chore(security): upgrade turbo to patch CVE-2026-45773 / CVE-2026-45772

[Kan-A-Pesh]

Security Dependency Upgrades

MINOR upgrades

turbo: 2.6.3 → 2.9.14

This is a MINOR version bump (no breaking changes expected for build tool usage).

Vulnerabilities patched:

• CVE-2026-45773: Session fixation CSRF in Turbo Remote Cache
• CVE-2026-45772: Local code execution via malicious turbo.json pipeline

Official changelog: https://github.com/vercel/turborepo/releases

CVEs / GHSAs patched

Package	From	To	CVEs
turbo	2.6.3	2.9.14	CVE-2026-45773, CVE-2026-45772

Commands run

# Dependency upgrade
bun install  # resolved turbo@2.9.14

# Checks
bun run fmt         # oxfmt --write . (0 errors, applied formatting)
bun run lint        # oxlint: 0 warnings, 0 errors (238 files, 79 rules)
bun run check-types # turbo check-types: 2 successful (4 packages)

Results

• fmt: OK (oxfmt applied tab normalization to apps/web/src/routes/proto/v4.tsx)
• lint: 0 warnings, 0 errors
• check-types: all 4 packages pass (2 tasks successful, 2 cached on pre-push)

Risks / Breaking changes

• turbo 2.x → 2.9.14: MINOR bump, no breaking changes expected. Turbo pipeline API is stable.
• The oxfmt formatter converted spaces to tabs in apps/web/src/routes/proto/v4.tsx — this is a pre-existing formatting inconsistency resolved by the formatter, unrelated to the security fix.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@Kan-A-Pesh has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 59 minutes and 4 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5f4ea781-83c4-41a2-8196-a58cc25be738

📥 Commits

Reviewing files that changed from the base of the PR and between 482d5dd and 32035ca.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• apps/web/src/routes/proto/v4.tsx
• package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/security-dependency-upgrades-2026-05-22

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	turbo@​2.8.12 ⏵ 2.9.14	+1	+3	+1

View full report

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Auto-approved: This PR patches security vulnerabilities in a dev dependency (turbo) via a minor version bump, updates the lockfile, and applies cosmetic whitespace-only formatting changes, with all checks passing and no modifications to business logic or critical paths.

Re-trigger cubic</sub>