Package managers converge on lockfile fixes and test runners harden browser defaults

pnpm rethinks registry configuration and lockfile updates

The biggest story this week is pnpm's triple release — 11.21 and 11.22 plus 11.23 — which together tackle two long-standing pain points: registry definitions and lockfile churn. For teams using private registries like Artifactory or GitLab, the new registries setting finally lets you describe each registry once — its tarball layout, the scopes routed to it, the prefix it answers to — so those details no longer leak into pnpm-lock.yaml. That's a quiet but meaningful cleanup for monorepos with mixed public/private dependencies.

On the install side, 11.21 and 11.22 change how pnpm install updates the lockfile: instead of re-resolving the entire dependency graph for everyday changes (like adding or removing a single package), it now updates the lockfile in place where possible. This cuts both install time and diff noise in PRs. The same release also stops recording SSH URLs that could break installs on CI, makes global installs switch atomically, and lets global interactive updates select whole dependency groups. There's a stricter note too — projects can no longer relocate pnpm's machine-level state via pnpm-workspace.yaml, which closes a footgun. The 11.23 follow-up adds virtualStoreType, makes undeclared imports resolve correctly under ESM when using the global virtual store (no plugin needed), and teaches pnpm config get to report what pnpm actually acts on rather than what's merely set.

Bun and Turborepo polish install and cache behavior

Bun's v1.4 lands with a focus on install correctness and runtime stability, though the release notes don't enumerate specific changes beyond the usual install fixes and compatibility improvements. For teams already on Bun as their package manager or runtime, this is a "update when you can" release — the kind that keeps the toolchain boring and reliable.

Over in the build-tooling corner, Turborepo's v2.10.11 adds native caching for uv tool tasks — a nice win for Python-heavy repos that use uv for dependency management — and fixes a subtle gitignore bug where rules weren't respected when git metadata was missing. That last one matters for CI environments that do shallow clones or checkout without full history. The release also fixes repeated strict entrypoint traversal (less redundant work in large graphs), concurrent generator config isolation, and transient input file handling.

Vitest tightens browser defaults and CI reporting

Vitest ships two releases this week: v4.1.11, a maintenance backport, and v5.0.0-rc.2, a release candidate with a few notable behavior changes. The v5 RC makes browser tests fail instead of hanging when the browser stops responding — a long-overdue default that will surface flaky tests instead of stalling CI. It also adds a custom title for the GitHub Actions summary report and includes test names in that summary, which makes triage from the Actions UI much faster. Security gets a bump too: coverage report requests now require authentication.

The v4.1.11 backport revives the global concurrency limit for test lifecycle hooks — a fix that was apparently lost in a previous release — and encodes iframeId in tester iframe URLs to avoid collisions in browser-mode runs. It also triggers garbage collection in playwright/chromium when disk space runs low and restricts redirect mocks to the filesystem allowlist. If you're on v4 and hitting browser-mode flakiness, this one's worth grabbing.