Skip to content

fix: Keep workspace config discovery inside root#12741

Merged
anthonyshew merged 1 commit into
mainfrom
shew/codemod-config-discovery
May 7, 2026
Merged

fix: Keep workspace config discovery inside root#12741
anthonyshew merged 1 commit into
mainfrom
shew/codemod-config-discovery

Conversation

@anthonyshew

@anthonyshew anthonyshew commented May 7, 2026

Copy link
Copy Markdown
Contributor
  • Keep workspace config discovery scoped to the selected Turborepo root.
  • Ignore workspace patterns that resolve outside that root before returning configs to callers.
  • Add regression coverage for escaped and absolute workspace patterns.

@anthonyshew anthonyshew requested a review from a team as a code owner May 7, 2026 14:14
@anthonyshew anthonyshew requested review from tknickman and removed request for a team May 7, 2026 14:14
@vercel

vercel Bot commented May 7, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
examples-basic-web Ready Ready Preview, Comment, Open in v0 May 7, 2026 2:15pm
examples-designsystem-docs Ready Ready Preview, Comment, Open in v0 May 7, 2026 2:15pm
examples-gatsby-web Ready Ready Preview, Comment, Open in v0 May 7, 2026 2:15pm
examples-kitchensink-blog Ready Ready Preview, Comment, Open in v0 May 7, 2026 2:15pm
examples-nonmonorepo Ready Ready Preview, Comment, Open in v0 May 7, 2026 2:15pm
examples-svelte-web Ready Ready Preview, Comment, Open in v0 May 7, 2026 2:15pm
examples-tailwind-web Ready Ready Preview, Comment, Open in v0 May 7, 2026 2:15pm
examples-vite-web Ready Ready Preview, Comment, Open in v0 May 7, 2026 2:15pm
turbo-site Ready Ready Preview, Comment, Open in v0 May 7, 2026 2:15pm

@anthonyshew anthonyshew enabled auto-merge (squash) May 7, 2026 14:21
@anthonyshew anthonyshew merged commit 86c0365 into main May 7, 2026
45 checks passed
@anthonyshew anthonyshew deleted the shew/codemod-config-discovery branch May 7, 2026 14:23
anthonyshew pushed a commit that referenced this pull request May 7, 2026
## Release v2.9.10

> [!CAUTION]
> Versioned docs aliasing FAILED. [View
logs](https://github.com/vercel/turborepo/actions/runs/25509373774)

### Changes

- release(turborepo): 2.9.9-canary.4 (#12716) (`25c71b0`)
- release(turborepo): 2.9.9 (#12719) (`acfe475`)
- fix: Respect SCM env vars in `turbo query affected` (#12722)
(`3caa8fb`)
- ci: Package VSCode extension in release workflow (#12723) (`329a545`)
- fix: Avoid raw create-turbo example telemetry (#12725) (`ec0b8dd`)
- fix: Escape graph HTML payloads (#12726) (`89b4f4e`)
- fix: Prevent OTEL token injection to spoofed origins (#12727)
(`1fbc725`)
- fix: Retry HTTP status failures (#12728) (`e389d66`)
- fix: Validate microfrontend proxy Host header (#12730) (`eb46170`)
- fix: Redact task hash env debug logs (#12733) (`6d9fc06`)
- fix: Filter microfrontend proxy environments (#12732) (`9b28a75`)
- fix: Preserve FSEvents mount points for device-relative paths (#12729)
(`6ce73e0`)
- fix: Validate proxy Host headers (#12731) (`9f70395`)
- fix: Resolve TypeScript `.js` extension imports to `.ts` files in
boundaries (#12644) (`b47f6dc`)
- fix: Use random temp path for repo downloads (#12736) (`106698c`)
- release(turborepo): 2.9.10-canary.1 (#12734) (`b1001c1`)
- fix: Reject OTel endpoints with userinfo (#12737) (`a6efc3f`)
- fix: Authenticate local devtools WebSocket (#12738) (`8276be8`)
- fix: Handle clipboard exec errors (#12739) (`3305766`)
- fix: Restrict Vercel token reuse to trusted API origins (#12740)
(`18a3a22`)
- fix: Keep workspace config discovery inside root (#12741) (`86c0365`)
- fix: Hardening for daemon IPC endpoints (#12742) (`13a9a8b`)
- fix: Enforce cache filesystem boundaries (#12743) (`a50e863`)

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
anthonyshew pushed a commit that referenced this pull request May 8, 2026
## Release v2.9.11-canary.1

> [!CAUTION]
> Versioned docs aliasing FAILED. [View
logs](https://github.com/vercel/turborepo/actions/runs/25519302524)

### Changes

- fix: Use random temp path for repo downloads (#12736) (`106698c`)
- release(turborepo): 2.9.10-canary.1 (#12734) (`b1001c1`)
- fix: Reject OTel endpoints with userinfo (#12737) (`a6efc3f`)
- fix: Authenticate local devtools WebSocket (#12738) (`8276be8`)
- fix: Handle clipboard exec errors (#12739) (`3305766`)
- fix: Restrict Vercel token reuse to trusted API origins (#12740)
(`18a3a22`)
- fix: Keep workspace config discovery inside root (#12741) (`86c0365`)
- fix: Hardening for daemon IPC endpoints (#12742) (`13a9a8b`)
- fix: Enforce cache filesystem boundaries (#12743) (`a50e863`)
- release(turborepo): 2.9.10 (#12745) (`4b3e7cc`)
- ci: Publish VS Code extension on release (#12747) (`1293d22`)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant