---
collection: js-toolchain
collection_name: JavaScript Runtimes & Tooling
week_start: 2026-07-13
title: pnpm adds workspace release management while Turborepo embeds sccache for Cargo
release_count: 7
generated: 2026-07-20
canonical: https://releases.sh/collections/js-toolchain/digest/2026-07-13
---

# pnpm adds workspace release management while Turborepo embeds sccache for Cargo

pnpm 11.11-11.14 introduced native workspace release management with `pnpm change`, `pnpm lane`, and `pnpm version -r`, alongside a new `pnpm doctor` command and significant memory improvements. Meanwhile, Turborepo shipped a canary cycle culminating in embedded sccache support for Cargo compile caching, Cargo-only repo support, and security fixes.

### pnpm rewrites workspace release workflows

The biggest story this week is [pnpm's 11.11 through 11.14](/release/rel_wc5MI044rLDNKoulEML7q-pnpm-11-11-11-14) releases, which fundamentally change how monorepo maintainers handle version bumps. The new `pnpm change` and `pnpm lane` commands give teams a structured workflow for proposing and tracking changes across packages, while `pnpm version -r` replaces the manual chore of bumping each package version. These aren't just convenience features — they bring pnpm's release management model closer to tools like Changesets and Beachball, but integrated directly into the package manager itself.

The releases also ship `pnpm doctor`, a diagnostic command that runs end-to-end checks on your installation, and the long-awaited `pnpm access` and `pnpm team` commands for managing registry permissions without leaving your terminal. For performance, pnpm cut peak memory during cold-cache resolution by roughly 30%, and fixed a path-traversal vulnerability that warranted attention. Scheme-carrying `peerDependencies` specifiers and convergence overrides round out the release, making this one of the most impactful pnpm updates in months.

### Turborepo's canary cycle: sccache, Cargo repos, and security

Across the Turborepo team, the week was defined by a rapid-fire canary cycle that landed three significant milestones. The [2.10.5 stable release](/release/rel_J4GL3aVoAKbypBl-m7tkn-turborepo-v2-10-5-embeds-sccache-for-cargo-compile-caching-and-fixes-output-path) embedded sccache directly into Turborepo, meaning Cargo compile caching now works through Remote Cache with zero installation. The same release also rejects output path traversal and surfaces toolchain tasks in the TUI.

The canary train then accelerated: [2.10.6-canary.1](/release/rel_0hSG8zzhlCTjrJY0pxE_L-turborepo-v2-10-6-canary-1-fixes-cargo-caching-and-yarn-pruning) fixed Cargo artifact caching and Yarn pruning edge cases, while [2.10.6-canary.2](/release/rel_mUF2whhi2fFknRWi8qKm7-turborepo-v2-10-6-canary-2-adds-cargo-only-repo-support-and-infers-cargo) added support for Cargo-only repositories and automatic inference of Cargo workspace tasks — a meaningful step for teams using Rust alongside JavaScript tooling. The [2.10.6-canary.3](/release/rel_H1DW-GlJ0yQtLaf1tdIZ5-turborepo-v2-10-6-canary-3-resolves-security-vulnerabilities) patch resolved weekly security audit vulnerabilities and updated to Rust 1.97.0, while [2.10.6-canary.4](/release/rel_rWjrOUHbdI2ajO7_S6yWY-turborepo-v2-10-6-canary-4-internal-release) added an experimental Rust guide and folded docs checks into the CI quality pipeline.

### Deno ships a modest but targeted patch

[Deno 2.9.3](/release/rel_vz1OHhtLM0pLRfkv99YXC-deno-v2-9-3-adds-deno-add-no-save-and-fixes-sqlite-napi-http2) arrived with a focused set of improvements. The `deno add` command now supports `--no-save` and `--save-optional` flags, giving developers more control over dependency tracking. On the compile front, support for `aarch64-pc-windows-msvc` targets opens the door for ARM64 Windows builds. The release also addresses several correctness issues: a sqlite deserialization guard, napi threadsafe function lifecycle fixes, `node_http2` header validation, and a critical data-loss fix for active stream reads on Node.js compatibility. For HTTP/2 power users, the new `http2MaxHeaderListSize` option on `Deno.createHttpClient` provides finer-grained control over server limits.

## Releases covered

### Deno

- [Deno v2.9.3 adds deno add --no-save and fixes sqlite, napi, http2](https://releases.sh/release/rel_vz1OHhtLM0pLRfkv99YXC-deno-add-no-save-sqlite-and-napi-threading-fixes)

### pnpm

- [pnpm 11.11-11.14](https://releases.sh/release/rel_wc5MI044rLDNKoulEML7q-pnpm-11-11-11-14)

### Vercel

- [Turborepo v2.10.5 embeds sccache for Cargo compile caching and fixes output path traversal](https://releases.sh/release/rel_J4GL3aVoAKbypBl-m7tkn-embedded-sccache-for-cargo-path-traversal-rejected)
- [Turborepo v2.10.6-canary.1 fixes Cargo caching and Yarn pruning](https://releases.sh/release/rel_0hSG8zzhlCTjrJY0pxE_L-unresolved-cargo-artifact-caching-disabled-yarn-ranges-preserved)
- [Turborepo v2.10.6-canary.2 adds Cargo-only repo support and infers Cargo workspace tasks](https://releases.sh/release/rel_mUF2whhi2fFknRWi8qKm7-cargo-only-repos-supported-workspace-tasks-inferred)
- [Turborepo v2.10.6-canary.3 resolves security vulnerabilities](https://releases.sh/release/rel_H1DW-GlJ0yQtLaf1tdIZ5-security-audit-vulnerabilities-resolved)
- [Turborepo v2.10.6-canary.4 internal release](https://releases.sh/release/rel_rWjrOUHbdI2ajO7_S6yWY-turborepo-v2-10-6-canary-4-internal-release)