chore(deps): refresh turbo security bump

[bntvllnt]

Summary

• Supersedes stale Dependabot PR chore(deps-dev): bump turbo from 2.8.3 to 2.9.14 in the npm_and_yarn group across 1 directory #490 with a fresh branch cut from current origin/main.
• Updates root turbo from the main lockfile-resolved 2.8.3 to 2.10.10.
• Refreshes pnpm-lock.yaml for the Turbo resolution only; removed unrelated Vite/Storybook/Rollup/Esbuild/Babel lockfile drift from the previous head.

Related to #503
Supersedes #490

Evidence

• Current main resolved turbo@2.8.3; this head resolves root turbo@2.10.10.
• pnpm why turbo --recursive shows the only dependency paths are root devDependencies.turbo plus @vllnt/eslint-config -> eslint-plugin-turbo -> turbo peer bindings in apps/registry and packages/ui.
• Working diff vs origin/main is limited to package.json and pnpm-lock.yaml; lockfile drift grep for unrelated rollup@, esbuild@, @babel/, vite@, and @storybook/ changes is empty.
• No UI/source behavior change intended.

Validation

• pnpm install --frozen-lockfile — pass.
• pnpm -F @vllnt/ui lint — pass.
• pnpm -F @vllnt/ui exec tsc --noEmit --project tsconfig.build.json — pass.
• pnpm build — pass; Next/Turbopack emitted existing warnings only.
• NODE_OPTIONS='--localstorage-file=/tmp/vllnt-ui-vitest-localstorage-t_78547d91.json' pnpm test:once — pass; 327 files / 1718 tests total across workspace (@vllnt/ui: 318 files / 1671 tests; @vllnt/ui-registry: 9 files / 47 tests).
• pnpm doctor:errors — fails on existing repo-wide react-doctor errors unrelated to this dependency-only diff; not widened or addressed in this PR.

GitHub checks

• Current head f5ee000284484f369af4162fa6e84aec3f7586f9: all reported checks passed (Analyze (actions), Analyze (javascript-typescript), CodeQL, E2E (Playwright), Enforce issue-linked PRs, Quality Gates, Scan codebase health).

Notes

• Unavoidable transitive lockfile changes are limited to Turbo's renamed platform optional packages (turbo-* 2.8.3 -> @turbo/* 2.10.10) and the existing @vllnt/eslint-config / eslint-plugin-turbo peer snapshots rebinding from turbo@2.8.3 to turbo@2.10.10.
• No generated registry files are included.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[bntvllnt]

Review — PR #504 @ d972845

BLOCKING

• S1 — lockfile contains unrelated toolchain drift beyond the Turbo security bump
  • Evidence: package.json only changes the root devDependency from turbo: ^2.4.4 to ^2.10.10, but pnpm-lock.yaml also refreshes unrelated Vite/Storybook toolchain resolutions, including vite@7.3.2 dependencies from esbuild 0.27.3 -> 0.27.7, postcss 8.5.10 -> 8.5.26, rollup 4.59.0 -> 4.62.4, and tinyglobby 0.2.15 -> 0.2.17 (pnpm-lock.yaml:16704-16709).
  • Cross-check: from a fresh origin/main worktree, pnpm add -Dw turbo@2.10.10 --lockfile-only produced the same package.json change but only a 130-line lockfile diff; this PR has a 741-line lockfile diff. So the extra lockfile churn is not required for the Turbo bump.
  • Why it matters: this PR is scoped as a security refresh/supersession of Dependabot chore(deps-dev): bump turbo from 2.8.3 to 2.9.14 in the npm_and_yarn group across 1 directory #490. Pulling unrelated build-tool patches into the same lockfile widens the dependency review surface and makes rollback/security attribution harder.
  • Fix: regenerate the branch from current origin/main with a minimal root Turbo update only, e.g. pnpm add -Dw turbo@2.10.10 --lockfile-only, then re-run pnpm install --frozen-lockfile and the existing CI gates. If the Vite/Storybook transitive refresh is intentional, split it into its own dependency PR or state the extra scope explicitly with rationale.

WARN

• W1 — local full react-doctor remains red, although PR-diff CI passes
  • Evidence: current-head CI Scan codebase health passed the PR-diff react-doctor step, but local pnpm doctor:errors on this worktree exits 1 with existing repo-wide errors outside this dependency-only diff.
  • Suggested next step: do not treat the local full-scan failures as introduced by this PR, but keep relying on the PR-diff react-doctor CI result for this dependency-only review.

VERIFIED CLEAN

• Reviewed every changed file and surrounding context: package.json, pnpm-lock.yaml.
• PR metadata is aligned with the refreshed supersession: title/branch are dependency-only, PR body says Related to #503 and Supersedes #490; PR Issue Link CI passes. GitHub closingIssuesReferences is empty because the PR uses Related to, which is allowed by repo rules for partial/dependency tracking.
• Dependency/security rationale is real: origin/main audit reports turbo@2.8.3 advisories GHSA-3qcw-2rhx-2726 and GHSA-hcf7-66rw-9f5r; current head audit no longer reports Turbo advisories. npm view turbo reports latest 2.10.10, matching the PR target.
• Lockfile integrity is mechanically valid: pnpm install --frozen-lockfile passes at head.
• No source/UI/generated registry files are touched.
• Viewed-state coverage marked for both changed files.

VALIDATION

• Current head verified: d9728458e027e2bec214e9bb49738d8c1430d92e.
• Live GitHub checks at current head: Quality Gates pass; E2E (Playwright) pass; react-doctor Scan codebase health pass; CodeQL pass (Analyze (actions), Analyze (javascript-typescript), and summary CodeQL); PR Issue Link pass.
• Local commands run:
  • pnpm install --frozen-lockfile — pass.
  • pnpm audit --dev --json on origin/main — Turbo advisories present for 2.8.3.
  • pnpm audit --dev --json on PR head — no Turbo advisory hits; audit still exits 1 due unrelated existing advisories.
  • pnpm doctor:errors — fail on existing repo-wide non-diff errors, not used as PR-specific blocker.
  • git diff --check origin/main...HEAD — pass.
  • Minimal-update comparison from fresh origin/main: pnpm add -Dw turbo@2.10.10 --lockfile-only — pass, lockfile diff materially smaller than PR.

Recommendation: REQUEST CHANGES before manual approval. Next human action: ask the author/agent to remove the unrelated lockfile drift or explicitly split/justify the additional Vite/Storybook transitive refresh; do not merge PR #504 as-is.

[bntvllnt]

@bntvllnt current-head re-review for PR #504 at f5ee000284484f369af4162fa6e84aec3f7586f9:

Review — clean / manual approval ready

VERIFIED CLEAN

• Changed files are limited to package.json and pnpm-lock.yaml (+38/-38 total).
• package.json only bumps root devDependencies.turbo from ^2.4.4 to ^2.10.10.
• Lockfile drift is limited to Turbo resolution updates: turbo@2.8.3 -> 2.10.10, renamed platform optional packages turbo-* -> @turbo/*, and the expected @vllnt/eslint-config / eslint-plugin-turbo peer snapshot rebinding to turbo@2.10.10.
• Re-checked the prior blocker: changed lockfile lines contain no unrelated Vite / Storybook / Rollup / Esbuild / Babel drift.
• PR body is now truthful for the current head and remains linked via Related to #503 plus Supersedes #490.
• GitHub checks for this head are green: Quality Gates, E2E, CodeQL, issue-link gate, codebase health scan, and CodeQL analysis checks.

VALIDATION

• pnpm install --frozen-lockfile — pass; clean working tree afterward.
• pnpm why turbo --recursive — pass; paths are root turbo plus @vllnt/eslint-config -> eslint-plugin-turbo -> turbo peers.
• pnpm -F @vllnt/ui lint — pass.
• pnpm -F @vllnt/ui exec tsc --noEmit --project tsconfig.build.json — pass.
• pnpm build — pass.
• NODE_OPTIONS='--localstorage-file=/tmp/vllnt-ui-vitest-localstorage-t_78547d91-review.json' pnpm test:once — pass (@vllnt/ui: 318 files / 1671 tests; workspace total 2 tasks successful).

No blocking findings remain from the Turbo scope review. Approval is recommended; final merge/approval remains manual.