[Cycode] Fix for vulnerable manifest file dependency - turbo updated to version 2.9.14

[cycode-security]

Cycode Vulnerable Dependencies Update

This pull request updates the following manifest file:

File Path	Number of packages to update
ui/package.json	1

📂 ui/package.json

1 package will be updated to resolve vulnerabilities:

Package Name	Current Version	Updated Version
turbo	2.4.4	2.9.14

Warning

Lock file generation failed for one or more manifest files in this pull request. Please regenerate the lock file manually before merging.

---

Note

Low Risk
Low risk dependency bump limited to the UI monorepo build toolchain, though it may affect CI/build caching behavior. No application/runtime code changes are included.

Overview
Updates the UI workspace tooling by bumping turbo in ui/package.json from ^2.3.4 to ^2.9.14 to address a vulnerable dependency.

^{Reviewed by Cursor Bugbot for commit 3e30c09. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3e30c09. Configure here.}

[cursor]

Lockfile out of sync

High Severity

turbo is set to ^2.9.14 in ui/package.json, but ui/package-lock.json still lists ^2.3.4 and installs [email protected]. Frontend CI runs npm ci in ui/, which requires those files to match, so installs can fail and the intended security bump may not be applied.

 

^{Reviewed by Cursor Bugbot for commit 3e30c09. Configure here.}