---
collection: js-toolchain
collection_name: JavaScript Runtimes & Tooling
week_start: 2026-06-01
title: Post-quantum crypto lands in Deno, Vitest ships v5 beta
release_count: 8
generated: 2026-07-11
canonical: https://releases.sh/collections/js-toolchain/digest/2026-06-01
---

# Post-quantum crypto lands in Deno, Vitest ships v5 beta

Deno 2.8.2 adds post-quantum cryptography and a `--minify` flag for compiled binaries, while Vitest released its v5 beta with breaking changes and backported security controls for the browser test runner.

### Deno goes post-quantum

[Deno 2.8.2](/release/rel_-mlmnjNJ9tYFPS0Fn3K25-deno-v2-8-2-adds-post-quantum-cryptography-and-improves-compile-bundling) is the week's standout release, bringing ML-DSA (FIPS 204) digital signatures and ML-KEM (FIPS 203) key encapsulation to the Web Crypto API — both NIST-standardized post-quantum algorithms designed to withstand attacks from future quantum computers. The same release adds ChaCha20-Poly1305, SHAKE (including cSHAKE and TurboSHAKE), and SHA-3 HMAC support, rounding out what is now one of the most comprehensive crypto APIs available in any runtime.

On the tooling side, the `deno compile` subcommand gains a `--minify` flag and improved `--bundle` dependency resolution that scopes npm embeddings to only the packages actually reached by the bundle, reducing binary size. Dozens of bug fixes across Node.js compatibility, the LSP, and file I/O round out the release.

### Vitest: stable patches and a v5 peek

Vitest shipped across four versions this week. [v3.2.5](/release/rel_UxDUBkNLvFMY1tHCXTfsE-v3-2-5) and [v3.2.6](/release/rel_caW8QnUrGixS-a2qRxpqx-v3-2-6) are maintenance patches — the former backports `allowWrite` and `allowExec` API options for the browser test runner, and the latter pins a needed vite-node version. [v4.1.8](/release/rel_hRBPCERlURI3JnPhP12v4-v4-1-8) backports the same `allowWrite`/`allowExec` controls plus a fix for orphaned Playwright routes when a module is mocked through multiple IDs. Together these give teams tighter security boundaries: the browser runner's CDP API can now be locked down when write or exec permissions are denied, preventing accidental file system or process access during tests.

More notably, [v5.0.0-beta.4](/release/rel__frxtz7CYCQT1n_FNwsa5-v5-0-0-beta-4) landed as a breaking change preview. It throws an error when hoistable methods appear outside the top-level scope (catching a class of subtle bugs) and makes `toHaveTextContent` strict — replacing the old behavior with a new `toMatchTextContent` matcher for substring matching. Teams evaluating the v5 migration should test their assertion suites against this beta.

### Turborepo refines monorepo fidelity

Vercel's Turborepo posted three canary releases this week, each tightening dependency resolution. [v2.9.17-canary.3](/release/rel_sVYx7wQ-pP3sVnw7TMtit-turborepo-v2-9-17-canary-3-preserves-bun-nested-dependency-versions) stopped Bun nested dependency versions from being dropped during lockfile processing. [v2.9.17-canary.4](/release/rel_v2vu976I4i8d_lyk-VZDv-turborepo-v2-9-17-canary-4-ignores-peer-dependencies-in-package-graph) began ignoring peer dependencies in the package graph entirely — a behavioral change that can significantly reduce the number of edges Turborepo considers when determining task ordering. [v2.9.17-canary.5](/release/rel_M9cMiiQiBmw397lJ7tAmt-turborepo-v2-9-17-canary-5-fixes-pnpm-override-prune-and-pty-stdin-handling) fixed pnpm override-resolved depenencies being lost during `prune`, kept PTY stdin open for tasks, and added P-521 ECDSA certificate chain support over rustls. Combined, these canaries move toward more accurate dependency tracking, especially in mixed-lockfile monorepos.

## Releases covered

### Deno

- [Deno v2.8.2 adds post-quantum cryptography and improves compile bundling](https://releases.sh/release/rel_-mlmnjNJ9tYFPS0Fn3K25-ml-dsa-and-ml-kem-post-quantum-signatures-compile-bundle-hardened)

### Vercel

- [Turborepo v2.9.17-canary.3 preserves Bun nested dependency versions](https://releases.sh/release/rel_sVYx7wQ-pP3sVnw7TMtit-bun-nested-dependency-versions-now-preserved)
- [Turborepo v2.9.17-canary.4 ignores peer dependencies in package graph](https://releases.sh/release/rel_v2vu976I4i8d_lyk-VZDv-peer-dependencies-ignored-in-package-graph)
- [Turborepo v2.9.17-canary.5 fixes pnpm override prune and PTY stdin handling](https://releases.sh/release/rel_M9cMiiQiBmw397lJ7tAmt-pnpm-override-prune-preserved-pty-stdin-stays-open)

### Vitest

- [v3.2.5](https://releases.sh/release/rel_UxDUBkNLvFMY1tHCXTfsE-v3-2-5)
- [v3.2.6](https://releases.sh/release/rel_caW8QnUrGixS-a2qRxpqx-v3-2-6)
- [v4.1.8](https://releases.sh/release/rel_hRBPCERlURI3JnPhP12v4-v4-1-8)
- [v5.0.0-beta.4](https://releases.sh/release/rel__frxtz7CYCQT1n_FNwsa5-v5-0-0-beta-4)