Turborepo 2.11.7: SDKROOT passthrough and Vercel OIDC cache quieting (2 Oct 2026)

No affiliate links. This is a frontend toolchain note from the Turborepo GitHub releases and the npm turbo registry. ShopperCove has not upgraded a production monorepo to 2.11.7 for this article.

Why 2.11.7 now

npm turbo@2.11.7 is the latest dist-tag as of 5 Oct 2026, published 2 Oct 2026 (14:58 UTC / 20:28 IST). The GitHub release landed at 14:57 UTC. Among Bun (1.4.2, 5 Sep), Prettier (3.9.9, 23 Sep), @rspack/core (2.2.8, 28 Sep), and Vite (8.3.2, 1 Oct), this is the freshest Turborepo stable line—and it is the Bun/Prettier/Rspack/Turborepo slot for this batch.

2.11.7 itself is a small patch. The useful operator story is the two cache/env fixes plus the 2.11.6 task-tag work that shipped the day before.

What 2.11.7 changes

From the v2.11.7 release and compare v2.11.6…v2.11.7:

1. SDKROOT passthrough (#14353): macOS / Apple SDK builds that rely on SDKROOT inside repository tasks should now see the variable. If your iOS/macOS or native tooling failed under turbo run but worked outside it, re-test after pinning 2.11.7.
2. Vercel OIDC token rotation no longer busts .env.local cache inputs (#14356): rotating the Vercel OIDC token written into .env.local should stop invalidating task hashes that treat that file as an input. Expect fewer surprise cache misses on Vercel-linked local projects.
3. Example chore: with-vite-module-federation updated (#14349).

Official env and caching docs: using environment variables, caching.

What you also get if you are still on 2.11.5 or earlier

2.11.6 (1 Oct 2026)

Headline features from the v2.11.6 release:

• Task tags with configuration inheritance (#14342)
• Expose tags in turbo query, filter query results by tags, and filter tasks by tags in the CLI (#14343, #14344, #14345)
• Standalone turbo upgrades correctly on installer reruns (#14330)
• Yarn patch resolutions kept with npm-protocol selectors during prune (#14337)
• Task inputs normalized the same way for affected detection and hashing (#14341)
• Production MFE negative lookaheads matched locally (#13496)

2.11.5 (28 Sep 2026) highlights worth knowing

From v2.11.5: versioned standalone turbo archives and curl | bash installer URLs; remote-cache backoff during outages; sign complete on-disk artifacts after local cache writes; stabilize pnpm per-workspace lockfile hashes; bundle docs inside the turbo npm package; js-yaml bump for CVE-2026-84375.

Upgrade checklist

1. Pin exactly: npm i -D turbo@2.11.7 (or pnpm / yarn / bun equivalent) and commit the lockfile.
2. If you develop on macOS with native/xcrun tasks: confirm SDKROOT is visible inside turbo run after the upgrade (#14353).
3. If .env.local holds a rotating Vercel OIDC token: compare cache hit rates before/after (#14356). Drop that token from inputs / env / passThroughEnv only if you still see churn—prefer the upstream fix first.
4. If you want tag-based filters: upgrade through 2.11.6+, then add tags in turbo.json and try turbo query / CLI filters (#14342–#14345).
5. Standalone / non-npm installs: re-run the documented installer so 2.11.6+ upgrade-on-rerun behavior applies (#14330, #14325).
6. No urgency invented: 2.11.7 is a two-fix patch, not a security advisory of its own (the recent yaml CVE fix landed in 2.11.5).

ShopperCove did not change production Turborepo versions for this article. Prefer turborepo.dev and the GitHub releases over third-party roundups.

Bottom line

Turborepo 2.11.7 (2 Oct 2026) is the patch to take if Apple SDKROOT tasks or Vercel OIDC churn in .env.local have been burning your cache. Pair it with 2.11.6 task tags if you are still behind. No affiliate.

Sources

• 01registry.npmjs.org/turbo/2.11.7

Related

• 01shoppercove.com/blog/vite-plus-1-0-unified-toolchain-october-2026
• 02shoppercove.com/blog/pnpm-12-9-1-rust-rewrite-wasm-split-october-2026
• 03shoppercove.com/blog/biome-2-5-15-type-inference-nursery-rules-october-2026
• 04shoppercove.com/blog/webpack-5-111-esm-output-stable-september-2026
• 05shoppercove.com/blog/oxlint-1-87-react-suggestions-a11y-fixes-october-2026
• 06shoppercove.com/blog/astro-7-3-preview-ignore-lock-october-2026
• 07shoppercove.com/blog/eslint-10-12-release-october-2026
• 08shoppercove.com/blog/nodejs-26-lts-october-2026-schedule-change