{"collection":{"slug":"js-toolchain","name":"JavaScript Runtimes & Tooling"},"digest":{"id":"cwd_l6UYxh_BTQQE7LR-pwgxg","weekStart":"2026-06-08","title":"pnpm locks down credential exposure as Turborepo chases Windows PTY parity","intro":"pnpm shipped a security fix stopping repository-controlled `.npmrc` files from expanding environment variables, alongside new releases adding frozen store support and file-free registry auth. Turborepo pushed seven canary releases and two stable patches focused on Windows PTY handling and JIT task input hashing.","body":"### Security hardening across the package managers\n\nThe week's most consequential release came from **pnpm**, which [stopped expanding environment variables in repository-controlled `.npmrc` and `pnpm-workspace.yaml` files](/release/rel_4DXxB5YU98GhrzxBz7pOz-why-pnpm-no-longer-expands-environment-variables-in-a-repository-s-npmrc). Previously, a cloned repo could use `${ENV_VAR}` placeholders in its config to exfiltrate secrets from your shell environment. The fix shipped silently in v10.34.2 and v11.5.3 — check your version if you haven't updated this month.\n\n### pnpm 11.6 and 11.7: auth without files, installs without writes\n\n[pnpm 11.6](/release/rel_1Sv8i__nGjbUFzfbqLaRl-pnpm-11-6) introduced a file-free path to registry authentication: you can now supply credentials entirely through `npm_config_//…` and `pnpm_config_//…` environment variables, avoiding the need to touch `.npmrc` at all. It also raised the default network concurrency and skips full lockfile re-resolution when only the file itself is missing — a small but welcome speed-up for fresh clones.\n\n[pnpm 11.7](/release/rel_BnVDo8ysHmnZXEvLhvjoZ-pnpm-11-7) followed with the `frozenStore` setting, letting you point installs at a read-only package store (useful in CI or container builds), and a `--batch` flag that publishes an entire workspace in a single registry request. Scope-specific auth tokens and a move toward full resolving installs delegated to pacquet round out the release.\n\n### Turborepo's Windows marathon\n\nTurborepo saw a remarkable cadence: six canary releases plus two stable patches in one week, almost entirely focused on Windows PTY (pseudo-terminal) behavior. The story starts with [v2.9.17](/release/rel_WhiGQdOgfWqMTdaZ47xRT-turborepo-v2-9-17-fixes-stdin-handling-for-persistent-tasks-and-adds-jit-task), which fixed stdin handling for persistent tasks on Windows and introduced JIT task input hashing — a feature that defers cache-key computation until a task is about to run, reducing overhead in large graphs. [v2.9.17-canary.1](/release/rel_0jPG-oCjBwZ05uLh8X03h-turborepo-v2-9-19-canary-1-fixes-ctrl-c-not-sending-to-windows-pty-tasks) then started sending Ctrl-C properly to Windows PTY tasks, and [canary.2](/release/rel_DN3OtxY6cwdQCsIrdoiLv-turborepo-v2-9-19-canary-2-stops-shim-killing-local-turbo-on-windows) stopped the shim process from killing the local turbo process on Ctrl+C. By [canary.3](/release/rel_J8097uFOfFXgkCgvD7EjL-turborepo-v2-9-19-canary-3-delivers-ctrl-c-to-conpty-children), Ctrl-C delivery to ConPTY children during graceful shutdown was solid. [canary.4](/release/rel_vJlYem6yLMz1JTg2O8k8W-turborepo-v2-9-19-canary-4-uses-pty-for-interactive-windows-tasks) flipped the switch to use PTY for all interactive tasks on Windows, and [canary.5](/release/rel_lOlmgVfR_rD_bnjd-l3a5-turborepo-v2-9-19-canary-5-filters-pruned-pnpm-workspace-patches) filtered pruned pnpm workspace patches so patch files aren't needlessly included in pruned output. Two other canaries ([canary.6](/release/rel_YUUar7eOrDCq4vFLhjtIE-turborepo-v2-9-17-canary-6-adds-jit-task-input-hashing-and-fixes-npm-on-windows) and [canary.7](/release/rel_rPK-KjkinSAtGKEbRGX7r-turborepo-v2-9-17-canary-7-defers-hashes-for-jit-task-dependents)) iterated on the JIT hashing machinery — deferring hashes for task dependents and fixing npm shim bypass on Windows.\n\nA [stable v2.9.18](/release/rel_Scgg-Kr9CTNYYIyKcyjHG-turborepo-v2-9-18-fixes-cache-archive-symlink-restore-and-prevents-git-argument) landed mid-week with cache archive symlink restore hardening and a git argument injection fix, while the web UI mode was removed across several releases.\n\n### Elsewhere\n\n[Deno 2.8.3](/release/rel_7LB7kq-cIVG6z6BwQlsTM-deno-v2-8-3-adds-watch-mode-to-compile-and-support-for-globs-in-links) added watch mode to `deno compile`, glob support in `deno.json` links, and ML-DSA JWK import/export in `ext/crypto`. The [Vitest VS Code extension v1.50.6](/release/rel_yQxC0joV-oKtd-IqE_i2L-v1-50-6) patched compatibility with Deno 2.8 and marked certain failures as test-run errors rather than generic crashes.","releaseIds":["rel_4DXxB5YU98GhrzxBz7pOz","rel_1Sv8i__nGjbUFzfbqLaRl","rel_BnVDo8ysHmnZXEvLhvjoZ","rel_WhiGQdOgfWqMTdaZ47xRT","rel_0jPG-oCjBwZ05uLh8X03h","rel_DN3OtxY6cwdQCsIrdoiLv","rel_J8097uFOfFXgkCgvD7EjL","rel_vJlYem6yLMz1JTg2O8k8W","rel_lOlmgVfR_rD_bnjd-l3a5","rel_YUUar7eOrDCq4vFLhjtIE","rel_rPK-KjkinSAtGKEbRGX7r","rel_Scgg-Kr9CTNYYIyKcyjHG","rel_7LB7kq-cIVG6z6BwQlsTM","rel_yQxC0joV-oKtd-IqE_i2L"],"releaseCount":14,"generatedAt":"2026-07-11T16:51:24.207Z","releases":[{"id":"rel_4DXxB5YU98GhrzxBz7pOz","title":"Why pnpm no longer expands environment variables in a repository's .npmrc","path":"/release/rel_4DXxB5YU98GhrzxBz7pOz-why-pnpm-no-longer-expands-environment-variables-in-a-repository-s-npmrc","org":{"slug":"pnpm","name":"pnpm"},"importance":null},{"id":"rel_1Sv8i__nGjbUFzfbqLaRl","title":"pnpm 11.6","path":"/release/rel_1Sv8i__nGjbUFzfbqLaRl-pnpm-11-6","org":{"slug":"pnpm","name":"pnpm"},"importance":null},{"id":"rel_BnVDo8ysHmnZXEvLhvjoZ","title":"pnpm 11.7","path":"/release/rel_BnVDo8ysHmnZXEvLhvjoZ-pnpm-11-7","org":{"slug":"pnpm","name":"pnpm"},"importance":null},{"id":"rel_WhiGQdOgfWqMTdaZ47xRT","title":"Turborepo v2.9.17 fixes stdin handling for persistent tasks and adds JIT task input hashing","path":"/release/rel_WhiGQdOgfWqMTdaZ47xRT-persistent-task-stdin-fixed-jit-task-input-hashing-added","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_0jPG-oCjBwZ05uLh8X03h","title":"Turborepo v2.9.19-canary.1 fixes Ctrl+C not sending to Windows PTY tasks","path":"/release/rel_0jPG-oCjBwZ05uLh8X03h-ctrl-c-now-sends-to-windows-pty-tasks-web-ui-mode-removed","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_DN3OtxY6cwdQCsIrdoiLv","title":"Turborepo v2.9.19-canary.2 stops shim killing local turbo on Windows","path":"/release/rel_DN3OtxY6cwdQCsIrdoiLv-shim-no-longer-kills-local-turbo-on-windows-ctrl-c","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_J8097uFOfFXgkCgvD7EjL","title":"Turborepo v2.9.19-canary.3 delivers Ctrl-C to ConPTY children","path":"/release/rel_J8097uFOfFXgkCgvD7EjL-ctrl-c-now-delivered-to-conpty-children-on-windows","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_vJlYem6yLMz1JTg2O8k8W","title":"Turborepo v2.9.19-canary.4 uses PTY for interactive Windows tasks","path":"/release/rel_vJlYem6yLMz1JTg2O8k8W-windows-tasks-use-pty-interactively","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_lOlmgVfR_rD_bnjd-l3a5","title":"Turborepo v2.9.19-canary.5 filters pruned pnpm workspace patches","path":"/release/rel_lOlmgVfR_rD_bnjd-l3a5-pruned-pnpm-workspace-patches-filtered-symlink-caching-fixed","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_YUUar7eOrDCq4vFLhjtIE","title":"Turborepo v2.9.17-canary.6 adds JIT task input hashing and fixes npm on Windows","path":"/release/rel_YUUar7eOrDCq4vFLhjtIE-jit-task-input-hashing-added-npm-command-shim-bypass-on-windows","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_rPK-KjkinSAtGKEbRGX7r","title":"Turborepo v2.9.17-canary.7 defers hashes for JIT task dependents","path":"/release/rel_rPK-KjkinSAtGKEbRGX7r-jit-task-dependent-hashes-deferred","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_Scgg-Kr9CTNYYIyKcyjHG","title":"Turborepo v2.9.18 fixes cache archive symlink restore and prevents git argument injection","path":"/release/rel_Scgg-Kr9CTNYYIyKcyjHG-cache-archive-symlinks-restored-git-argument-injection-prevented","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_7LB7kq-cIVG6z6BwQlsTM","title":"Deno v2.8.3 adds watch mode to compile and support for globs in links","path":"/release/rel_7LB7kq-cIVG6z6BwQlsTM-compile-gets-watch-mode-globs-supported-in-links","org":{"slug":"deno","name":"Deno"},"importance":null},{"id":"rel_yQxC0joV-oKtd-IqE_i2L","title":"v1.50.6","path":"/release/rel_yQxC0joV-oKtd-IqE_i2L-v1-50-6","org":{"slug":"vitest","name":"Vitest"},"importance":null}]}}