pnpm 11.8 ships dry-run install while Turborepo polishes shutdown and Vitest rolls betas

Install with confidence: pnpm 11.8

The week's biggest story belongs to pnpm 11.8, which introduces pnpm install --dry-run — a preview of what would be installed without actually touching node_modules. For teams reviewing dependency trees in CI or before upgrading a lockfile, this is the safety net that's been missing. Alongside it, pnpm now generates Node.js package maps and richer SBOM output, giving supply-chain auditors more to work with. The pnpm view command now defaults to the current package, saving a keystroke when inspecting its own metadata, and pnpm run --no-bail finally returns correct exit codes. The release also bundles several determinism fixes in install and update paths, quietly making monorepo workflows more predictable.

Turborepo refines the shutdown dance

Turborepo shipped three canary releases this week, all circling the same hard problem: shutting down gracefully when PTY processes are involved. v2.9.19-canary.6 kicked things off by preserving PNPM dependency-check configuration and peer-resolved prune entries during operations, plus a speed boost to create-turbo downloads and precomputation of unblocked JIT descendants. v2.9.19-canary.7 then prevented duplicate PTY graceful shutdown signals that could terminate processes incorrectly. v2.9.19-canary.8 added true graceful stopping of nested PTY processes and restored the TUI force-shutdown behavior, while v2.9.19-canary.9 softened the force shutdown message and fixed symlink cycles being incorrectly cached. For anyone running Turborepo with large task graphs or custom scripts spawned as subprocesses, these changes mean fewer orphaned processes and less alarming error noise. The allow_no_package_manager config is now threaded to both daemon and watcher, and bun patchedDependencies survive the prune step — small touches that prevent real head-scratchers.

Vitest’s twin track: stable backports and v5 breaking changes

Vitest kept a dual rhythm this week. The v4.1.9 patch backports a fix for importOriginal when used with the optimizer and query imports, and resolves a race where browser sessions weren't waiting for orchestrator readiness — both critical for anyone running Vitest in browser mode. Meanwhile, v5.0.0-beta.5 lands two breaking changes: config files are no longer looked up from ancestor directories (tightening the resolution scope), and the @vitest/runner package is inlined into the main bundle and no longer published separately. The runner inlining simplifies dependency trees and removes an entire import path to manage, at the cost of a one-time migration for anyone explicitly importing from that package.