pnpm rewrites itself in Rust as the package manager hits stable 12

pnpm goes Rust

The biggest story of the week is pnpm's stable Rust rewrite. pnpm 12 is deliberately not a migration: the commands, flags, settings, and lockfile format of pnpm 11 all carry over, so the upgrade is meant to be invisible to existing projects. What's genuinely different is catalogued separately, and the release itself is about what pnpm 11 never shipped at all.

That foundation paid off almost immediately. pnpm also brought the new workspace task scheduler to the Rust CLI, persisted successful recursive tasks so retries only redo what actually failed, expanded shared build artifacts to macOS and Windows, and moved login credentials into structured global configuration. The scheduler work is the through-line: pnpm 11.25 had already replaced topological batches with a task scheduler, added configurable workspace task dependencies and per-task concurrency, and made interrupted recursive runs resumable from the work that passed. That same release introduced registry revisions, signed build artifacts shared through pnpr, batch approval for staged packages, and automatic pruning of stale audit exceptions.

The supporting artifact infrastructure is scaling out too. pnpr 0.1.0-alpha.9, shipped alongside 12.1, makes the artifact tier independent and horizontally scalable through S3-compatible storage — the piece that turns signed build sharing from a convenience into something teams can run at size.

Deno's desktop runtime keeps filling in

Deno's desktop clipboard API and richer menu items continue the runtime's push into native application territory: clipboard access, plus icon, tooltip, and checked state on menu entries. The release also tightens security, enforcing permissions for proxy transports in fetch, and fixes a spread of issues across HTTP, N-API, and npm — including keeping request bodies readable after a response is sent and skipping invalid DNS records in ANY queries. None of it is headline material, but the proxy permission check is the kind of gap worth closing quietly.

Build tooling gets faster and quieter

Turborepo spent the week trimming overhead. Its streamed dry-run JSON and merged glob walks cut latency by no longer buffering output and by collapsing same-prefix tree-wildcard globs into a single directory walk, with unused package configuration stats and repository indexing skipped and dozens of fixes across Factory, task caching, and affected queries. A canary followed with the same streaming and glob merging plus indexed Berry lockfile overrides, a security.txt endpoint, and the removal of incremental task caching — a preview of where the next stable lands.

Vitest, meanwhile, promoted parseSpecifications out of experimental in its v5 release candidate, switched coverage to the @vitest/istanbuljs packages, and added source-location highlighting and keyboard navigation for trace steps in the UI, alongside fixes across browser, coverage, snapshot, and worker handling. Small, but it's the release candidate, so the surface is nearly frozen.