Skip to content

fix: Upgrade tsup to fix rollup and glob vulnerabilities#11601

Merged
anthonyshew merged 1 commit intomainfrom
anthonyshew/turbo-5138-tsup-upgrade
Jan 31, 2026
Merged

fix: Upgrade tsup to fix rollup and glob vulnerabilities#11601
anthonyshew merged 1 commit intomainfrom
anthonyshew/turbo-5138-tsup-upgrade

Conversation

@anthonyshew
Copy link
Copy Markdown
Contributor

@anthonyshew anthonyshew commented Jan 31, 2026

Summary

  • Upgrades tsup from 5.12.9/6.7.0 to 8.5.1 in turbo-ignore, create-turbo, @turbo/codemod, and @turbo/releaser
  • Fixes TURBO-5138, TURBO-5139: rollup DOM Clobbering vulnerability (now uses rollup ^4.34.8)
  • Fixes TURBO-5142: glob command injection vulnerability (tsup 8.x uses sucrase 3.35.1 which replaced glob with tinyglobby)

Testing

All affected packages build and pass tests.

@anthonyshew anthonyshew requested a review from a team as a code owner January 31, 2026 20:49
@anthonyshew anthonyshew requested review from tknickman and removed request for a team January 31, 2026 20:49
@turbo-orchestrator turbo-orchestrator Bot added pkg: create-turbo Issues related to npx create-turbo pkg: turbo-codemod pkg: turbo-ignore packages/turbo-ignore labels Jan 31, 2026
@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented Jan 31, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
examples-basic-web Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 8:50pm
examples-designsystem-docs Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 8:50pm
examples-gatsby-web Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 8:50pm
examples-kitchensink-blog Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 8:50pm
examples-nonmonorepo Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 8:50pm
examples-svelte-web Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 8:50pm
examples-tailwind-web Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 8:50pm
examples-vite-web Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 8:50pm
turbo-site Ready Ready Preview, Comment, Open in v0 Jan 31, 2026 8:50pm
1 Skipped Deployment
Project Deployment Actions Updated (UTC)
turborepo-test-coverage Skipped Skipped Open in v0 Jan 31, 2026 8:50pm

@github-actions
Copy link
Copy Markdown
Contributor

Coverage Report

Metric Coverage
Lines 75.88%
Functions 46.74%
Branches 0.00%

View full report

@anthonyshew anthonyshew merged commit a330a68 into main Jan 31, 2026
108 checks passed
@anthonyshew anthonyshew deleted the anthonyshew/turbo-5138-tsup-upgrade branch January 31, 2026 21:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pkg: create-turbo Issues related to npx create-turbo pkg: turbo-codemod pkg: turbo-ignore packages/turbo-ignore

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant