🔐 deps: turbo 2.x closes two advisories instead of deferring them to November

[Juma Allan (jumaallan)]

User description

Story: N/A — dependency security

Summary

turbo 1.13.4 carries two advisories, GHSA-3qcw-2rhx-2726 and GHSA-hcf7-66rw-9f5r. They were
allowlisted in osv-scanner.toml until November because the fix is a major version. This
upgrades to 2.10.10 and removes the entries, so they are fixed rather than deferred.

• turbo.json's top-level pipeline key becomes tasks, which turbo 2 requires. The official
  codemod (@turbo/codemod migrate --from 1.13.4 --to 2.10.10 --dry) reports 13 transforms with
  every one unchanged or skipped except that rename, so nothing else in this config needs to move.

• The two IgnoredVulns blocks for turbo come out of osv-scanner.toml. Nothing else in that file
  changed.

• Three transitive dev-only packages picked up eight advisories after the August triage, which is why the audit has been red on main since 31 August: vm2 3.11.5, browserslist 4.25.1 and decode-uri-component 0.2.2. All three are reachable by a lockfile refresh, so they move to 3.12.0, 4.28.8 and 0.5.0 instead of joining the allowlist; decode-uri-component is pinned through resolutions because its fix sits outside query-string's ^0.2.2.
  Verified the advisories are actually gone rather than merely unlisted: scanning with no config at
  all reports neither GHSA anywhere in the tree.

The risk worth checking here was CI's contract with turbo, since ci.yml parses turbo's JSON to
decide whether to restore a cache:

node -p "($(yarn turbo run build:ios --dry=json)).tasks.find(t => t.task === 'build:ios').cache.status"

That still works under turbo 2 — confirmed field by field for both build:ios and build:android:
the top level still has tasks, and each task still exposes cache.status.

Known Issues

• turbo 2 changes how a bare directory in inputs is hashed: 1.13.4 hashed nothing for it, 2.x
  expands it to every file beneath. turbo.json's negations still say example/… while the
  workspace directory is sample/, and build:ios is declared in sample/package.json, so
  inputs resolve relative to sample/ — meaning bare ios now pulls in sample/ios/Pods
  (19,501 inputs locally, versus 67 without Pods) and !example/ios/Pods excludes nothing.
  Measured consequence: the iOS cache probe hashes before pod install and the build hashes
  after, so build:ios will always report MISS and the "Cache cocoapods" step will keep running.
  CI still passes and the probe output stays small (~10 KB, well under the argv limit), so this is
  slower, not broken.
  I deliberately did not fix the globs in this PR. Correcting them changes cache keys, and a
  wrong correction risks the opposite failure — a false cache hit that skips a build that should
  have run. That is worse than a slow build, and it deserves its own change with someone watching
  the first few runs.
• Not run: the real build:android / build:ios compiles. Only --dry=json was exercised, which
  is what CI's probe uses; the compile steps themselves are untouched by this diff.

Test Instructions

corepack yarn install
corepack yarn turbo --version                    # 2.10.10
corepack yarn turbo run build:ios --dry=json     # parses; .tasks[] contains build:ios with cache.status
corepack yarn lint && corepack yarn typecheck && corepack yarn test && corepack yarn prepare
osv-scanner --config=osv-scanner.toml --lockfile=yarn.lock --format=table   # No issues found

The Security Audit workflow (OSV Scanner over yarn.lock) is the check that was red on main; it should be green on this branch.

Lint passes with the three pre-existing no-bitwise warnings in sample/src/HomeScreen.tsx,
unchanged by this work.

Screenshot

N/A — no UI changes.

---

PR Type

Enhancement

---

Description

• Upgrade turbo devDependency to ^2.10.10

• Rename turbo.json pipeline key to tasks

• Drop two turbo advisory allowlist entries

---

Diagram Walkthrough

flowchart LR
  A["turbo ^1.10.7"] -- "major upgrade" --> B["turbo ^2.10.10"]
  B -- "schema rename" --> C["turbo.json: pipeline to tasks"]
  B -- "advisories fixed" --> D["osv-scanner.toml: 2 IgnoredVulns removed"]

Loading

File Walkthrough

	Relevant files
Dependencies	package.json Bump turbo devDependency to 2.x                                                    package.json Bump turbo devDependency from ^1.10.7 to ^2.10.10. +1/-1
Configuration changes	turbo.json Migrate turbo config to turbo 2 schema                                      turbo.json Rename the top-level pipeline key to tasks, as required by turbo 2. Task definitions themselves are unchanged. +1/-1      osv-scanner.toml Remove turbo advisory allowlist entries                                    osv-scanner.toml Remove the IgnoredVulns entry for GHSA-3qcw-2rhx-2726. Remove the IgnoredVulns entry for GHSA-hcf7-66rw-9f5r. Both advisories are now resolved by the turbo 2.x upgrade rather than deferred. +0/-10

---

---

Need help?

Type /help how to ... in the comments thread for any questions about PR-Agent usage.

Check out the documentation for more information.

[prfectionist]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🏅 Score: 88

🧪 No relevant tests

🔒 No security concerns identified

🔀 No multiple PR themes

⚡ Recommended focus areas for review Config Compatibility The pipeline -> tasks rename makes turbo.json valid only for turbo 2.x. Since the Android native version is host-overridable and contributors may have a stale node_modules with turbo 1.x, any environment resolving turbo 1.13.x will now fail to read this config. Worth confirming the lockfile is regenerated in the same change so CI and local installs both land on 2.10.10 (the diff does not show a yarn.lock update). "tasks": {

[github-actions]

🔍 Semgrep Security Scan Results

✅ No security findings detected by p/security-audit ruleset.

[github-actions]

This PR is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 7 days.