## Release v2.8.12-canary.3

Versioned docs: https://v2-8-12-canary-3.turborepo.dev

### Changes

- fix: Prevent peerDependencies from overwriting concrete dependency
specifiers (#12004) (`a038409`)
- ci: Trigger prysk integration tests via `cargo nextest` (#11999)
(`2053ede`)
- release(turborepo): 2.8.12-canary.2 (#12005) (`dccfdf0`)
- fix: Resolve correct nested package version in bun lockfile pruning
(#12008) (`95dff45`)
- refactor: Replace shell-based fixture setup with pure Rust (#12006)
(`a743e38`)
- fix: Resolve all lockfile pruning test failures (#12009) (`21dcaed`)
- perf: Extract query module into turborepo-query crate (#12007)
(`0604379`)
- refactor: Migrate dry-json prysk tests to Rust + insta snapshots
(#12010) (`2606f3f`)
- perf: Deduplicate petgraph, fixedbitset, and dashmap (#12011)
(`9b11ef6`)
- refactor: Migrate persistent-dependencies and task-dependencies to
Rust + insta (#12012) (`9aab7b5`)
- test: Add lockfile-tests fixture for issue #12013 (#12014) (`bae81f7`)
- perf: Remove libgit2/git2 dependency, replace with gix-object (#12015)
(`fbf50e5`)
- refactor: Migrate daemon, jsonc, query, edit-turbo-json tests to Rust
(#12016) (`bf730d5`)
- perf: Remove async-graphql from turborepo-lib (#12017) (`7c8a4a0`)
- refactor: Migrate inference and run-logging tests to Rust (#12018)
(`dc4f922`)
- refactor: Migrate run-caching and strict-env-vars tests to Rust
(#12020) (`c07645d`)
- fix: Mark lockfile-aware-caching/bun prysk test as flaky (#12021)
(`c60f0c1`)
- fix: Add nextest retries for flaky tests (#12027) (`9d90270`)
- refactor: Migrate prune and run-summary tests to Rust (#12022)
(`329bdb5`)
- ci: Increase Rust test partitions from 4 to 10 (#12028) (`0c1bd47`)
- fix: Add nextest retries for flaky prysk tests (#12030) (`9b66431`)
- ci: Use larger runners for macOS Rust tests (#12029) (`9479a54`)
- fix: Add nextest retries for flaky
prune_test::test_prune_composable_config (#12032) (`b47e099`)
- fix: Suppress npm upgrade notices in Rust integration tests (#12033)
(`f698b04`)
- ci: Disable flaky Rust unit tests from release pipeline (#12034)
(`829b351`)

---------

Co-authored-by: Turbobot <turbobot@vercel.com>

…ed (#12228)

## Summary

Fixes #12156

- When `turbo prune` removes the hoisted (top-level) version of a
package but keeps a nested version (e.g., `"accepts/negotiator" →
negotiator@0.6.3`), the pruned lockfile now promotes the nested entry to
top-level to maintain bun's lockfile invariant
- Adds regression tests for both simple and deeply-nested promotion
chains
- Adds a check-lockfiles fixture from the issue reporter's real-world
lockfile

## Background

Bun lockfiles store nested entries like `"accepts/negotiator"` only as
overrides of a hoisted top-level entry (`"negotiator"`). PR #12008
introduced exact version matching for nested entries during transitive
closure computation, which correctly resolves the right nested version.
However, when the hoisted version isn't needed by the pruned workspace,
the subgraph output contained orphaned nested entries without their
required top-level anchors. `bun install --frozen-lockfile` rejects this
structural mismatch.

## How it works

After the existing orphan removal step in `BunLockfile::subgraph()`, a
new promotion loop:

1. Identifies nested entries whose package name has no corresponding
top-level entry
2. Promotes the shallowest such entry to top-level (renames
`"accepts/negotiator"` → `"negotiator"`)
3. Renames children accordingly (e.g., `"accepts/negotiator/dep"` →
`"negotiator/dep"`)
4. Repeats until stable (handles deeply nested chains like
`chalk/ansi-styles/color-convert/color-name`)

When multiple nested versions exist for the same package, one is
promoted and the rest remain as valid nested overrides.

## Testing

- `test_nested_entries_promoted_when_hoisted_version_pruned` — core
regression test
- `test_nested_promotion_deep_chain` — multi-level chain promotion
- `lockfile-tests/fixtures/bun-v1-issue-12156/` — real-world lockfile
fixture for check-lockfiles