chore(deps): update dependency turbo to v2

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
turbo (source)	^1.13.4 → ^2.9.16

---

Release Notes

vercel/turborepo (turbo)

v2.9.16: Turborepo v2.9.16

Compare Source

What's Changed

Changelog

• release(turborepo): 2.9.15 by @​github-actions[bot] in #​12955
• fix: Avoid hanging PTY shutdown by @​anthonyshew in #​12958
• fix: Retry npm tlog publish failures by @​anthonyshew in #​12959
• release(turborepo): 2.9.16-canary.1 by @​anthonyshew in #​12960
• fix: Preserve nested Bun dependency versions by @​anthonyshew in #​12963
• Revert "fix: Preserve nested Bun dependency versions" by @​anthonyshew in #​12964
• release(turborepo): 2.9.16-canary.2 by @​github-actions[bot] in #​12961
• fix: Preserve nested Bun dependency versions by @​anthonyshew in #​12965
• fix: Don't delete existing .git when using --no-git flag by @​anthonyshew in #​12968

Full Changelog: vercel/turborepo@v2.9.15...v2.9.16

v2.9.15: Turborepo v2.9.15

Compare Source

What's Changed

Changelog

• release(turborepo): 2.9.14 by @​github-actions[bot] in #​12805
• fix: Prune package.json workspaces by @​anthonyshew in #​12808
• fix: Wait for process trees before task completion by @​anthonyshew in #​12809
• release(turborepo): 2.9.15-canary.1 by @​github-actions[bot] in #​12810
• ci: Sign macOS release binaries by @​anthonyshew in #​12811
• release(turborepo): 2.9.15-canary.2 by @​github-actions[bot] in #​12812
• fix: Prevent cache archive symlink reads by @​anthonyshew in #​12813
• release(turborepo): 2.9.15-canary.3 by @​github-actions[bot] in #​12814
• fix: Avoid path-racy chmod during directory restore by @​anthonyshew in #​12815
• fix: Prevent cache restore symlink race writes by @​anthonyshew in #​12817
• chore: Deny Rust panic extraction by default by @​anthonyshew in #​12818
• fix: Make structured log symlink defense race-safe by @​anthonyshew in #​12821
• fix: Preserve Bun alias child packages by @​anthonyshew in #​12822
• fix: Avoid UTF-8 panics at boundaries by @​anthonyshew in #​12823
• fix: Preserve non-UTF-8 Git path boundaries by @​anthonyshew in #​12826
• fix: Create daemon dirs with private permissions by @​anthonyshew in #​12827
• fix: Return Berry lockfile errors instead of panicking by @​anthonyshew in #​12828
• fix: Isolate Corepack state in integration tests by @​anthonyshew in #​12831
• ci: Use larger Windows runners for Rust tests by @​anthonyshew in #​12832
• docs: Add with-vite-module-federation example by @​gioboa in #​12794
• test: Run Rust tests without partitioning by @​anthonyshew in #​12833
• chore: Remove TaskHashTracker-based expect() calls by @​anthonyshew in #​12836
• chore: Deduplicate hash canonicalization by @​anthonyshew in #​12837
• fix: Prevent Windows process drain hangs by @​anthonyshew in #​12838
• fix: Refactor execsync to execfilesync for Shell command built from environment values by @​bjormgyg in #​12829
• test: Bound vt100 random quickcheck by @​anthonyshew in #​12839
• fix: Validate daemon discovery responses by @​anthonyshew in #​12840
• fix: Store PackageGraph root invariants by @​anthonyshew in #​12841
• chore: Avoid engine graph node expects by @​anthonyshew in #​12842
• test: Make Rust tests parallel-safe by @​anthonyshew in #​12843
• fix: Avoid graph utility node lookup panics by @​anthonyshew in #​12844
• fix: Avoid graph walker expect() calls by @​anthonyshew in #​12845
• fix: Remove fs panic extraction lints by @​anthonyshew in #​12846
• fix: Remove fixed map panic extraction calls by @​anthonyshew in #​12847
• fix: Remove devtools WebSocket panics by @​anthonyshew in #​12850
• fix: Remove json rewrite panic lint allow by @​anthonyshew in #​12848
• fix: Remove turborepo-types panic lint allows by @​anthonyshew in #​12849
• chore: Remove turborepo-hash build expect by @​anthonyshew in #​12851
• fix: Remove napi panic lint allows by @​anthonyshew in #​12852
• fix: Avoid globwatch expect calls by @​anthonyshew in #​12853
• fix: Remove LSP expect callsites by @​anthonyshew in #​12854
• fix: Remove scope panic lint allows by @​anthonyshew in #​12855
• fix: Remove task hash panic lints by @​anthonyshew in #​12856
• fix: Remove frameworks panic lint allows by @​anthonyshew in #​12857
• fix: Remove microfrontends proxy expect lint allow by @​anthonyshew in #​12859
• fix: Avoid API client expect calls by @​anthonyshew in #​12858
• fix: Avoid task executor expect calls by @​anthonyshew in #​12860
• fix: Remove turbo-trace unwrap callsite by @​anthonyshew in #​12863
• fix: Remove Vercel API mock expect usage by @​anthonyshew in #​12862
• fix: Remove vt100 expect lint allow by @​anthonyshew in #​12861
• fix: Remove turborepo-shim expect callsites by @​anthonyshew in #​12864
• test: Deflake daemon existing process test by @​anthonyshew in #​12865
• fix: Avoid repository NAPI unwrap calls by @​anthonyshew in #​12866
• fix: Remove pidlock panic callsites by @​anthonyshew in #​12867
• fix: Remove telemetry panic callsites by @​anthonyshew in #​12868
• chore: Remove Rust re-export shims by @​anthonyshew in #​12870
• fix: Remove turbo-json panic lint allows by @​anthonyshew in #​12869
• fix: Remove globwalk's expect() callsites by @​anthonyshew in #​12871
• fix: Remove turbopath's expect() callsites by @​anthonyshew in #​12872
• test: Deflake Corepack prepare lock on Windows by @​anthonyshew in #​12873
• fix: Remove signals panic callsites by @​anthonyshew in #​12874
• fix: Remove turbo-trace's expect() allow by @​anthonyshew in #​12876
• fix: Remove Vercel API mock unwrap usage by @​anthonyshew in #​12877
• fix: Remove task executor unwrap usage by @​anthonyshew in #​12878
• fix: Remove run summary expect usage by @​anthonyshew in #​12879
• fix: Remove microfrontends proxy unwrap usage by @​anthonyshew in #​12880
• fix: Remove api client unwrap usage by @​anthonyshew in #​12881
• fix: Remove globwalk unwrap usage by @​anthonyshew in #​12883
• fix: Remove UI expect() usage by @​anthonyshew in #​12882
• fix: Remove microfrontends expect usage by @​anthonyshew in #​12885
• fix: Remove boundaries's expect() usage by @​anthonyshew in #​12887
• fix: Remove turborepo-process's unwrap() usage by @​anthonyshew in #​12888
• fix: Remove UI unwrap usage by @​anthonyshew in #​12889
• fix: Remove microfrontends unwrap allow by @​anthonyshew in #​12890
• fix: Remove turborepo-process's expect() usage by @​anthonyshew in #​12891
• fix: Remove scm expect usage by @​anthonyshew in #​12893
• fix: Remove auth unwrap usage by @​anthonyshew in #​12886
• fix: Remove turbopath's unwrap() usage by @​anthonyshew in #​12884
• fix: Remove auth's expect() usage by @​anthonyshew in #​12895
• fix: Remove wax unwrap usage by @​anthonyshew in #​12899
• fix: Remove scm unwrap usage by @​anthonyshew in #​12897
• fix: Remove turborepo-boundaries's unwrap() usage by @​anthonyshew in #​12896
• fix: Remove daemon unwrap usage by @​anthonyshew in #​12898
• fix: Include lockfile-changed packages in affected tasks by @​anthonyshew in #​12900
• fix: Remove turborepo-wax's expect() usage by @​anthonyshew in #​12901
• fix: Remove turborepo-filewatch's expect() usage by @​anthonyshew in #​12903
• fix: Remove turborepo-cache's expect() usage by @​anthonyshew in #​12902
• fix: Remove turborepo-daemon's expect() usage by @​anthonyshew in #​12904
• fix: Remove turborepo-engine's unwrap() usage by @​anthonyshew in #​12906
• fix: Remove filewatch unwrap usage by @​anthonyshew in #​12907
• fix: Remove engine expect usage by @​anthonyshew in #​12908
• fix: Remove cache unwrap usage by @​anthonyshew in #​12909
• fix: Remove turborepo-lockfiles expect() usage by @​anthonyshew in #​12910
• chore: Set pnpm minimum release age by @​anthonyshew in #​12912
• fix: Remove turborepo-lockfiles's unwrap() usage by @​anthonyshew in #​12911
• fix: Remove turborepo-vt100's unwrap() usage by @​anthonyshew in #​12913
• release(turborepo): 2.9.15-canary.4 by @​github-actions[bot] in #​12905
• fix: Remove turborepo-lib's unwrap() usage by @​anthonyshew in #​12915
• fix: Remove turborepo-lib's expect() usage by @​anthonyshew in #​12914
• fix: Remove shim test unwrap usage by @​anthonyshew in #​12917
• fix: Remove turbo json test unwrap allowance by @​anthonyshew in #​12918
• fix: Remove run summary test unwrap usage by @​anthonyshew in #​12916
• release(turborepo): 2.9.15-canary.5 by @​github-actions[bot] in #​12919
• fix: Restore task completion semantics by @​anthonyshew in #​12923
• fix: Preserve nested Bun workspace dependency versions by @​anthonyshew in #​12924
• release(turborepo): 2.9.15-canary.6 by @​github-actions[bot] in #​12925
• fix: Restore release PR auto-merge by @​anthonyshew in #​12927
• perf: Index repo gitignore matchers by @​anthonyshew in #​12928
• ci: Disable incremental Rust test builds by @​anthonyshew in #​12929
• perf: Trim OpenTelemetry crate features by @​anthonyshew in #​12930
• perf: Trim microfrontends proxy HTTP features by @​anthonyshew in #​12931
• fix: Accept experimentalCI object config by @​anthonyshew in #​12934
• release(turborepo): 2.9.15-canary.7 by @​github-actions[bot] in #​12935
• fix: Restore a few internal invariant checks by @​anthonyshew in #​12933
• fix: Improve profile tracing coverage by @​anthonyshew in #​12936
• fix: Use build-scale OTel duration buckets by @​anthonyshew in #​12939
• fix: Preserve pnpm injected peer package entries by @​anthonyshew in #​12940
• feat: Add heap allocation profiling by @​anthonyshew in #​12943
• release(turborepo): 2.9.15-canary.8 by @​anthonyshew in #​12945
• docs: Correct attribute presence claims in turborepo-otel by @​adityasingh2400 in #​12932
• chore(turbo-codemod): Remove duplicate "in" in transforms path comment by @​mvanhorn in #​12948
• chore: Switch Geist font imports to npm geist package by @​christopherkindl in #​12952
• fix: Respect root gitignore during prune by @​anthonyshew in #​12953
• fix: Harden OTEL endpoint validation by @​anthonyshew in #​12954

New Contributors

• @​gioboa made their first contribution in #​12794
• @​bjormgyg made their first contribution in #​12829
• @​adityasingh2400 made their first contribution in #​12932
• @​mvanhorn made their first contribution in #​12948
• @​christopherkindl made their first contribution in #​12952

Full Changelog: vercel/turborepo@v2.9.14...v2.9.15

v2.9.14: Turborepo v2.9.14

Compare Source

[!NOTE]
This release contains important security fixes.

High:

• GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection

Low:

• GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation
• GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection

What's Changed

Changelog

• release(turborepo): 2.9.12 by @​github-actions[bot] in #​12774
• fix: Restore docs mobile menu by @​anthonyshew in #​12782
• ci: Use pull_request for PR title linting by @​anthonyshew in #​12787
• ci: Scope GitHub Actions caches by branch by @​anthonyshew in #​12788
• test: Validate lockfiles without dependency downloads by @​anthonyshew in #​12789
• Removed unneeded import form hash creation script in docs by @​dancrumb in #​12799
• fix: Validate auth callback state by @​anthonyshew in #​12802
• fix: Harden VS Code extension command execution by @​anthonyshew in #​12800
• fix: Avoid project-local Yarn during detection by @​anthonyshew in #​12801
• chore: Release 2.9.13 by @​anthonyshew in #​12803

New Contributors

• @​dancrumb made their first contribution in #​12799

Full Changelog: vercel/turborepo@v2.9.12...v2.9.14

v2.9.12: Turborepo v2.9.12

Compare Source

What's Changed

Changelog

• release(turborepo): 2.9.11 by @​github-actions[bot] in #​12771
• fix: Allow transit nodes in LSP diagnostics by @​anthonyshew in #​12773

Full Changelog: vercel/turborepo@v2.9.11...v2.9.12

v2.9.11: Turborepo v2.9.11

Compare Source

What's Changed

Changelog

• release(turborepo): 2.9.10 by @​github-actions[bot] in #​12745
• ci: Publish VS Code extension on release by @​anthonyshew in #​12747
• fix: Start daemon for VSCode Extension from the extension itself by @​anthonyshew in #​12749
• release(turborepo): 2.9.11-canary.1 by @​github-actions[bot] in #​12748
• fix: Include file URIs in LSP lifecycle logs by @​anthonyshew in #​12751
• fix: Handle JSON decoration visitor depth by @​anthonyshew in #​12752
• fix: Resolve relative turbo path in VS Code extension by @​anthonyshew in #​12753
• fix: Preserve Bun nested dependencies during prune by @​anthonyshew in #​12754
• fix: Prefer installed Turbo for LSP by @​anthonyshew in #​12755
• release(turborepo): 2.9.11-canary.2 by @​github-actions[bot] in #​12750
• ci: Parallelize LSP release publishing by @​anthonyshew in #​12758
• fix: Reduce VS Code extension startup popups by @​anthonyshew in #​12759
• fix: Support turbo.jsonc in VS Code extension by @​anthonyshew in #​12760
• fix: Remove VS Code task key gradient by @​anthonyshew in #​12761
• release(turborepo): 2.9.11-canary.3 by @​github-actions[bot] in #​12756
• chore: Release v2.9.11-canary.4 by @​anthonyshew in #​12762
• ci: Stop VS Code publish from blocking release PR by @​anthonyshew in #​12763
• release(turborepo): 2.9.11-canary.5 by @​github-actions[bot] in #​12764
• fix: Publish VS Code extension from release tag by @​anthonyshew in #​12765
• fix: Support shimmed VS Code LSP probes by @​anthonyshew in #​12767
• release(turborepo): 2.9.11-canary.6 by @​github-actions[bot] in #​12766
• release(turborepo): 2.9.11-canary.7 by @​github-actions[bot] in #​12768
• fix: Allow $TURBO_EXTENDS$ in LSP diagnostics by @​anthonyshew in #​12770

Full Changelog: vercel/turborepo@v2.9.10...v2.9.11

v2.9.10: Turborepo v2.9.10

Compare Source

What's Changed

Changelog

• release(turborepo): 2.9.9-canary.4 by @​github-actions[bot] in #​12716
• release(turborepo): 2.9.9 by @​github-actions[bot] in #​12719
• fix: Respect SCM env vars in turbo query affected by @​anthonyshew in #​12722
• ci: Package VSCode extension in release workflow by @​anthonyshew in #​12723
• fix: Avoid some raw create-turbo example telemetry by @​anthonyshew in #​12725
• fix: Escape graph HTML payloads by @​anthonyshew in #​12726
• fix: Prevent OTEL token injection to spoofed origins by @​anthonyshew in #​12727
• fix: Retry HTTP status failures by @​anthonyshew in #​12728
• fix: Validate microfrontend proxy Host header by @​anthonyshew in #​12730
• fix: Redact task hash env debug logs by @​anthonyshew in #​12733
• fix: Filter microfrontend proxy environments by @​anthonyshew in #​12732
• fix: Preserve FSEvents mount points for device-relative paths by @​anthonyshew in #​12729
• fix: Validate proxy Host headers by @​anthonyshew in #​12731
• fix: Resolve TypeScript .js extension imports to .ts files in boundaries by @​maschwenk in #​12644
• fix: Use random temp path for repo downloads by @​anthonyshew in #​12736
• release(turborepo): 2.9.10-canary.1 by @​github-actions[bot] in #​12734
• fix: Reject OTel endpoints with userinfo by @​anthonyshew in #​12737
• fix: Authenticate local devtools WebSocket by @​anthonyshew in #​12738
• fix: Handle clipboard exec errors by @​anthonyshew in #​12739
• fix: Restrict Vercel token reuse to trusted API origins by @​anthonyshew in #​12740
• fix: Keep workspace config discovery inside root by @​anthonyshew in #​12741
• fix: Hardening for daemon IPC endpoints by @​anthonyshew in #​12742
• fix: Enforce cache filesystem boundaries by @​anthonyshew in #​12743

Full Changelog: vercel/turborepo@v2.9.9...v2.9.10

v2.9.9: Turborepo v2.9.9

Compare Source

What's Changed

Changelog

• release(turborepo): 2.9.8 by @​github-actions[bot] in #​12700
• fix: Remove Unix parent death watchdogs by @​anthonyshew in #​12699
• release(turborepo): 2.9.9-canary.1 by @​github-actions[bot] in #​12705
• fix: Scope repo index prefixes to Git root by @​anthonyshew in #​12706
• release(turborepo): 2.9.9-canary.2 by @​github-actions[bot] in #​12708
• ci: Harden non-release GitHub Actions by @​anthonyshew in #​12707
• docs: Add pnpm workspace flag (-w) to Oxc setup docs by @​mattjoll in #​12655
• fix: Harden OG image signatures by @​anthonyshew in #​12709
• fix: Scope release npm publishing credentials by @​anthonyshew in #​12710
• ci: Harden release workflows by @​anthonyshew in #​12711
• release(turborepo): 2.9.9-canary.3 by @​github-actions[bot] in #​12712
• fix: Harden docs security endpoints by @​anthonyshew in #​12713
• ci: Harden internal GitHub Actions by @​anthonyshew in #​12714
• ci: Harden release workflow handling by @​anthonyshew in #​12715
• fix: Preserve lockfiles during dry-run conversion by @​anthonyshew in #​12717
• ci: Fix LSP workflow container matrix by @​anthonyshew in #​12718

New Contributors

• @​mattjoll made their first contribution in #​12655

Full Changelog: vercel/turborepo@v2.9.8...v2.9.9

v2.9.8: Turborepo v2.9.8

Compare Source

What's Changed

@​turbo/repository

• chore: Update to Rust 1.95.0 by @​ognevny in #​12636

Changelog

• release(turborepo): 2.9.7 by @​github-actions[bot] in #​12679
• test: Add regression for gitignored output restore by @​anthonyshew in #​12681
• docs: Clarify root task guidance by @​anthonyshew in #​12683
• fix: Preserve concrete dependency precedence by @​anthonyshew in #​12682
• release(turborepo): 2.9.8-canary.1 by @​github-actions[bot] in #​12685
• fix: Resolve Yarn catalog affected packages by @​anthonyshew in #​12684
• release(turborepo): 2.9.8-canary.2 by @​github-actions[bot] in #​12687
• fix: Preserve Bun prune lockfile validity by @​anthonyshew in #​12686
• release(turborepo): 2.9.8-canary.3 by @​github-actions[bot] in #​12689
• fix: Create prune docker bin stubs by @​anthonyshew in #​12688
• release(turborepo): 2.9.8-canary.4 by @​github-actions[bot] in #​12690
• fix: Keep tbx shell connections stable by @​anthonyshew in #​12692
• perf: Reduce turbo watch hash memory spikes by @​anthonyshew in #​12695
• release(turborepo): 2.9.8-canary.5 by @​github-actions[bot] in #​12696
• fix: Reduce parent-death watchdog CPU usage by @​anthonyshew in #​12697
• release(turborepo): 2.9.8-canary.6 by @​github-actions[bot] in #​12698

Full Changelog: vercel/turborepo@v2.9.7...v2.9.8

v2.9.7: Turborepo v2.9.7

Compare Source

What's Changed

eslint

• chore: Upgrade dependencies to resolve their known vulnerabilities by @​anthonyshew in #​12604

Examples

• feat(sandbox): Bump @​vercel/sandbox from v1 to beta by @​marc-vercel in #​12595
• chore: Update examples to Turbo 2.9.6 by @​cursor[bot] in #​12600
• examples: Add Ultracite example by @​haydenbleasel in #​12615

Changelog

• fix: Align Markdown docs routing with docs/md endpoints by @​molebox in #​12596
• fix: Support two-dot git ranges in filter selectors by @​anthonyshew in #​12599
• feat: Graceful shutdown by @​anthonyshew in #​12607
• test: Add stdin EOF startup regression coverage by @​anthonyshew in #​12609
• fix: Ignore SIGINT in shim after spawning local turbo by @​anthonyshew in #​12612
• fix: Support pnpm v11 multi-document lockfiles by @​anthonyshew in #​12616
• fix: Preserve graceful shutdown exit code by @​anthonyshew in #​12620
• fix: Keep Node wrapper alive during graceful shutdown by @​anthonyshew in #​12622
• fix: Preserve PTY graceful shutdown semantics by @​anthonyshew in #​12624
• feat: Move Vercel auth to standard OAuth/device flows by @​markandrus in #​12526
• fix: Preserve legacy Vercel auth compatibility by @​anthonyshew in #​12629
• fix: Recover Vercel auth tokens across login flows by @​anthonyshew in #​12631
• docs: Fix TURBO_PLATFORM_ENV_DISABLED value in docs (true, not false) by @​sleitor in #​12633
• chore: Update flags SDK by @​AndyBitz in #​12646
• ci: Disable AWS-backed sccache by @​anthonyshew in #​12663
• fix: Prevent prune from overmatching gitignore entries by @​anthonyshew in #​12662
• ci: Harden release API commits by @​anthonyshew in #​12664
• ci: Fix release API commit paths by @​anthonyshew in #​12665
• release(turborepo): 2.9.7-canary.14 by @​github-actions[bot] in #​12666
• chore: Add tbx sandbox helper by @​anthonyshew in #​12668
• fix: Allow npm registry in tbx sandboxes by @​anthonyshew in #​12669
• fix: Install turbo globally in tbx base by @​anthonyshew in #​12670
• docs: Clarify package hash file inputs by @​anthonyshew in #​12671
• fix: Allow tbx sandboxes to use stale bases by @​anthonyshew in #​12672
• fix: Install dotfiles during tbx base refresh by @​anthonyshew in #​12673
• fix: Improve tbx sandbox startup by @​anthonyshew in #​12674
• fix: Improve tbx sandbox startup defaults by @​anthonyshew in #​12675
• fix: Support pnpm 11 flat patch lockfiles by @​anthonyshew in #​12676
• docs: Fix link to passthrough variables source code by @​Wartijn in #​12643
• release(turborepo): 2.9.7-canary.15 by @​github-actions[bot] in #​12677
• fix: Avoid rerunning non-cacheable watch dependencies by @​anthonyshew in #​12678

New Contributors

• @​marc-vercel made their first contribution in #​12595
• @​cursor[bot] made their first contribution in #​12600
• @​markandrus made their first contribution in #​12526
• @​AndyBitz made their first contribution in #​12646
• @​Wartijn made their first contribution in #​12643

Full Changelog: vercel/turborepo@v2.9.6...v2.9.7

v2.9.6: Turborepo v2.9.6

Compare Source

What's Changed

create-turbo

• chore: Update dependencies found in audits by @​anthonyshew in #​12586

Examples

• fix: Add missing @types/node to with-svelte example apps by @​anthonyshew in #​12585

Changelog

• docs: Add Bun equivalent for updating dependencies by @​anthonyshew in #​12580
• fix: Mention turbo.json in concurrency error message by @​anthonyshew in #​12582
• fix: Surface actionable message when remote cache is requested but not linked by @​anthonyshew in #​12584
• chore: Delete agents app by [@​anthonyshew](https://redirect.github.com/anthonyshe

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 12pm on Sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.