JavaScript Runtimes & Tooling

Turborepo ships broad performance work and a setup command

Turborepo v2.11.9 lands dozens of performance optimizations across lockfile parsing, caching, globbing, and file watching, alongside a new root-only turbo setup policy and fixes for crashes on non-UTF-8 arguments and missing Git roots.

• —Turborepo's v2.11.9 release is dominated by performance work spanning lockfile closure computation, cache archive handling, glob matching, task output rendering, and file watching.
• —A new root-only turbo setup policy in turbo.json joins fixes for the turbo shim crashing on non-UTF-8 arguments, missing Git or non-repository setup roots, and Homebrew's bundled npm prefix in setup preflight.

Vitest fixes hook cleanup and mock memory leaks across two branches

Vitest shipped correctness fixes on both the v4 and v5 branches, ensuring hook cleanups still run when a later hook fails, releasing mocks of finished test files to stop memory leaks, and hardening manual and redirect mocks.

• —Vitest v5 now runs hook cleanups even when a later hook fails and releases mocks belonging to finished test files, fixing memory leaks in long test sessions.
• —Vitest v5 aborts all running tests on cancel and preserves Vite's default fs.deny when an API token file is present.
• —Vitest backported hardened manual and redirect mocks to the v4 branch.

Turborepo adds a verified managed-tool setup command

Turborepo introduced an experimental setup command that installs managed tools through checksum-verified downloads and atomic lock writes, alongside fixes for npm patches in pruned workspaces and a codemod that emitted duplicate package names.

• —Turborepo's experimental setup command installs managed tools with bounded, checksum-verifying downloads and atomic lock writes.
• —npm patches now apply correctly in pruned workspaces, and symlinked AGENTS.md files are preserved.
• —A codemod no longer generates duplicate package names.

Vitest turns on module caching by default and expands trace viewer

Vitest enabled fsModuleCache by default and added fit and zoom controls to its trace viewer, alongside fixes for coverage memory leaks and V8 browser leaks between test files.

• —Vitest now caches filesystem modules by default, speeding up repeated runs without configuration
• —The trace viewer gained fit and zoom controls and highlights when a selector matches multiple elements
• —Fixed memory leaks in coverage collection and V8 browser leaks between test files, plus module mock resolution in paths containing spaces and Map/Set deep equality in assertions

Bun ships v1.4.3 with no user-facing change noted

Bun released v1.4.3, but the release carries no described change beyond install and upgrade instructions, leaving the day without a substantive update.

Deno team joins Cloudflare as the runtime winds down

The entire Deno team is moving to Cloudflare, leaving the Deno runtime with monthly bug-fix and security releases for one year before development ends, Deno Deploy shutting down in six months, and JSR continuing on Cloudflare infrastructure.

• —Deno enters maintenance mode: the whole team is joining Cloudflare, with only monthly bug fix and security releases for another year before development stops.
• —Deno Deploy shuts down in six months, with migration support offered to paying customers moving to Cloudflare Workers.
• —JSR keeps running, with its infrastructure relocating to Cloudflare.

Turborepo adds tag-filtered tasks and fixes pruning and codemod bugs

Turborepo gained taggable tasks with config inheritance that the CLI and query command can filter on, alongside fixes for Yarn patch resolutions lost during prune and duplicate names from the add-package-names codemod.

• —Turborepo lets tasks carry tags that inherit through configuration and can filter tasks and packages by tag from the CLI and query command.
• —Turborepo now preserves Yarn patch resolutions during prune and keeps task-input normalization consistent for affected detection and hashing.
• —Turborepo stops the add-package-names codemod from generating duplicate names and passes SDKROOT through to repository tasks.

pnpm patches install failures and tightens dependency security

pnpm fixed install failures after overrides changes and filtered frozen installs, while shipping security fixes that stop dependency versions from writing files outside the global virtual store and verify locked config dependencies against their registry before install.

• —pnpm now blocks a dependency version from writing files outside the global virtual store and verifies locked config dependencies against their registry before installing, so a lockfile can no longer swap a pinned config dependency's integrity.
• —Install failures are fixed after an overrides change and on filtered frozen installs with catalogPrune.
• —The experimental nodeLinker.type: loaded now keeps its generated store manifest, loader, and bin shims inside node_modules, which projects already gitignore.

Turborepo fixes cache invalidation from rotated OIDC tokens

Turborepo stops Vercel OIDC token rotation in .env.local from busting task cache inputs and passes SDKROOT through to repository tasks.

• —Turborepo no longer treats rotated Vercel OIDC tokens in .env.local as changed cache inputs, preventing spurious cache misses
• —SDKROOT is now passed through to repository tasks, fixing toolchain resolution for tasks that rely on it

pnpm adds StackBlitz WebContainer support and patches login

pnpm shipped a security fix for its login flow alongside automatic WebAssembly execution in StackBlitz WebContainers and a new per-registry network concurrency setting.

• —pnpm now runs under WebAssembly in StackBlitz WebContainers, including when install scripts are disabled, while native installs still use the native executable.
• —Registries can each define a networkConcurrency limit, capping in-flight requests per registry origin independently.
• —pnpm login received a security fix; every installed project is now recorded in the store.