chore(deps): bump the monorepo-dependencies group across 1 directory with 11 updates

[dependabot]

Bumps the monorepo-dependencies group with 11 updates in the / directory:

Package	From	To
@biomejs/biome	2.4.15	2.5.2
@types/node	25.7.0	26.1.0
commitizen	4.3.1	4.3.2
esbuild	0.28.0	0.28.1
lint-staged	17.0.4	17.0.8
playwright	1.60.0	1.61.1
preact	10.29.1	10.29.3
tsx	4.21.0	4.22.4
turbo	2.9.12	2.10.2
preact-render-to-string	6.6.7	6.7.0
es-module-lexer	2.1.0	2.2.0

Updates @biomejs/biome from 2.4.15 to 2.5.2

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.2

2.5.2

Patch Changes

• #10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

• #10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

• #10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

  <script>
  import { SvelteMap } from "svelte/reactivity";
  const map = $state(new SvelteMap()); // redundant
  </script>

• #10752 f62fb8b Thanks @​ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

• #10796 f1b3ab2 Thanks @​ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

• #10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

  // No longer flagged (returns are `string`):
  function getValue(b: boolean): string {
    if (b) return "a" as string;
    return "b" as string;
  }
  // Now also reported, like as const (returns false):
  function isReady(): boolean {
  return false as false;
  }

• #10678 8f073a7 Thanks @​PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.

• #10756 5ec965a Thanks @​denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.

  -.powerPathNavigator
  -  .helm
  -  button.pressedButton, // pressed
  +.powerPathNavigator .helm button.pressedButton, // pressed
   .powerPathNavigator .helm button:active:not(.disabledButton) {
   }

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.2

Patch Changes

• #10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

• #10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

• #10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

  <script>
  import { SvelteMap } from "svelte/reactivity";
  const map = $state(new SvelteMap()); // redundant
  </script>

• #10752 f62fb8b Thanks @​ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

• #10796 f1b3ab2 Thanks @​ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

• #10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

  // No longer flagged (returns are `string`):
  function getValue(b: boolean): string {
    if (b) return "a" as string;
    return "b" as string;
  }
  // Now also reported, like as const (returns false):
  function isReady(): boolean {
  return false as false;
  }

• #10678 8f073a7 Thanks @​PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.

• #10756 5ec965a Thanks @​denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.

  -.powerPathNavigator
  -  .helm
  -  button.pressedButton, // pressed
  +.powerPathNavigator .helm button.pressedButton, // pressed
   .powerPathNavigator .helm button:active:not(.disabledButton) {
   }

• #10757 6232fcd Thanks @​PranavAchar01! - Fixed #8269: the CSS parser now accepts Tailwind @variant and @utility names that start with a digit, such as the 2xl breakpoint.

... (truncated)

Commits

• e649198 ci: release (#10747)
• 4a32b63 feat(lint): add ignorePrimitives option to useNullishCoalescing (#10798)
• f3d4c00 feat(js/nursery): add noSvelteNoUnnecessaryStateWrap rule (#10545)
• f458028 feat(lint): add ignoreBooleanCoercion option to useNullishCoalescing (#10595)
• ffe7d33 chore: revert
• 564d660 chore: revert
• 0abf1a5 ci: release (#10627)
• 23814f1 chore(biome_configuration): add allowTrailingCommas to json-schema to make VS...
• a0f197e chore: dead and old links (#10668)
• c0b9832 ci: release (#10499)
• Additional commits viewable in compare view

Updates @types/node from 25.7.0 to 26.1.0

Commits

• See full diff in compare view

Updates commitizen from 4.3.1 to 4.3.2

Release notes

Sourced from commitizen's releases.

v4.3.2

4.3.2 (2026-06-12)

• chore(deps): bump semantic-release to 25 for npm trusted publishing (#1029) (6eb168c), closes #1029
• ci(release): bump actions/checkout and actions/setup-node to v4 (#1024) (f5702c4), closes #1024
• ci(release): use npm trusted publishing via OIDC (#1028) (096ed52), closes #1028
• chore(deps) Update all non-major dependencies (#1026) (4e98218), closes #1026
• chore(deps) Update dependency lodash to v4.18.1 [SECURITY] (#1010) (11be6a1), closes #1010
• fix(ci): fix pipelines and update matrices to node 18/20/22 (#1023) (48e4b8b), closes #1023
• docs: update README.md to add contributors (#985) (3c08866), closes #985

Commits

• 6eb168c chore(deps): bump semantic-release to 25 for npm trusted publishing (#1029)
• 096ed52 ci(release): use npm trusted publishing via OIDC (#1028)
• 4e98218 chore(deps) Update all non-major dependencies (#1026)
• f5702c4 ci(release): bump actions/checkout and actions/setup-node to v4 (#1024)
• 11be6a1 chore(deps) Update dependency lodash to v4.18.1 [SECURITY] (#1010)
• 48e4b8b fix(ci): fix pipelines and update matrices to node 18/20/22 (#1023)
• 3c08866 docs: update README.md to add contributors (#985)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for commitizen since your current version.

Updates esbuild from 0.28.0 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Updates lint-staged from 17.0.4 to 17.0.8

Release notes

Sourced from lint-staged's releases.

v17.0.8

Patch Changes

• #1809 179b437 - Fix lint-staged discarding the ongoing merge conflict status (.git/MERGE_HEAD) when using the --hide-unstaged or --hide-all options.

• #1811 3d0b2c0 - Fix issues with Git commands that are successful but also emit warnings to stderr, by ignoring the stderr output completely when the process exits with code 0. This was the behavior when using nano-spawn and execa, but when switching to tinyexec in 16.3.0 both stdout and stderr were used as interleaved output.

v17.0.7

Patch Changes

• #1806 e692e58 - Update dependency tinyexec@^1.2.4.

v17.0.6

Patch Changes

• #1803 bdf2770 - Run all tests with Deno, in addition to Node.js and Bun.

• #1796 7508272 - Fix performance regression of lint-staged v17 by going back to using git add to stage task modifications. This was changed to git update-index --again in v17 for less manual work, but unfortunately the update-index command gets slower in very large Git repos.

• #1797 7b2505a - This version of lint-staged uses the new staged publishing for npm packages feature. Releases are already published from GitHub Actions with trusted publishing, but now an additional approval with two-factor authentication is also required.

• #1802 321b0a9 - Downgrade dependency tinyexec@1.2.2 to avoid issues in version 1.2.3.

v17.0.5

Patch Changes

• #1792 1f67271 - Correctly set the --max-arg-length default value based on the running platform. This controls how very long lists of staged files are split into multiple chunks.

Changelog

Sourced from lint-staged's changelog.

17.0.8

Patch Changes

• #1809 179b437 - Fix lint-staged discarding the ongoing merge conflict status (.git/MERGE_HEAD) when using the --hide-unstaged or --hide-all options.

• #1811 3d0b2c0 - Fix issues with Git commands that are successful but also emit warnings to stderr, by ignoring the stderr output completely when the process exits with code 0. This was the behavior when using nano-spawn and execa, but when switching to tinyexec in 16.3.0 both stdout and stderr were used as interleaved output.

17.0.7

Patch Changes

• #1806 e692e58 - Update dependency tinyexec@^1.2.4.

17.0.6

Patch Changes

• #1803 bdf2770 - Run all tests with Deno, in addition to Node.js and Bun.

• #1796 7508272 - Fix performance regression of lint-staged v17 by going back to using git add to stage task modifications. This was changed to git update-index --again in v17 for less manual work, but unfortunately the update-index command gets slower in very large Git repos.

• #1797 7b2505a - This version of lint-staged uses the new staged publishing for npm packages feature. Releases are already published from GitHub Actions with trusted publishing, but now an additional approval with two-factor authentication is also required.

• #1802 321b0a9 - Downgrade dependency tinyexec@1.2.2 to avoid issues in version 1.2.3.

17.0.5

Patch Changes

• #1792 1f67271 - Correctly set the --max-arg-length default value based on the running platform. This controls how very long lists of staged files are split into multiple chunks.

Commits

• 5f3b8f2 Merge pull request #1812 from lint-staged/changeset-release/main
• 43a9b8d chore(changeset): release
• 630e2f6 Merge pull request #1809 from lint-staged/restore-merge-status
• 179b437 fix: restore Git merge status after creating backup stash
• 6bae2e2 Merge pull request #1811 from lint-staged/exec-git-ignore-stderr
• b82a830 ci: run npm audit omitting dev, including prod dependencies
• 0b19b80 build(deps): update dependencies
• 3d0b2c0 fix: ignore stderr when doing Git operations
• cd11fec Merge pull request #1807 from lint-staged/changeset-release/main
• 15a8ee0 chore(changeset): release
• Additional commits viewable in compare view

Updates playwright from 1.60.0 to 1.61.1

Release notes

Sourced from playwright's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

... (truncated)

Commits

• 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
• 4328122 chore: mark v1.61.1 (#41404)
• 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
• 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
• 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
• b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
• b5a3175 cherry-pick(#41319): fix(loader): support other node versions
• d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
• 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
• a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
• Additional commits viewable in compare view

Updates preact from 10.29.1 to 10.29.3

Release notes

Sourced from preact's releases.

10.29.3

Fixes

• Fix error recovery for partially rendered subtrees (#5120, thanks @​JoviDeCroock)
• Fix useId stability across async Suspense (#5108, thanks @​JoviDeCroock)
• Flush subtree effects when rendering a pending node (#5055, thanks @​JoviDeCroock)
• Fix hydrate recovery with null excess DOM children (#5112, thanks @​JoviDeCroock)

Performance

• Address and guard memory leak hotspots (#5116, thanks @​JoviDeCroock)
• Avoid redundant allocations and writes (#5115, thanks @​JoviDeCroock)

Types

• Accept Signalish for input DOM-type (#5096, thanks @​JoviDeCroock)

Maintenance

• Use npm staged publishing (#5101, thanks @​JoviDeCroock)
• Add tier 3 sponsor logos (#5098, thanks @​JoviDeCroock)

10.29.2

Fixes

• Fix hydration when we have defaultValue or value on a textarea (#5081, thanks @​JoviDeCroock)

Maintenance

• Add CODEOWNERS for GitHub configuration (v10.x) (#5088, thanks @​JoviDeCroock)
• Fix trusted publishing workflow (#5084, thanks @​JoviDeCroock)
• Trusted publishing (#5072, thanks @​JoviDeCroock)

Commits

• 65b32cb 10.29.3 (#5121)
• 1a3b8b5 Fix error recovery for partially rendered subtrees (#5120)
• 67f0290 Fix useId stability across async Suspense (#5108)
• d9e8984 Flush subtree effects (#5055)
• bd0302d Fix memory leak hotspots (#5116)
• 6aced21 perf(hooks): avoid redundant allocations and writes in SCU and diffed (#5115)
• 82ed24e Fix hydrate error recovery with null excess DOM children (#5112)
• 4299769 ci: use npm staged publishing (#5101)
• 7eca820 Add tier 3 sponsor logos (#5098)
• 5eb933b fix: accept Signalish for input type (#5096)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for preact since your current version.

Updates tsx from 4.21.0 to 4.22.4

Release notes

Sourced from tsx's releases.

v4.22.4

4.22.4 (2026-05-31)

Bug Fixes

• resolve CommonJS directory requires inside dependencies (#803) (1ce8463)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

• decode typed loader source (dce02fc)
• preserve entrypoint with TypeScript preload hooks (68f72f3)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.2

4.22.2 (2026-05-18)

Bug Fixes

• preserve CJS JSON require in ESM hooks (35b700b)
• preserve named exports from CommonJS TypeScript (11de737)
• support module.exports require(esm) interop (cf8f199)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.1

4.22.1 (2026-05-17)

Bug Fixes

• resolve tsconfig path aliases containing a colon (#780) (6979f28)

---

This release is also available on:

• npm package (@​latest dist-tag)

... (truncated)

Commits

• 1ce8463 fix: resolve CommonJS directory requires inside dependencies (#803)
• dce02fc fix: decode typed loader source
• 68f72f3 fix: preserve entrypoint with TypeScript preload hooks
• 69455cf test: cover package exports for ambiguous ESM reexports
• 35b700b fix: preserve CJS JSON require in ESM hooks
• ef807db chore: update testing dependencies
• 3917090 test: document compatibility test taxonomy
• de8113f refactor: centralize Node capability facts
• c1f62db test: consolidate tsconfig path edge coverage
• 4e08174 test: consolidate loader hook coverage
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.

Updates turbo from 2.9.12 to 2.10.2

Release notes

Sourced from turbo's releases.

Turborepo v2.10.2

What's Changed

Changelog

• release(turborepo): 2.10.1 by @​github-actions[bot] in vercel/turborepo#13156
• docs: Prefer devEngines packageManager by @​anthonyshew in vercel/turborepo#13155
• fix: Install Zig for LSP builds by @​anthonyshew in vercel/turborepo#13158
• ci: Pin macOS Rust builds to macOS 15 by @​anthonyshew in vercel/turborepo#13167
• feat: Recognize nub as a package manager by @​colinhacks in vercel/turborepo#13120
• fix: Preserve 3-level nested Bun lockfile entries during prune by @​anthonyshew in vercel/turborepo#13168
• fix: Avoid following nested symlinked cache outputs by @​anthonyshew in vercel/turborepo#13166
• feat: Add nub package manager support to JavaScript packages by @​anthonyshew in vercel/turborepo#13169
• fix: Link ghostty-vt statically on Windows MSVC by @​anthonyshew in vercel/turborepo#13171
• release(turborepo): 2.10.2-canary.1 by @​github-actions[bot] in vercel/turborepo#13172

New Contributors

• @​colinhacks made their first contribution in vercel/turborepo#13120

Full Changelog: vercel/turborepo@v2.10.1...v2.10.2

Turborepo v2.10.2-canary.1

What's Changed

Changelog

• feat: Support devEngines packageManager in workspaces by @​anthonyshew in vercel/turborepo#13150
• release(turborepo): 2.10.1-canary.3 by @​github-actions[bot] in vercel/turborepo#13149
• feat: Update add package manager codemod by @​anthonyshew in vercel/turborepo#13151
• feat: Update workspace package manager declarations by @​anthonyshew in vercel/turborepo#13154
• release(turborepo): 2.10.1 by @​github-actions[bot] in vercel/turborepo#13156
• docs: Prefer devEngines packageManager by @​anthonyshew in vercel/turborepo#13155
• fix: Install Zig for LSP builds by @​anthonyshew in vercel/turborepo#13158
• ci: Pin macOS Rust builds to macOS 15 by @​anthonyshew in vercel/turborepo#13167
• feat: Recognize nub as a package manager by @​colinhacks in vercel/turborepo#13120
• fix: Preserve 3-level nested Bun lockfile entries during prune by @​anthonyshew in vercel/turborepo#13168
• fix: Avoid following nested symlinked cache outputs by