{"collection":{"slug":"js-toolchain","name":"JavaScript Runtimes & Tooling"},"digest":{"id":"cwd_grRBcS_AUNj0xt4ziNbgT","weekStart":"2026-06-01","title":"Post-quantum crypto lands in Deno, Vitest ships v5 beta","intro":"Deno 2.8.2 adds post-quantum cryptography and a `--minify` flag for compiled binaries, while Vitest released its v5 beta with breaking changes and backported security controls for the browser test runner.","body":"### Deno goes post-quantum\n\n[Deno 2.8.2](/release/rel_-mlmnjNJ9tYFPS0Fn3K25-deno-v2-8-2-adds-post-quantum-cryptography-and-improves-compile-bundling) is the week's standout release, bringing ML-DSA (FIPS 204) digital signatures and ML-KEM (FIPS 203) key encapsulation to the Web Crypto API — both NIST-standardized post-quantum algorithms designed to withstand attacks from future quantum computers. The same release adds ChaCha20-Poly1305, SHAKE (including cSHAKE and TurboSHAKE), and SHA-3 HMAC support, rounding out what is now one of the most comprehensive crypto APIs available in any runtime.\n\nOn the tooling side, the `deno compile` subcommand gains a `--minify` flag and improved `--bundle` dependency resolution that scopes npm embeddings to only the packages actually reached by the bundle, reducing binary size. Dozens of bug fixes across Node.js compatibility, the LSP, and file I/O round out the release.\n\n### Vitest: stable patches and a v5 peek\n\nVitest shipped across four versions this week. [v3.2.5](/release/rel_UxDUBkNLvFMY1tHCXTfsE-v3-2-5) and [v3.2.6](/release/rel_caW8QnUrGixS-a2qRxpqx-v3-2-6) are maintenance patches — the former backports `allowWrite` and `allowExec` API options for the browser test runner, and the latter pins a needed vite-node version. [v4.1.8](/release/rel_hRBPCERlURI3JnPhP12v4-v4-1-8) backports the same `allowWrite`/`allowExec` controls plus a fix for orphaned Playwright routes when a module is mocked through multiple IDs. Together these give teams tighter security boundaries: the browser runner's CDP API can now be locked down when write or exec permissions are denied, preventing accidental file system or process access during tests.\n\nMore notably, [v5.0.0-beta.4](/release/rel__frxtz7CYCQT1n_FNwsa5-v5-0-0-beta-4) landed as a breaking change preview. It throws an error when hoistable methods appear outside the top-level scope (catching a class of subtle bugs) and makes `toHaveTextContent` strict — replacing the old behavior with a new `toMatchTextContent` matcher for substring matching. Teams evaluating the v5 migration should test their assertion suites against this beta.\n\n### Turborepo refines monorepo fidelity\n\nVercel's Turborepo posted three canary releases this week, each tightening dependency resolution. [v2.9.17-canary.3](/release/rel_sVYx7wQ-pP3sVnw7TMtit-turborepo-v2-9-17-canary-3-preserves-bun-nested-dependency-versions) stopped Bun nested dependency versions from being dropped during lockfile processing. [v2.9.17-canary.4](/release/rel_v2vu976I4i8d_lyk-VZDv-turborepo-v2-9-17-canary-4-ignores-peer-dependencies-in-package-graph) began ignoring peer dependencies in the package graph entirely — a behavioral change that can significantly reduce the number of edges Turborepo considers when determining task ordering. [v2.9.17-canary.5](/release/rel_M9cMiiQiBmw397lJ7tAmt-turborepo-v2-9-17-canary-5-fixes-pnpm-override-prune-and-pty-stdin-handling) fixed pnpm override-resolved depenencies being lost during `prune`, kept PTY stdin open for tasks, and added P-521 ECDSA certificate chain support over rustls. Combined, these canaries move toward more accurate dependency tracking, especially in mixed-lockfile monorepos.","releaseIds":["rel_-mlmnjNJ9tYFPS0Fn3K25","rel_UxDUBkNLvFMY1tHCXTfsE","rel_caW8QnUrGixS-a2qRxpqx","rel_hRBPCERlURI3JnPhP12v4","rel__frxtz7CYCQT1n_FNwsa5","rel_sVYx7wQ-pP3sVnw7TMtit","rel_v2vu976I4i8d_lyk-VZDv","rel_M9cMiiQiBmw397lJ7tAmt"],"releaseCount":8,"generatedAt":"2026-07-11T16:51:39.762Z","releases":[{"id":"rel_-mlmnjNJ9tYFPS0Fn3K25","title":"Deno v2.8.2 adds post-quantum cryptography and improves compile bundling","path":"/release/rel_-mlmnjNJ9tYFPS0Fn3K25-ml-dsa-and-ml-kem-post-quantum-signatures-compile-bundle-hardened","org":{"slug":"deno","name":"Deno"},"importance":null},{"id":"rel_UxDUBkNLvFMY1tHCXTfsE","title":"v3.2.5","path":"/release/rel_UxDUBkNLvFMY1tHCXTfsE-v3-2-5","org":{"slug":"vitest","name":"Vitest"},"importance":null},{"id":"rel_caW8QnUrGixS-a2qRxpqx","title":"v3.2.6","path":"/release/rel_caW8QnUrGixS-a2qRxpqx-v3-2-6","org":{"slug":"vitest","name":"Vitest"},"importance":null},{"id":"rel_hRBPCERlURI3JnPhP12v4","title":"v4.1.8","path":"/release/rel_hRBPCERlURI3JnPhP12v4-v4-1-8","org":{"slug":"vitest","name":"Vitest"},"importance":null},{"id":"rel__frxtz7CYCQT1n_FNwsa5","title":"v5.0.0-beta.4","path":"/release/rel__frxtz7CYCQT1n_FNwsa5-v5-0-0-beta-4","org":{"slug":"vitest","name":"Vitest"},"importance":null},{"id":"rel_sVYx7wQ-pP3sVnw7TMtit","title":"Turborepo v2.9.17-canary.3 preserves Bun nested dependency versions","path":"/release/rel_sVYx7wQ-pP3sVnw7TMtit-bun-nested-dependency-versions-now-preserved","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_v2vu976I4i8d_lyk-VZDv","title":"Turborepo v2.9.17-canary.4 ignores peer dependencies in package graph","path":"/release/rel_v2vu976I4i8d_lyk-VZDv-peer-dependencies-ignored-in-package-graph","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_M9cMiiQiBmw397lJ7tAmt","title":"Turborepo v2.9.17-canary.5 fixes pnpm override prune and PTY stdin handling","path":"/release/rel_M9cMiiQiBmw397lJ7tAmt-pnpm-override-prune-preserved-pty-stdin-stays-open","org":{"slug":"vercel","name":"Vercel"},"importance":null}]}}