---
collection: js-toolchain
collection_name: JavaScript Runtimes & Tooling
digest_count: 10
canonical: https://releases.sh/collections/js-toolchain/digest
---

# JavaScript Runtimes & Tooling weekly digests

- **[pnpm adds workspace release management while Turborepo embeds sccache for Cargo](https://releases.sh/collections/js-toolchain/digest/2026-07-13)** — week of 2026-07-13 (7 releases)
  > pnpm 11.11-11.14 introduced native workspace release management with `pnpm change`, `pnpm lane`, and `pnpm version -r`, alongside a new `pnpm doctor` command and significant memory improvements. Meanwhile, Turborepo shipped a canary cycle culminating in embedded sccache support for Cargo compile caching, Cargo-only repo support, and security fixes.
- **[Mocks clear by default as Vitest reaches beta 6 and Turborepo ships Cargo workspace support](https://releases.sh/collections/js-toolchain/digest/2026-07-06)** — week of 2026-07-06 (12 releases)
  > Vitest v5.0.0-beta.6 introduces breaking changes to mock clearing and reporter output directories, while Turborepo v2.10.4 adds production-ready Cargo workspace support and Deno v2.9.2 brings desktop window APIs and React Router autodetect.
- **[Turborepo embraces the new breed of package managers](https://releases.sh/collections/js-toolchain/digest/2026-06-29)** — week of 2026-06-29 (17 releases)
  > Turborepo shipped full support for nub and aube package managers across 2.10.x, while pnpm 11.10 made the week's other splash with a CI-friendly authentication overhaul and a path toward its Rust rewrite.
- **[Desktop runtimes, faster builds, and smarter caches](https://releases.sh/collections/js-toolchain/digest/2026-06-22)** — week of 2026-06-22 (7 releases)
  > Deno 2.9 shipped with a groundbreaking `deno desktop` subcommand for native desktop apps and major performance gains, while Turborepo reached v2.10.0 with incremental task caching and graceful shutdown.
- **[pnpm 11.8 ships dry-run install while Turborepo polishes shutdown and Vitest rolls betas](https://releases.sh/collections/js-toolchain/digest/2026-06-15)** — week of 2026-06-15 (7 releases)
  > pnpm 11.8 adds dry-run install previews and richer SBOM output; Turborepo releases three canary builds improving PTY process shutdown and symlink handling; Vitest ships a v4.1.9 bugfix backport alongside v5.0.0-beta.5 with breaking config changes.
- **[pnpm locks down credential exposure as Turborepo chases Windows PTY parity](https://releases.sh/collections/js-toolchain/digest/2026-06-08)** — week of 2026-06-08 (14 releases)
  > pnpm shipped a security fix stopping repository-controlled `.npmrc` files from expanding environment variables, alongside new releases adding frozen store support and file-free registry auth. Turborepo pushed seven canary releases and two stable patches focused on Windows PTY handling and JIT task input hashing.
- **[Post-quantum crypto lands in Deno, Vitest ships v5 beta](https://releases.sh/collections/js-toolchain/digest/2026-06-01)** — week of 2026-06-01 (8 releases)
  > Deno 2.8.2 adds post-quantum cryptography and a `--minify` flag for compiled binaries, while Vitest released its v5 beta with breaking changes and backported security controls for the browser test runner.
- **[pnpm closes supply-chain holes while Turborepo fixes its stability floor](https://releases.sh/collections/js-toolchain/digest/2026-05-25)** — week of 2026-05-25 (8 releases)
  > pnpm 11.4 and 11.5 shipped security hardening around lockfiles, credentials, and patch files, while Turborepo landed a series of fixes for process hangs, symlink races, and Bun compatibility across four canary and stable releases.
- **[Deno 2.8 rewires the CLI, pnpm experiments with Rust](https://releases.sh/collections/js-toolchain/digest/2026-05-18)** — week of 2026-05-18 (11 releases)
  > Deno shipped its biggest release of the year with workspace support, six new subcommands, and a new agent security firewall, while pnpm opened the door to a Rust-powered install backend and Turbo kept hardening.
- **[Turborepo's triple security fix overshadows a quiet week](https://releases.sh/collections/js-toolchain/digest/2026-05-11)** — week of 2026-05-11 (8 releases)
  > Turborepo patched a high-severity command injection vulnerability in its VS Code extension alongside fixes for CSRF and unintended code execution, while Bun shipped v1.3.14 and Vitest released a minor bug-fix update.

## Fetching more

Append `.md` (markdown), `.json` (raw data), or `.atom` (feed) to any URL on this page.

- Digest Atom feed: `https://releases.sh/collections/js-toolchain/digest.atom`