--- collection: js-toolchain collection_name: JavaScript Runtimes & Tooling week_start: 2026-06-08 title: pnpm locks down credential exposure as Turborepo chases Windows PTY parity release_count: 14 generated: 2026-07-11 canonical: https://releases.sh/collections/js-toolchain/digest/2026-06-08 --- # pnpm locks down credential exposure as Turborepo chases Windows PTY parity pnpm shipped a security fix stopping repository-controlled `.npmrc` files from expanding environment variables, alongside new releases adding frozen store support and file-free registry auth. Turborepo pushed seven canary releases and two stable patches focused on Windows PTY handling and JIT task input hashing. ### Security hardening across the package managers The week's most consequential release came from **pnpm**, which [stopped expanding environment variables in repository-controlled `.npmrc` and `pnpm-workspace.yaml` files](/release/rel_4DXxB5YU98GhrzxBz7pOz-why-pnpm-no-longer-expands-environment-variables-in-a-repository-s-npmrc). Previously, a cloned repo could use `${ENV_VAR}` placeholders in its config to exfiltrate secrets from your shell environment. The fix shipped silently in v10.34.2 and v11.5.3 — check your version if you haven't updated this month. ### pnpm 11.6 and 11.7: auth without files, installs without writes [pnpm 11.6](/release/rel_1Sv8i__nGjbUFzfbqLaRl-pnpm-11-6) introduced a file-free path to registry authentication: you can now supply credentials entirely through `npm_config_//…` and `pnpm_config_//…` environment variables, avoiding the need to touch `.npmrc` at all. It also raised the default network concurrency and skips full lockfile re-resolution when only the file itself is missing — a small but welcome speed-up for fresh clones. [pnpm 11.7](/release/rel_BnVDo8ysHmnZXEvLhvjoZ-pnpm-11-7) followed with the `frozenStore` setting, letting you point installs at a read-only package store (useful in CI or container builds), and a `--batch` flag that publishes an entire workspace in a single registry request. Scope-specific auth tokens and a move toward full resolving installs delegated to pacquet round out the release. ### Turborepo's Windows marathon Turborepo saw a remarkable cadence: six canary releases plus two stable patches in one week, almost entirely focused on Windows PTY (pseudo-terminal) behavior. The story starts with [v2.9.17](/release/rel_WhiGQdOgfWqMTdaZ47xRT-turborepo-v2-9-17-fixes-stdin-handling-for-persistent-tasks-and-adds-jit-task), which fixed stdin handling for persistent tasks on Windows and introduced JIT task input hashing — a feature that defers cache-key computation until a task is about to run, reducing overhead in large graphs. [v2.9.17-canary.1](/release/rel_0jPG-oCjBwZ05uLh8X03h-turborepo-v2-9-19-canary-1-fixes-ctrl-c-not-sending-to-windows-pty-tasks) then started sending Ctrl-C properly to Windows PTY tasks, and [canary.2](/release/rel_DN3OtxY6cwdQCsIrdoiLv-turborepo-v2-9-19-canary-2-stops-shim-killing-local-turbo-on-windows) stopped the shim process from killing the local turbo process on Ctrl+C. By [canary.3](/release/rel_J8097uFOfFXgkCgvD7EjL-turborepo-v2-9-19-canary-3-delivers-ctrl-c-to-conpty-children), Ctrl-C delivery to ConPTY children during graceful shutdown was solid. [canary.4](/release/rel_vJlYem6yLMz1JTg2O8k8W-turborepo-v2-9-19-canary-4-uses-pty-for-interactive-windows-tasks) flipped the switch to use PTY for all interactive tasks on Windows, and [canary.5](/release/rel_lOlmgVfR_rD_bnjd-l3a5-turborepo-v2-9-19-canary-5-filters-pruned-pnpm-workspace-patches) filtered pruned pnpm workspace patches so patch files aren't needlessly included in pruned output. Two other canaries ([canary.6](/release/rel_YUUar7eOrDCq4vFLhjtIE-turborepo-v2-9-17-canary-6-adds-jit-task-input-hashing-and-fixes-npm-on-windows) and [canary.7](/release/rel_rPK-KjkinSAtGKEbRGX7r-turborepo-v2-9-17-canary-7-defers-hashes-for-jit-task-dependents)) iterated on the JIT hashing machinery — deferring hashes for task dependents and fixing npm shim bypass on Windows. A [stable v2.9.18](/release/rel_Scgg-Kr9CTNYYIyKcyjHG-turborepo-v2-9-18-fixes-cache-archive-symlink-restore-and-prevents-git-argument) landed mid-week with cache archive symlink restore hardening and a git argument injection fix, while the web UI mode was removed across several releases. ### Elsewhere [Deno 2.8.3](/release/rel_7LB7kq-cIVG6z6BwQlsTM-deno-v2-8-3-adds-watch-mode-to-compile-and-support-for-globs-in-links) added watch mode to `deno compile`, glob support in `deno.json` links, and ML-DSA JWK import/export in `ext/crypto`. The [Vitest VS Code extension v1.50.6](/release/rel_yQxC0joV-oKtd-IqE_i2L-v1-50-6) patched compatibility with Deno 2.8 and marked certain failures as test-run errors rather than generic crashes. ## Releases covered ### Deno - [Deno v2.8.3 adds watch mode to compile and support for globs in links](https://releases.sh/release/rel_7LB7kq-cIVG6z6BwQlsTM-compile-gets-watch-mode-globs-supported-in-links) ### pnpm - [Why pnpm no longer expands environment variables in a repository's .npmrc](https://releases.sh/release/rel_4DXxB5YU98GhrzxBz7pOz-why-pnpm-no-longer-expands-environment-variables-in-a-repository-s-npmrc) - [pnpm 11.6](https://releases.sh/release/rel_1Sv8i__nGjbUFzfbqLaRl-pnpm-11-6) - [pnpm 11.7](https://releases.sh/release/rel_BnVDo8ysHmnZXEvLhvjoZ-pnpm-11-7) ### Vercel - [Turborepo v2.9.17 fixes stdin handling for persistent tasks and adds JIT task input hashing](https://releases.sh/release/rel_WhiGQdOgfWqMTdaZ47xRT-persistent-task-stdin-fixed-jit-task-input-hashing-added) - [Turborepo v2.9.19-canary.1 fixes Ctrl+C not sending to Windows PTY tasks](https://releases.sh/release/rel_0jPG-oCjBwZ05uLh8X03h-ctrl-c-now-sends-to-windows-pty-tasks-web-ui-mode-removed) - [Turborepo v2.9.19-canary.2 stops shim killing local turbo on Windows](https://releases.sh/release/rel_DN3OtxY6cwdQCsIrdoiLv-shim-no-longer-kills-local-turbo-on-windows-ctrl-c) - [Turborepo v2.9.19-canary.3 delivers Ctrl-C to ConPTY children](https://releases.sh/release/rel_J8097uFOfFXgkCgvD7EjL-ctrl-c-now-delivered-to-conpty-children-on-windows) - [Turborepo v2.9.19-canary.4 uses PTY for interactive Windows tasks](https://releases.sh/release/rel_vJlYem6yLMz1JTg2O8k8W-windows-tasks-use-pty-interactively) - [Turborepo v2.9.19-canary.5 filters pruned pnpm workspace patches](https://releases.sh/release/rel_lOlmgVfR_rD_bnjd-l3a5-pruned-pnpm-workspace-patches-filtered-symlink-caching-fixed) - [Turborepo v2.9.17-canary.6 adds JIT task input hashing and fixes npm on Windows](https://releases.sh/release/rel_YUUar7eOrDCq4vFLhjtIE-jit-task-input-hashing-added-npm-command-shim-bypass-on-windows) - [Turborepo v2.9.17-canary.7 defers hashes for JIT task dependents](https://releases.sh/release/rel_rPK-KjkinSAtGKEbRGX7r-jit-task-dependent-hashes-deferred) - [Turborepo v2.9.18 fixes cache archive symlink restore and prevents git argument injection](https://releases.sh/release/rel_Scgg-Kr9CTNYYIyKcyjHG-cache-archive-symlinks-restored-git-argument-injection-prevented) ### Vitest - [v1.50.6](https://releases.sh/release/rel_yQxC0joV-oKtd-IqE_i2L-v1-50-6)