{"collection":{"slug":"js-toolchain","name":"JavaScript Runtimes & Tooling"},"digest":{"id":"cwd_BdCur0wZjlAwAvP4XjSOL","weekStart":"2026-05-25","title":"pnpm closes supply-chain holes while Turborepo fixes its stability floor","intro":"pnpm 11.4 and 11.5 shipped security hardening around lockfiles, credentials, and patch files, while Turborepo landed a series of fixes for process hangs, symlink races, and Bun compatibility across four canary and stable releases.","body":"### Supply-chain hardening with pnpm\n\n[Pnpm 11.4](/release/rel_26KxE7YolLI3obpQM_p3r-pnpm-11-4) closed a cluster of supply-chain attack surfaces that could let malicious registries or git references slip tampered code into a project without detection. Lockfile integrity checks are now enforced by default, tarball integrity mismatches block installs (with a scoped `--update-checksums` opt-in for legitimate retractions), and git resolutions are validated against their expected commit hashes. Credential scoping was tightened so tokens don't leak across registries, and patch files are checked before application. The change also hardened dependency alias validation and made `pnpm runtime set` write to `devEngines.runtime` by default instead of `engines.runtime`, keeping the latter reserved for explicit runtime requirements.\n\nA week later, [Pnpm 11.5](/release/rel_4y_Om89V_OgJnkB7ywZ3O-pnpm-11-5) added a more granular quality-of-life feature: the new `hoistingLimits` setting gives developers fine control over how far dependencies hoist in `nodeLinker: hoisted` installs, useful for monorepos with deeply nested dependency trees. The release also replaced the interactive prompt library to fix scrolling in long choice lists, and recognized staged publishes in pnpm's trust scale.\n\n### Turborepo's stability sprint\n\nTurborepo dominated the week's release volume with five updates between May 26 and May 30, and the theme was unmistakably stability. [Turborepo v2.9.15](/release/rel_rHW4iRNOw5F-B0ENZs6aH-turborepo-v2-9-15-fixes-cache-symlink-races-and-process-handling) landed first, fixing symlink race conditions during cache restore and archive reads, preventing Windows process drain hangs, and removing widespread `panic!` callsites that could crash the tool on unexpected states. It also fixed prune's handling of `package.json` workspaces and Bun alias child package preservation.\n\nThe [v2.9.16](/release/rel_lq-fVeJj_k7isKSiWjiST-turborepo-v2-9-16-fixes-pty-shutdown-hang-and-bun-dependency-handling) stable release doubled down on the process hang issue from the previous release, fixing a PTY shutdown hang that could leave processes stuck indefinitely. It also preserved nested Bun dependency versions correctly and ensured `--no-git` no longer accidentally deletes an existing `.git` directory. Two canary releases followed: [v2.9.16-canary.2](/release/rel__ZNccE8RM04bvrCBEJ6hN-turborepo-v2-9-16-canary-2-adds-heap-allocation-profiling-and-hardens-otel) added heap allocation profiling and hardened OpenTelemetry endpoint validation, while [v2.9.17-canary.2](/release/rel_TP1gbvqZU7fMddOmZK8iL-turborepo-v2-9-17-canary-2-adds-auth-http-timeouts-and-fixes-windows-shutdown) added HTTP timeouts for authentication requests and fixed graceful shutdown on Windows.\n\nThe [v2.9.17-canary.1](/release/rel_EK8Z3Ol7Vh3RgYGY5SKfs-turborepo-v2-9-17-canary-1-fixes-bun-dependency-versions-and-git-deletion) in between continued the Bun dependency version preservation work and fixed non-PTY stdin staying alive for persistent tasks. Taken together, this week's Turborepo output reads like a systematic audit of the tool's process lifecycle — symlinks, PTY shutdowns, Windows drains, and root task detection all got explicit attention.\n\n### Deno's Node.js compatibility patch\n\n[Deno v2.8.1](/release/rel_W6sEtSve2YzogbIN4tQFs-deno-v2-8-1-fixes-node-js-polyfill-bugs-and-network-permission-checks) wasn't a headline feature release, but it fixed several sharp edges in Node.js compatibility that matter for production workloads. `TLSSocket.authorized` now correctly returns `false` when clients present no certificate (matching Node's behavior), PKCS#12 MAC support was added to TLS SecureContext for enterprise certificate handling, and `fs.watch` now emits error events on open failures instead of silently failing. Network permission checks now apply to resolved IPs in both `fetch` and WebSocket, closing a potential bypass vector. The release also fixed a panic in `deno test --parallel` and improved error messages when importing `.node` native addons via ESM.","releaseIds":["rel_26KxE7YolLI3obpQM_p3r","rel_4y_Om89V_OgJnkB7ywZ3O","rel_rHW4iRNOw5F-B0ENZs6aH","rel_lq-fVeJj_k7isKSiWjiST","rel__ZNccE8RM04bvrCBEJ6hN","rel_TP1gbvqZU7fMddOmZK8iL","rel_EK8Z3Ol7Vh3RgYGY5SKfs","rel_W6sEtSve2YzogbIN4tQFs"],"releaseCount":8,"generatedAt":"2026-07-11T16:52:01.918Z","releases":[{"id":"rel_26KxE7YolLI3obpQM_p3r","title":"pnpm 11.4","path":"/release/rel_26KxE7YolLI3obpQM_p3r-pnpm-11-4","org":{"slug":"pnpm","name":"pnpm"},"importance":null},{"id":"rel_4y_Om89V_OgJnkB7ywZ3O","title":"pnpm 11.5","path":"/release/rel_4y_Om89V_OgJnkB7ywZ3O-pnpm-11-5","org":{"slug":"pnpm","name":"pnpm"},"importance":null},{"id":"rel_rHW4iRNOw5F-B0ENZs6aH","title":"Turborepo v2.9.15 fixes cache symlink races and process handling","path":"/release/rel_rHW4iRNOw5F-B0ENZs6aH-cache-symlink-races-fixed-process-tree-hangs-resolved","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_lq-fVeJj_k7isKSiWjiST","title":"Turborepo v2.9.16 fixes PTY shutdown hang and Bun dependency handling","path":"/release/rel_lq-fVeJj_k7isKSiWjiST-pty-shutdown-hang-fixed-bun-dependencies-now-preserved","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel__ZNccE8RM04bvrCBEJ6hN","title":"Turborepo v2.9.16-canary.2 adds heap allocation profiling and hardens OTEL validation","path":"/release/rel__ZNccE8RM04bvrCBEJ6hN-heap-allocation-profiling-added-otel-endpoint-validation-hardened","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_TP1gbvqZU7fMddOmZK8iL","title":"Turborepo v2.9.17-canary.2 adds auth HTTP timeouts and fixes Windows shutdown","path":"/release/rel_TP1gbvqZU7fMddOmZK8iL-auth-http-timeouts-added-windows-graceful-shutdown-fixed","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_EK8Z3Ol7Vh3RgYGY5SKfs","title":"Turborepo v2.9.17-canary.1 fixes Bun dependency versions and .git deletion","path":"/release/rel_EK8Z3Ol7Vh3RgYGY5SKfs-bun-nested-dependencies-preserved-git-no-longer-deleted-with-no-git","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_W6sEtSve2YzogbIN4tQFs","title":"Deno v2.8.1 fixes Node.js polyfill bugs and network permission checks","path":"/release/rel_W6sEtSve2YzogbIN4tQFs-node-js-tls-fs-fixes-network-deny-list-enforced-on-resolve","org":{"slug":"deno","name":"Deno"},"importance":null}]}}