fix: Report malformed JSON parse errors instead of panicking - #13198
Merged
Merged
Conversation
biome's deserialization entry points run even when the source failed to parse, and deserializing a broken syntax tree panics on unterminated string literals (assertion failed: start <= end in biome_text_size). A dangling quote in turbo.json or any package.json, e.g. mid-edit during watch mode, crashed turbo with an internal panic. No published biome release fixes this, so add turborepo_errors::json::deserialize_from_json_str, which checks for parse errors before deserializing and reports them as diagnostics. Switch all JSON config parsing (turbo.json, package.json, microfrontends) to it, and ban the raw biome entry points via clippy disallowed-methods so new call sites cannot reintroduce the panic. Fixes #13197
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
anthonyshew
enabled auto-merge (squash)
July 2, 2026 12:32
anthonyshew
pushed a commit
that referenced
this pull request
Jul 2, 2026
## Release v2.10.3-canary.8 > [!CAUTION] > Versioned docs aliasing FAILED. [View logs](https://github.com/vercel/turborepo/actions/runs/28592357402) ### Changes - release(turborepo): 2.10.3-canary.7 (#13195) (`b426736`) - chore: Upgrade TypeScript to 7.0.1-rc (#13144) (`cf07baa`) - docs: Add filtered installs to Vercel guide (#13196) (`7e70b52`) - examples: add with-mcp-servers (#12997) (`8eb4d9d`) - fix: Report malformed JSON parse errors instead of panicking (#13198) (`a69df7d`) - fix: Improve error messaging when platform binary is missing (#13199) (`8e145f0`) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
anthonyshew
pushed a commit
that referenced
this pull request
Jul 3, 2026
## Release v2.10.3 > [!CAUTION] > Versioned docs aliasing FAILED. [View logs](https://github.com/vercel/turborepo/actions/runs/28672736782) ### Changes - feat: Add nub to create-turbo options (#13173) (`82b1cf1`) - release(turborepo): 2.10.2 (#13174) (`ec30b18`) - release(turborepo): 2.10.3-canary.1 (#13176) (`47e2b22`) - fix: Normalize package manager versions (#13177) (`658f607`) - fix: Use singular workspace in package resolution error (#13178) (`d199c53`) - fix: Support nub native lockfiles (#13179) (`50546e6`) - perf(build): Enable thin LTO + codegen-units=1 for release builds (#13160) (`628aea9`) - release(turborepo): 2.10.3-canary.2 (#13181) (`16aed08`) - feat: Add aube package manager support (#13183) (`0f78006`) - release(turborepo): 2.10.3-canary.3 (#13184) (`fec7cee`) - fix: Normalize package manager version output (#13185) (`f469ed8`) - release(turborepo): 2.10.3-canary.4 (#13186) (`406fe59`) - refactor: Richer internal dependency data (#13188) (`909c696`) - fix: Honor package manager version ranges (`136273e`) - fix: Skip node_modules in boundaries checks (#13191) (`93741a0`) - fix: Add token exchange recovery guidance (#13192) (`bef588b`) - feat: Add --production flag to turbo prune (#13190) (`3777442`) - release(turborepo): 2.10.3-canary.5 (#13193) (`ca20ca2`) - feat: Accept Bun lockfile version 2 (#13119) (`69e2085`) - fix: Handle task executor join errors as internal errors (#13148) (`c4017e9`) - fix: Tweaks for nub support (#13187) (`ca029ee`) - release(turborepo): 2.10.3-canary.6 (#13194) (`b79f767`) - release(turborepo): 2.10.3-canary.7 (#13195) (`b426736`) - chore: Upgrade TypeScript to 7.0.1-rc (#13144) (`cf07baa`) - docs: Add filtered installs to Vercel guide (#13196) (`7e70b52`) - examples: add with-mcp-servers (#12997) (`8eb4d9d`) - fix: Report malformed JSON parse errors instead of panicking (#13198) (`a69df7d`) - fix: Improve error messaging when platform binary is missing (#13199) (`8e145f0`) - release(turborepo): 2.10.3-canary.8 (#13200) (`5987ed1`) - fix(watch): recover from slow initial hash instead of timing out (#13159) (`05e26cb`) - chore: Update vitest example to vitest 4 and use native test merging (#13202) (`e2b61dc`) - feat: Toggle between the TUI and streamed logs (#13203) (`1325455`) - fix: Resolve Bun scoped package deps that share a name with a dependency (#13207) (`e4773ab`) - feat: Select tasks by clicking rows in the TUI task list (#13206) (`c568f67`) - perf: Avoid deep-cloning dependency maps in lockfile closure cache (#13209) (`abd84cf`) - perf: Cache root internal dependencies in package graph (#13211) (`7ec8c6d`) - feat: Automatically copy TUI selection to clipboard on mouse release (#13208) (`61d6013`) - perf: Cache env wildcard matches across tasks during hashing (#13210) (`148b1dd`) - perf: Replace per-package graph traversals in scope filtering (#13212) (`28d1871`) - perf: Derive dirty hash from repo index (#13213) (`b521d32`) - fix: Include untracked symlinks in repo-index dirty hash (#13218) (`c3c91ab`) - refactor: Use upstream libghostty-vt crates instead of vendored bindings (#13205) (`c2115dc`) - fix: Remove devtools feature flag (#13219) (`65efe27`) - fix: Harden TUI terminal restore during shutdown (#13220) (`dccab93`) - fix: Correct gitignore precedence in untracked walk and memoize matcher chains (#13221) (`bc32fcc`) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
turbopanics withassertion failed: start <= end(frombiome_text_size) when any JSON config it reads contains an unterminated string literal — e.g. a dangling"left inturbo.jsonor apackage.jsonmid-edit while watch mode re-reads the file. Fixes #13197.The root cause is in biome 0.5.7:
deserialize_from_json_strruns deserialization even when parsing failed, andinner_string_textassumes every string token has both quote delimiters, computingTextRange::new(1, 0)for a lone-quote token. No newer version of the affected biome crates is published to crates.io, so this cannot be fixed by upgrading.What
turborepo_errors::json::deserialize_from_json_str, which checks for parse errors before deserializing and returns them as diagnostics instead of deserializing a broken syntax tree.turbo.json/turbo.jsonc,package.json, and microfrontends configs. (bun.lockparsing already guarded correctly.)disallowed-methodsso future call sites can't reintroduce the panic. The single#[allow]lives inside the wrapper, where the tree is proven error-free.How to test
Put a dangling quote in a
turbo.jsonvalue (e.g."persistent": "followed by a newline) and run anyturbocommand. Before: internal Rust panic. After:Same for
package.json. Regression tests cover the panicking inputs at every converted call site, verified against a repro that panics with the exact same inputs through biome's raw entry point.