BetaWeekly digests are a beta — we're trying something new. Feedback welcome.
JavaScript Runtimes & Tooling weekly digests
- Week of October 5, 2026Deno hands the runtime to Cloudflare as pnpm hardens the supply chain
The Deno team is joining Cloudflare, with the Deno runtime entering a one-year maintenance window before development ends, while pnpm shipped eight releases focused on supply-chain security, a new remote cache, and an experimental node linker.
- Week of September 28, 2026pnpm hardens credentials and trims its footprint as Turborepo tags tasks
pnpm spent the week closing credential leaks and cutting its own install size, while Turborepo shipped task tags with inherited configuration for finer-scoped builds.
- Week of September 21, 2026Turborepo patches two CVEs as pnpm lands dedupe and relocatable modules
Turborepo shipped a security release patching two vulnerabilities in js-yaml and its docs toolchain while reworking remote-cache behavior, and pnpm rolled out automatic dependency deduplication, relocatable node_modules, and repo-config-aware Node shims across three releases.
- Week of September 14, 2026Turborepo's polyglot push meets pnpm's Python ambitions
Turborepo spent the week building out non-JavaScript workspace support — Python virtual environments, uv and Cargo affectedness, Go workspace handling — and cut a 2.11 major release, while pnpm 12.5 turned its own attention to Python interpreters and cross-platform lockfiles.
- Week of September 7, 2026pnpm opens the workspace to Cargo and Python as Turborepo tunes for speed
pnpm 12.4 lets a single workspace install crates and Python packages alongside npm dependencies, while Turborepo spent the week on resolver, cache, and watch performance and Vitest's VS Code extension gained a trace view.
- Week of August 31, 2026pnpm's two CLIs converge, Bun patches, and Vitest 5 lands
pnpm brought its JavaScript and Rust CLIs into feature parity, Bun shipped two rounds of fixes, and Vitest 5 arrived with a performance-focused rewrite of how test files are discovered.
- Week of August 24, 2026pnpm rewrites itself in Rust as the package manager hits stable 12
pnpm 12 lands as a full Rust rewrite that keeps pnpm 11's commands and lockfile intact, while Deno adds a desktop clipboard API and Vitest stabilizes its specification parser ahead of v5.
- Week of August 17, 2026Package managers converge on lockfile fixes and test runners harden browser defaults
pnpm's 11.21-11.23 releases reshape how multi-registry setups and lockfiles behave, while Bun v1.4 and Turborepo v2.10.11 polish install and caching edges. Vitest's v4.1.11 and v5.0.0-rc.2 tighten browser test reliability and CI reporting.
- Week of August 10, 2026Pruning speeds up while vitest rethinks its config
Turborepo's 2.10.x line landed several performance and correctness fixes across pruning, hashing, and lockfile support, while Vitest shipped its first v5 release candidate with breaking changes to how test configurations work.
- Week of August 3, 2026Turborepo embraces uv, Deno streams Blob text
Python and uv workspaces land in Turborepo while Deno adds Blob text streaming and a QuickJS backend, both runtimes pushing hard on monorepo and JS compatibility fronts.
- Week of July 27, 2026Android support lands in Turborepo as pnpm sharpens update workflows
Turborepo 2.10.8 brings Android support via Termux, while pnpm 11.15-11.19 add GitHub Actions version management, changeset-powered updates, and memory improvements for large workspaces.
- Week of July 20, 2026Vitest beta rethinks config, Turborepo stable courts Cargo
Vitest v5.0.0-beta.7 separates config resolution from server creation, a breaking change for programmatic users, while Turborepo v2.10.6 adds first-class Cargo-only repository support.
- Week of July 13, 2026pnpm adds workspace release management while Turborepo embeds sccache for Cargo
pnpm 11.11-11.14 introduced native workspace release management with `pnpm change`, `pnpm lane`, and `pnpm version -r`, alongside a new `pnpm doctor` command and significant memory improvements. Meanwhile, Turborepo shipped a canary cycle culminating in embedded sccache support for Cargo compile caching, Cargo-only repo support, and security fixes.
- Week of July 6, 2026Mocks clear by default as Vitest reaches beta 6 and Turborepo ships Cargo workspace support
Vitest v5.0.0-beta.6 introduces breaking changes to mock clearing and reporter output directories, while Turborepo v2.10.4 adds production-ready Cargo workspace support and Deno v2.9.2 brings desktop window APIs and React Router autodetect.
- Week of June 29, 2026Turborepo embraces the new breed of package managers
Turborepo shipped full support for nub and aube package managers across 2.10.x, while pnpm 11.10 made the week's other splash with a CI-friendly authentication overhaul and a path toward its Rust rewrite.
- Week of June 22, 2026Desktop runtimes, faster builds, and smarter caches
Deno 2.9 shipped with a groundbreaking `deno desktop` subcommand for native desktop apps and major performance gains, while Turborepo reached v2.10.0 with incremental task caching and graceful shutdown.
- Week of June 15, 2026pnpm 11.8 ships dry-run install while Turborepo polishes shutdown and Vitest rolls betas
pnpm 11.8 adds dry-run install previews and richer SBOM output; Turborepo releases three canary builds improving PTY process shutdown and symlink handling; Vitest ships a v4.1.9 bugfix backport alongside v5.0.0-beta.5 with breaking config changes.
- Week of June 8, 2026pnpm locks down credential exposure as Turborepo chases Windows PTY parity
pnpm shipped a security fix stopping repository-controlled `.npmrc` files from expanding environment variables, alongside new releases adding frozen store support and file-free registry auth. Turborepo pushed seven canary releases and two stable patches focused on Windows PTY handling and JIT task input hashing.
- Week of June 1, 2026Post-quantum crypto lands in Deno, Vitest ships v5 beta
Deno 2.8.2 adds post-quantum cryptography and a `--minify` flag for compiled binaries, while Vitest released its v5 beta with breaking changes and backported security controls for the browser test runner.
- Week of May 25, 2026pnpm closes supply-chain holes while Turborepo fixes its stability floor
pnpm 11.4 and 11.5 shipped security hardening around lockfiles, credentials, and patch files, while Turborepo landed a series of fixes for process hangs, symlink races, and Bun compatibility across four canary and stable releases.
- Week of May 18, 2026Deno 2.8 rewires the CLI, pnpm experiments with Rust
Deno shipped its biggest release of the year with workspace support, six new subcommands, and a new agent security firewall, while pnpm opened the door to a Rust-powered install backend and Turbo kept hardening.
- Week of May 11, 2026Turborepo's triple security fix overshadows a quiet week
Turborepo patched a high-severity command injection vulnerability in its VS Code extension alongside fixes for CSRF and unintended code execution, while Bun shipped v1.3.14 and Vitest released a minor bug-fix update.