Copilot in #​12517
• fix: Preserve shallow install strategy during npm lockfile pruning by @​anthonyshew in #​12520
• fix: Preserve per-workspace lockfiles during pnpm pruning by @​anthonyshew in #​12519
• feat: Add incremental task caching by @​anthonyshew in #​12531
• docs: Send siteId as label on feedback GitHub issues by @​molebox in #​12527
• Replace local ai-agent-detection with @​vercel/agent-readability by @​molebox in #​12528
• fix: Prevent filterUsingTasks --filter from pulling dependents into Task Graph by @​anthonyshew in #​12535
• fix: Only enforce signature key length for keys that exist by @​anthonyshew in #​12538
• fix: Validate engine concurrency after task-level filtering by @​anthonyshew in #​12540
• feat: Allow --affected and --filter to be combined by @​anthonyshew in #​12543
• fix(config): Deep-merge nested OTEL config across priority sources by @​bitttttten in #​12513
• fix: Retain microfrontend proxy tasks when using filterUsingTasks by @​anthonyshew in #​12545
• fix: Bun workspace lockfile pruning producing invalid output by @​JRoy in #​12548
• fix: Respect dirty .gitignore patterns during task input hashing by @​anthonyshew in #​12557
• feat: Add circular package dependency detection to boundaries by @​anthonyshew in #​12567
• perf: Increase remote cache upload chunk size from 8KB to 256KB by @​anthonyshew in #​12568
• perf: Parallelize boundaries checking with Rayon and cache DFS traversals by @​anthonyshew in #​12569
• docs: Add Bun equivalent for updating dependencies by @​anthonyshew in #​12580
• fix: Mention turbo.json in concurrency error message by @​anthonyshew in #​12582
• fix: Surface actionable message when remote cache is requested but not linked by @​anthonyshew in #​12584
• chore: Delete agents app by @​anthonyshew in #​12587
• fix: Load custom CA certificates in fast webpki-only HTTP client by @​anthonyshew in #​12591
• docs: Remove pre-release badges by @​anthonyshew in #​12592
• fix: Align Markdown docs routing with docs/md endpoints by @​molebox in #​12596
• fix: Support two-dot git ranges in filter selectors by @​anthonyshew in #​12599
• feat: Graceful shutdown by @​anthonyshew in #​12607
• test: Add stdin EOF startup regression coverage by @​anthonyshew in #​12609
• fix: Ignore SIGINT in shim after spawning local turbo by @​anthonyshew in #​12612
• fix: Support pnpm v11 multi-document lockfiles by @​anthonyshew in #​12616
• fix: Preserve graceful shutdown exit code by @​anthonyshew in #​12620
• fix: Keep Node wrapper alive during graceful shutdown by @​anthonyshew in #​12622
• fix: Preserve PTY graceful shutdown semantics by @​anthonyshew in #​12624
• feat: Move Vercel auth to standard OAuth/device flows by @​markandrus in #​12526
• fix: Preserve legacy Vercel auth compatibility by @​anthonyshew in #​12629
• fix: Recover Vercel auth tokens across login flows by @​anthonyshew in #​12631
• docs: Fix TURBO_PLATFORM_ENV_DISABLED value in docs (true, not false) by @​sleitor in #​12633
• chore: Update flags SDK by @​AndyBitz in #​12646
• ci: Disable AWS-backed sccache by @​anthonyshew in #​12663
• fix: Prevent prune from overmatching gitignore entries by @​anthonyshew in #​12662
• ci: Harden release API commits by @​anthonyshew in #​12664
• ci: Fix release API commit paths by @​anthonyshew in #​12665
• release(turborepo): 2.9.7-canary.14 by @​github-actions[bot] in #​12666
• chore: Add tbx sandbox helper by @​anthonyshew in #​12668
• fix: Allow npm registry in tbx sandboxes by @​anthonyshew in #​12669
• fix: Install turbo globally in tbx base by @​anthonyshew in #​12670
• docs: Clarify package hash file inputs by @​anthonyshew in #​12671
• fix: Allow tbx sandboxes to use stale bases by @​anthonyshew in #​12672
• fix: Install dotfiles during tbx base refresh by @​anthonyshew in #​12673
• fix: Improve tbx sandbox startup by @​anthonyshew in #​12674
• fix: Improve tbx sandbox startup defaults by @​anthonyshew in #​12675
• fix: Support pnpm 11 flat patch lockfiles by @​anthonyshew in #​12676
• docs: Fix link to passthrough variables source code by @​Wartijn in #​12643
• release(turborepo): 2.9.7-canary.15 by @​github-actions[bot] in #​12677
• fix: Avoid rerunning non-cacheable watch dependencies by @​anthonyshew in #​12678
• release(turborepo): 2.9.7 by @​github-actions[bot] in #​12679
• test: Add regression for gitignored output restore by @​anthonyshew in #​12681
• docs: Clarify root task guidance by @​anthonyshew in #​12683
• fix: Preserve concrete dependency precedence by @​anthonyshew in #​12682
• release(turborepo): 2.9.8-canary.1 by [@​github-actions](https://redirect.github.com/gith

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 4am every weekday,every weekend"
• Automerge
  • "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview, Comment	Jul 27, 2026 5:36pm
hashdotdesign-tokens	Ready	Preview, Comment	Jul 27, 2026 5:36pm
petrinaut	Ready	Preview, Comment	Jul 27, 2026 5:36pm

[cursor]

PR Summary

Low Risk
Single dependency version pin in mise config with no code changes; main risk is regressions in turbo behavior across the 2.6→2.10 release line affecting builds or caching.

Overview
Bumps the Turborepo CLI version pinned in mise (.config/mise/config.toml) from 2.6.3 to 2.10.5, so local and CI environments that install tools via mise get the newer monorepo runner used by tasks such as turbo run.

No application or turbo.json config changes—only the toolchain version.

^{Reviewed by Cursor Bugbot for commit a8d5726. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.73%. Comparing base (6736174) to head (2bb6cd2).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8844   +/-   ##
=======================================
  Coverage   59.73%   59.73%           
=======================================
  Files        1371     1371           
  Lines      135461   135461           
  Branches     6066     6066           
=======================================
+ Hits        80911    80915    +4     
+ Misses      53618    53614    -4     
  Partials      932      932           

Flag	Coverage Δ
apps.hash-ai-worker-ts	1.39% <ø> (ø)
apps.hash-api	6.39% <ø> (ø)
blockprotocol.type-system	40.84% <ø> (ø)
local.claude-hooks	0.00% <ø> (ø)
local.harpc-client	51.49% <ø> (ø)
local.hash-backend-utils	1.90% <ø> (ø)
local.hash-graph-sdk	10.02% <ø> (ø)
local.hash-isomorphic-utils	0.18% <ø> (ø)
rust.antsi	0.00% <ø> (ø)
rust.error-stack	90.89% <ø> (ø)
rust.harpc-codec	84.70% <ø> (ø)
rust.harpc-net	96.26% <ø> (+0.06%)	⬆️
rust.harpc-tower	67.03% <ø> (ø)
rust.harpc-types	0.00% <ø> (ø)
rust.harpc-wire-protocol	92.23% <ø> (ø)
rust.hash-codec	72.76% <ø> (ø)
rust.hash-graph-api	7.41% <ø> (ø)
rust.hash-graph-authorization	62.59% <ø> (ø)
rust.hash-graph-embeddings	91.88% <ø> (ø)
rust.hash-graph-postgres-store	29.13% <ø> (ø)
rust.hash-graph-store	38.47% <ø> (ø)
rust.hash-graph-temporal-versioning	47.95% <ø> (ø)
rust.hash-graph-types	0.00% <ø> (ø)
rust.hash-graph-validation	84.71% <ø> (ø)
rust.hashql-ast	89.63% <ø> (ø)
rust.hashql-compiletest	28.39% <ø> (ø)
rust.hashql-core	78.98% <ø> (ø)
rust.hashql-diagnostics	72.51% <ø> (ø)
rust.hashql-eval	80.04% <ø> (ø)
rust.hashql-hir	89.09% <ø> (ø)
rust.hashql-mir	87.92% <ø> (ø)
rust.hashql-syntax-jexpr	94.04% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codspeed-hq]

Merging this PR will degrade performance by 15.38%

❌ 2 regressed benchmarks
✅ 96 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	bit_matrix/dense/iter_row[64]	140.8 ns	170 ns	-17.16%
❌	bit_matrix/dense/iter_row[200]	185.8 ns	215 ns	-13.57%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing deps/tool/turbo-monorepo (2bb6cd2) with main (5a90775)}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 566388e. Configure here.}

[cursor]

Mise lock not bumped with turbo

Medium Severity

The npm:turbo pin is raised to 2.10.0 here while lockfile is enabled and .config/mise/mise.lock still records 2.6.3. GitHub Actions and the AI worker Docker build use mise install --locked, so those paths keep installing the old turbo until the lockfile is regenerated.

 

^{Reviewed by Cursor Bugbot for commit 566388e. Configure here.}