chore(deps): update dependency turbo to v2.9.14 [security]#479
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update dependency turbo to v2.9.14 [security]#479renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.9.12→2.9.14Turbo: Unexpected local code execution during Yarn Berry detection
CVE-2026-45772 / GHSA-3qcw-2rhx-2726
More information
Details
Impact
Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected versions, package manager detection executed
yarn --versionfrom the project directory, which could cause Yarn to load and execute a project-controlledyarnPathfrom.yarnrc.yml. An attacker who controls repository contents could cause code execution when a user or CI system runs affectedturbo,@turbo/codemod, or@turbo/workspaceconversion commands.Fix
Turbo now avoids executing project-local Yarn during package manager detection. Yarn versions and paths are inferred from metadata such as
package.json, parsing the value ofyarnPathin.yarnrc.ymlrather than executing it, andyarn.lock, and unrecognized Yarn lockfile formats are rejected instead of falling back to executingyarn.Workarounds
If you cannot upgrade immediately, do not run Turborepo commands in untrusted repositories. Review or remove
.yarnrc.ymlfiles that defineyarnPathbefore running Turborepo, especially in CI or automated tooling that processes external projects.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Trubo: Login callback CSRF/session fixation
CVE-2026-45773 / GHSA-hcf7-66rw-9f5r
More information
Details
Impact
Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback. While the CLI was waiting for authentication, a malicious web page could send a request to the local callback server with an attacker-controlled token. If accepted before the legitimate callback, the CLI could complete login with the wrong credentials.
This affects users authenticating the
turboCLI against self-hosted remote cache/auth endpoints. Vercel-hosted login flows using device authorization are not affected.Fix
The login and SSO redirect flows now generate a random state value, include it in the browser authentication URL, and require the same value on the localhost callback before accepting a token. Callbacks with a missing or mismatched state are rejected.
Workarounds
If you cannot upgrade immediately, avoid browser-based self-hosted
turbo loginor SSO flows on machines that may load untrusted web content during authentication. Use a pre-provisioned token or environment-based authentication instead.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:H/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
vercel/turborepo (turbo)
v2.9.14: Turborepo v2.9.14Compare Source
High:
Low:
What's Changed
Changelog
pull_requestfor PR title linting by @anthonyshew in #12787New Contributors
Full Changelog: vercel/turborepo@v2.9.12...v2.9.14
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.