chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@commitlint/cli (source)	20.4.1 → 20.4.2
@commitlint/config-conventional (source)	20.4.1 → 20.4.2
pnpm (source)	10.29.3 → 10.30.1
turbo (source)	2.8.9 → 2.8.10

---

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v20.4.2

Compare Source

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v20.4.2

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

pnpm/pnpm (pnpm)

v10.30.1: pnpm 10.30.1

Compare Source

Patch Changes

• Use the /-/npm/v1/security/audits/quick endpoint as the primary audit endpoint, falling back to /-/npm/v1/security/audits when it fails #​10649.

Platinum Sponsors

Gold Sponsors

v10.30.0: pnpm 10.30

Compare Source

Minor Changes

• pnpm why now shows a reverse dependency tree. The searched package appears at the root with its dependents as branches, walking back to workspace roots. This replaces the previous forward-tree output which was noisy and hard to read for deeply nested dependencies.

Patch Changes

• Revert pnpm why dependency pruning to prefer correctness over memory consumption. Reverted PR: #​7122.
• Optimize pnpm why and pnpm list performance in workspaces with many importers by sharing the dependency graph and materialization cache across all importers instead of rebuilding them independently for each one #​10596.

Platinum Sponsors

Gold Sponsors

vercel/turborepo (turbo)

v2.8.10: Turborepo v2.8.10

Compare Source

What's Changed

create-turbo

• fix: Sanitize git command inputs in create-turbo by @​anthonyshew in #​11876

Changelog

• fix: Move node-plop to dependencies so PlopTypes resolves for consumers by @​anthonyshew in #​11862
• chore: Use 2024 edition in more packages, do not ignore some clippy l… by @​ognevny in #​11860
• perf: Optimize hot-path hash computation by avoiding clones and using unstable sorts by @​anthonyshew in #​11872
• perf: Replace twox-hash with xxhash-rust and optimize file hashing by @​anthonyshew in #​11874
• fix: Restrict credential file permissions to owner-only by @​anthonyshew in #​11870
• perf: Reduce allocations in globwalk by @​anthonyshew in #​11528
• perf: Replace O(V³) Floyd-Warshall with O(V+E) DFS in watch mode subgraph creation by @​anthonyshew in #​11878
• feat: Generate LLM-friendly markdown alongside --profile trace output by @​anthonyshew in #​11880
• feat: Make --profile and --anon-profile filename optional by @​anthonyshew in #​11883
• perf: Batch per-package git subprocess calls into repo-wide index by @​anthonyshew in #​11887
• perf: Parallelize and pre-build RepoGitIndex by @​anthonyshew in #​11889
• perf: Pre-compile glob exclusion filter and cache path prefix in file hashing by @​anthonyshew in #​11891

Full Changelog: vercel/turborepo@v2.8.9...v2.8.10

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 13a2e3c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​commitlint/​cli@​20.4.1 ⏵ 20.4.2
	turbo@​2.8.9 ⏵ 2.8.10	+1
	@​commitlint/​config-conventional@​20.4.1 ⏵ 20.4.2				-1

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.95%. Comparing base (ccbd420) to head (13a2e3c).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2117   +/-   ##
=======================================
  Coverage   92.95%   92.95%           
=======================================
  Files          73       73           
  Lines        1477     1477           
  Branches      256      258    +2     
=======================================
  Hits         1373     1373           
  Misses         94       94           
  Partials       10       10           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.