Skip to content

🔐 deps: turbo 2.x closes two advisories instead of deferring them to November #241

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Juma Allan (jumaallan) wants to merge 4 commits into from
Closed

🔐 deps: turbo 2.x closes two advisories instead of deferring them to November #241

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
eb70401
🔐 deps: upgrade turbo to 2.x so its two advisories are fixed, not def…
jumaallan Aug 14, 2026
0368cf5
🐛 ci(turbo): restore env passthrough so the native builds find the SDK
jumaallan Aug 14, 2026
601ebb8
Merge branch 'main' into chore/turbo-2
jumaallan Sep 2, 2026
c780ce1
🛡️ deps: refresh the three transitive packages OSV started flagging a…
jumaallan Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 0 additions & 10 deletions osv-scanner.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,13 +87,3 @@ reason = "tmp 0.0.33 via external-editor and patch-package. Fix is 0.2.x, and a
id = "GHSA-ph9p-34f9-6g65"
ignoreUntil = 2026-11-14
reason = "tmp 0.0.33 via external-editor and patch-package. Fix is 0.2.x, outside the ^0.0.33 range. Dev-only."

[[IgnoredVulns]]
id = "GHSA-3qcw-2rhx-2726"
ignoreUntil = 2026-11-14
reason = "turbo 1.13.4, a direct devDependency pinned ^1.10.7. Fix is 2.x, which changes turbo.json's schema (pipeline -> tasks), so it needs its own change. Build-time only."

[[IgnoredVulns]]
id = "GHSA-hcf7-66rw-9f5r"
ignoreUntil = 2026-11-14
reason = "turbo 1.13.4, a direct devDependency pinned ^1.10.7. Fix is 2.x, a schema-changing major. Build-time only."
3 changes: 2 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,11 +67,12 @@
"react-native": "0.74.2",
"react-native-builder-bob": "^0.20.0",
"release-it": "^15.0.0",
"turbo": "^1.10.7",
"turbo": "^2.10.10",
"typescript": "^5.2.2"
},
"resolutions": {
"@types/react": "^18.2.44",
"decode-uri-component": "^0.5.0",
"fast-xml-parser": "^5.7.0"
},
"peerDependencies": {
Expand Down
3 changes: 2 additions & 1 deletion turbo.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
{
"$schema": "https://turbo.build/schema.json",
"pipeline": {
"envMode": "loose",
"tasks": {
Comment thread
jumaallan marked this conversation as resolved.
"build:android": {
"inputs": [
"package.json",
Comment thread
jumaallan marked this conversation as resolved.
Expand Down
192 changes: 101 additions & 91 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3425,7 +3425,7 @@ __metadata:
react-native: 0.74.2
react-native-builder-bob: ^0.20.0
release-it: ^15.0.0
turbo: ^1.10.7
turbo: ^2.10.10
typescript: ^5.2.2
peerDependencies:
react: "*"
Expand Down Expand Up @@ -3470,6 +3470,48 @@ __metadata:
languageName: node
linkType: hard

"@turbo/darwin-64@npm:2.10.10":
version: 2.10.10
resolution: "@turbo/darwin-64@npm:2.10.10"
conditions: os=darwin & cpu=x64
languageName: node
linkType: hard

"@turbo/darwin-arm64@npm:2.10.10":
version: 2.10.10
resolution: "@turbo/darwin-arm64@npm:2.10.10"
conditions: os=darwin & cpu=arm64
languageName: node
linkType: hard

"@turbo/linux-64@npm:2.10.10":
version: 2.10.10
resolution: "@turbo/linux-64@npm:2.10.10"
conditions: (os=android | os=linux) & cpu=x64
languageName: node
linkType: hard

"@turbo/linux-arm64@npm:2.10.10":
version: 2.10.10
resolution: "@turbo/linux-arm64@npm:2.10.10"
conditions: (os=android | os=linux) & cpu=arm64
languageName: node
linkType: hard

"@turbo/windows-64@npm:2.10.10":
version: 2.10.10
resolution: "@turbo/windows-64@npm:2.10.10"
conditions: os=win32 & cpu=x64
languageName: node
linkType: hard

"@turbo/windows-arm64@npm:2.10.10":
version: 2.10.10
resolution: "@turbo/windows-arm64@npm:2.10.10"
conditions: os=win32 & cpu=arm64
languageName: node
linkType: hard

"@types/babel__core@npm:^7.1.14":
version: 7.20.5
resolution: "@types/babel__core@npm:7.20.5"
Expand Down Expand Up @@ -4456,6 +4498,15 @@ __metadata:
languageName: node
linkType: hard

"baseline-browser-mapping@npm:^2.11.12":
version: 2.11.20
resolution: "baseline-browser-mapping@npm:2.11.20"
bin:
baseline-browser-mapping: dist/cli.cjs
checksum: 57304eb3e402e6ee43836dc5695d0680db1381054ee25dd02dc703eeac9b760f6bb5e3e94ab4a1d09cffa44eac3e56fda10bfa5364a951256149fd55b62f4df1
languageName: node
linkType: hard

"basic-ftp@npm:^5.0.2":
version: 5.3.1
resolution: "basic-ftp@npm:5.3.1"
Expand Down Expand Up @@ -4553,16 +4604,17 @@ __metadata:
linkType: hard

"browserslist@npm:^4.20.4, browserslist@npm:^4.24.0, browserslist@npm:^4.25.1":
version: 4.25.1
resolution: "browserslist@npm:4.25.1"
dependencies:
caniuse-lite: ^1.0.30001726
electron-to-chromium: ^1.5.173
node-releases: ^2.0.19
update-browserslist-db: ^1.1.3
version: 4.28.8
resolution: "browserslist@npm:4.28.8"
dependencies:
baseline-browser-mapping: ^2.11.12
caniuse-lite: ^1.0.30001809
electron-to-chromium: ^1.5.402
node-releases: ^2.0.53
update-browserslist-db: ^1.3.0
bin:
browserslist: cli.js
checksum: 2a7e4317e809b09a436456221a1fcb8ccbd101bada187ed217f7a07a9e42ced822c7c86a0a4333d7d1b4e6e0c859d201732ffff1585d6bcacd8d226f6ddce7e3
checksum: cf6e9dd104a26ba88c2a56d319f7f659c4ee1384960f601331cfb75bb05826033245587026a25903d4745cbaac251203dcfc6e3a869e60f359686138bd551554
languageName: node
linkType: hard

Expand Down Expand Up @@ -4768,10 +4820,10 @@ __metadata:
languageName: node
linkType: hard

"caniuse-lite@npm:^1.0.30001726":
version: 1.0.30001731
resolution: "caniuse-lite@npm:1.0.30001731"
checksum: ecd2ad779f31011bef657c0104a08a780d9bb38ff8ad7aeeeaf196151be22c492de87f4a9c89a30ea4aa9575c5a39c85bf6bd56e89a4bf8259f54a4fbfc24a0d
"caniuse-lite@npm:^1.0.30001809":
version: 1.0.30001810
resolution: "caniuse-lite@npm:1.0.30001810"
checksum: 4ff2dae8df59eb5f5ae71c4803666cf581459a9432c7cf016afd85f4f110774fb9c6469a62ff69a73ed7be5a7eae27988656c3acf56bceed7b0f24358426a5a8
languageName: node
linkType: hard

Expand Down Expand Up @@ -5623,10 +5675,10 @@ __metadata:
languageName: node
linkType: hard

"decode-uri-component@npm:^0.2.2":
version: 0.2.2
resolution: "decode-uri-component@npm:0.2.2"
checksum: 95476a7d28f267292ce745eac3524a9079058bbb35767b76e3ee87d42e34cd0275d2eb19d9d08c3e167f97556e8a2872747f5e65cbebcac8b0c98d83e285f139
"decode-uri-component@npm:^0.5.0":
version: 0.5.0
resolution: "decode-uri-component@npm:0.5.0"
checksum: b5ea6417714cf2da39a4e59095a9572fe3a47aab08abbbe08a330ba11a96d937d3948565e5739fb9c7f48f278222e69a4e4e6356eb6f7b88643eba264f1d07b8
languageName: node
linkType: hard

Expand Down Expand Up @@ -5922,10 +5974,10 @@ __metadata:
languageName: node
linkType: hard

"electron-to-chromium@npm:^1.5.173":
version: 1.5.195
resolution: "electron-to-chromium@npm:1.5.195"
checksum: 8002cb96a6ce87e6c64a3b5c3f71bb852a41a232312151b5c057f79c75aee76c948468bfabf0cd5aab082d28c39c6a4e0dce2b7d479a29ba2016a2e024796dba
"electron-to-chromium@npm:^1.5.402":
version: 1.5.420
resolution: "electron-to-chromium@npm:1.5.420"
checksum: 95e7380d639da34f75b2964f64579042bd8b15847f4582eff19f0520fc5919605a2bdd7b3359c04ad9f8019573dc3374efb3b91ea1b85855876654da93d3ca63
languageName: node
linkType: hard

Expand Down Expand Up @@ -10435,10 +10487,10 @@ __metadata:
languageName: node
linkType: hard

"node-releases@npm:^2.0.19":
version: 2.0.19
resolution: "node-releases@npm:2.0.19"
checksum: 917dbced519f48c6289a44830a0ca6dc944c3ee9243c468ebd8515a41c97c8b2c256edb7f3f750416bc37952cc9608684e6483c7b6c6f39f6bd8d86c52cfe658
"node-releases@npm:^2.0.53":
version: 2.0.54
resolution: "node-releases@npm:2.0.54"
checksum: 34dd32cb489b71306e25014ccc5ddd2a1793ba13aed75dcbb6f7ec144fa093030cb91781d1d296fb7105987f42f23d3877a1ec0913702be4412f2493fdfe3102
languageName: node
linkType: hard

Expand Down Expand Up @@ -13238,74 +13290,32 @@ __metadata:
languageName: node
linkType: hard

"turbo-darwin-64@npm:1.13.4":
version: 1.13.4
resolution: "turbo-darwin-64@npm:1.13.4"
conditions: os=darwin & cpu=x64
languageName: node
linkType: hard

"turbo-darwin-arm64@npm:1.13.4":
version: 1.13.4
resolution: "turbo-darwin-arm64@npm:1.13.4"
conditions: os=darwin & cpu=arm64
languageName: node
linkType: hard

"turbo-linux-64@npm:1.13.4":
version: 1.13.4
resolution: "turbo-linux-64@npm:1.13.4"
conditions: os=linux & cpu=x64
languageName: node
linkType: hard

"turbo-linux-arm64@npm:1.13.4":
version: 1.13.4
resolution: "turbo-linux-arm64@npm:1.13.4"
conditions: os=linux & cpu=arm64
languageName: node
linkType: hard

"turbo-windows-64@npm:1.13.4":
version: 1.13.4
resolution: "turbo-windows-64@npm:1.13.4"
conditions: os=win32 & cpu=x64
languageName: node
linkType: hard

"turbo-windows-arm64@npm:1.13.4":
version: 1.13.4
resolution: "turbo-windows-arm64@npm:1.13.4"
conditions: os=win32 & cpu=arm64
languageName: node
linkType: hard

"turbo@npm:^1.10.7":
version: 1.13.4
resolution: "turbo@npm:1.13.4"
dependencies:
turbo-darwin-64: 1.13.4
turbo-darwin-arm64: 1.13.4
turbo-linux-64: 1.13.4
turbo-linux-arm64: 1.13.4
turbo-windows-64: 1.13.4
turbo-windows-arm64: 1.13.4
"turbo@npm:^2.10.10":
version: 2.10.10
resolution: "turbo@npm:2.10.10"
dependencies:
"@turbo/darwin-64": 2.10.10
"@turbo/darwin-arm64": 2.10.10
"@turbo/linux-64": 2.10.10
"@turbo/linux-arm64": 2.10.10
"@turbo/windows-64": 2.10.10
"@turbo/windows-arm64": 2.10.10
dependenciesMeta:
turbo-darwin-64:
"@turbo/darwin-64":
optional: true
turbo-darwin-arm64:
"@turbo/darwin-arm64":
optional: true
turbo-linux-64:
"@turbo/linux-64":
optional: true
turbo-linux-arm64:
"@turbo/linux-arm64":
optional: true
turbo-windows-64:
"@turbo/windows-64":
optional: true
turbo-windows-arm64:
"@turbo/windows-arm64":
optional: true
bin:
turbo: bin/turbo
checksum: 94533f700dbbb7b556a7152ef04500a44b571232daf1eb9bd82bcfebac473d0cf45a78c851325c6867246656cb0b3be7c62a412381b6e85c77c1eddf51302778
checksum: bfb31a042af20cf8219aef7054dd273434a5357e9f1520c0d704146d719bb7383726c25bf8fb7dcb6d12d9c1937e9efbe909cb913c1ce9892a34d65004ef610b
languageName: node
linkType: hard

Expand Down Expand Up @@ -13614,17 +13624,17 @@ __metadata:
languageName: node
linkType: hard

"update-browserslist-db@npm:^1.1.3":
version: 1.1.3
resolution: "update-browserslist-db@npm:1.1.3"
"update-browserslist-db@npm:^1.3.0":
version: 1.3.2
resolution: "update-browserslist-db@npm:1.3.2"
dependencies:
escalade: ^3.2.0
picocolors: ^1.1.1
peerDependencies:
browserslist: ">= 4.21.0"
bin:
update-browserslist-db: cli.js
checksum: 7b6d8d08c34af25ee435bccac542bedcb9e57c710f3c42421615631a80aa6dd28b0a81c9d2afbef53799d482fb41453f714b8a7a0a8003e3b4ec8fb1abb819af
checksum: 68b13d54c6da73d22fe36820ed3d32226811b3837386ec9cf2cf866d3c958fc5522946c20123867456cc199dcb952103a1d2a26d6b3b6eb47a317551ea24ea72
languageName: node
linkType: hard

Expand Down Expand Up @@ -13732,14 +13742,14 @@ __metadata:
linkType: hard

"vm2@npm:^3.9.19":
version: 3.11.5
resolution: "vm2@npm:3.11.5"
version: 3.12.0
resolution: "vm2@npm:3.12.0"
dependencies:
acorn: ^8.15.0
acorn-walk: ^8.3.4
bin:
vm2: bin/vm2
checksum: f45b09f28df96696bb5869b0c0e9acf0a91d9dbc27c0e64b0e500480c6de33d92d645bd5b2bc56a9466ee4b8f856d02eb45d1b165d4b957cc7e5f10d9dccdc77
checksum: 2b107fb79361fded3403afa32b32e6a15d9c281bd505ef1cc695dbcac36c28ce7c3f840b1eeb0980537695be6cae3173190f53df27392b3f498bdf7eaa235c7f
languageName: node
linkType: hard

Expand Down
Loading