chore(deps): update dependency turbo to v2.9.14

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
turbo (source)	2.9.9 → 2.9.14

---

Release Notes

vercel/turborepo (turbo)

v2.9.14: Turborepo v2.9.14

Compare Source

[!NOTE]
This release contains important security fixes.

High:

• GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection

Low:

• GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation
• GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection

What's Changed

Changelog

• release(turborepo): 2.9.12 by @​github-actions[bot] in #​12774
• fix: Restore docs mobile menu by @​anthonyshew in #​12782
• ci: Use pull_request for PR title linting by @​anthonyshew in #​12787
• ci: Scope GitHub Actions caches by branch by @​anthonyshew in #​12788
• test: Validate lockfiles without dependency downloads by @​anthonyshew in #​12789
• Removed unneeded import form hash creation script in docs by @​dancrumb in #​12799
• fix: Validate auth callback state by @​anthonyshew in #​12802
• fix: Harden VS Code extension command execution by @​anthonyshew in #​12800
• fix: Avoid project-local Yarn during detection by @​anthonyshew in #​12801
• chore: Release 2.9.13 by @​anthonyshew in #​12803

New Contributors

• @​dancrumb made their first contribution in #​12799

Full Changelog: vercel/turborepo@v2.9.12...v2.9.14

v2.9.12: Turborepo v2.9.12

Compare Source

What's Changed

Changelog

• release(turborepo): 2.9.11 by @​github-actions[bot] in #​12771
• fix: Allow transit nodes in LSP diagnostics by @​anthonyshew in #​12773

Full Changelog: vercel/turborepo@v2.9.11...v2.9.12

v2.9.11: Turborepo v2.9.11

Compare Source

What's Changed

Changelog

• release(turborepo): 2.9.10 by @​github-actions[bot] in #​12745
• ci: Publish VS Code extension on release by @​anthonyshew in #​12747
• fix: Start daemon for VSCode Extension from the extension itself by @​anthonyshew in #​12749
• release(turborepo): 2.9.11-canary.1 by @​github-actions[bot] in #​12748
• fix: Include file URIs in LSP lifecycle logs by @​anthonyshew in #​12751
• fix: Handle JSON decoration visitor depth by @​anthonyshew in #​12752
• fix: Resolve relative turbo path in VS Code extension by @​anthonyshew in #​12753
• fix: Preserve Bun nested dependencies during prune by @​anthonyshew in #​12754
• fix: Prefer installed Turbo for LSP by @​anthonyshew in #​12755
• release(turborepo): 2.9.11-canary.2 by @​github-actions[bot] in #​12750
• ci: Parallelize LSP release publishing by @​anthonyshew in #​12758
• fix: Reduce VS Code extension startup popups by @​anthonyshew in #​12759
• fix: Support turbo.jsonc in VS Code extension by @​anthonyshew in #​12760
• fix: Remove VS Code task key gradient by @​anthonyshew in #​12761
• release(turborepo): 2.9.11-canary.3 by @​github-actions[bot] in #​12756
• chore: Release v2.9.11-canary.4 by @​anthonyshew in #​12762
• ci: Stop VS Code publish from blocking release PR by @​anthonyshew in #​12763
• release(turborepo): 2.9.11-canary.5 by @​github-actions[bot] in #​12764
• fix: Publish VS Code extension from release tag by @​anthonyshew in #​12765
• fix: Support shimmed VS Code LSP probes by @​anthonyshew in #​12767
• release(turborepo): 2.9.11-canary.6 by @​github-actions[bot] in #​12766
• release(turborepo): 2.9.11-canary.7 by @​github-actions[bot] in #​12768
• fix: Allow $TURBO_EXTENDS$ in LSP diagnostics by @​anthonyshew in #​12770

Full Changelog: vercel/turborepo@v2.9.10...v2.9.11

v2.9.10: Turborepo v2.9.10

Compare Source

What's Changed

Changelog

• release(turborepo): 2.9.9-canary.4 by @​github-actions[bot] in #​12716
• release(turborepo): 2.9.9 by @​github-actions[bot] in #​12719
• fix: Respect SCM env vars in turbo query affected by @​anthonyshew in #​12722
• ci: Package VSCode extension in release workflow by @​anthonyshew in #​12723
• fix: Avoid some raw create-turbo example telemetry by @​anthonyshew in #​12725
• fix: Escape graph HTML payloads by @​anthonyshew in #​12726
• fix: Prevent OTEL token injection to spoofed origins by @​anthonyshew in #​12727
• fix: Retry HTTP status failures by @​anthonyshew in #​12728
• fix: Validate microfrontend proxy Host header by @​anthonyshew in #​12730
• fix: Redact task hash env debug logs by @​anthonyshew in #​12733
• fix: Filter microfrontend proxy environments by @​anthonyshew in #​12732
• fix: Preserve FSEvents mount points for device-relative paths by @​anthonyshew in #​12729
• fix: Validate proxy Host headers by @​anthonyshew in #​12731
• fix: Resolve TypeScript .js extension imports to .ts files in boundaries by @​maschwenk in #​12644
• fix: Use random temp path for repo downloads by @​anthonyshew in #​12736
• release(turborepo): 2.9.10-canary.1 by @​github-actions[bot] in #​12734
• fix: Reject OTel endpoints with userinfo by @​anthonyshew in #​12737
• fix: Authenticate local devtools WebSocket by @​anthonyshew in #​12738
• fix: Handle clipboard exec errors by @​anthonyshew in #​12739
• fix: Restrict Vercel token reuse to trusted API origins by @​anthonyshew in #​12740
• fix: Keep workspace config discovery inside root by @​anthonyshew in #​12741
• fix: Hardening for daemon IPC endpoints by @​anthonyshew in #​12742
• fix: Enforce cache filesystem boundaries by @​anthonyshew in #​12743

Full Changelog: vercel/turborepo@v2.9.9...v2.9.10

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.