{"collection":{"slug":"js-toolchain","name":"JavaScript Runtimes & Tooling"},"digest":{"id":"cwd_erBFxXpb4eXMnh99JefDk","weekStart":"2026-09-14","title":"Turborepo 2.11 lands with a Python push across the JS toolchain","intro":"Turborepo shipped its 2.11 release, anchored by a wave of monorepo work spanning Remix and Nuxt inference, static repository discovery, and uv/Python workspace support, while pnpm 12.5 brought editable Python project packages and machine-wide concurrency groups.","body":"### Turborepo 2.11 and the monorepo introspection buildout\n\nThe week's headline is [Turborepo 2.11](/release/rel_xtsait5P9kIHdinQFBDNo-turborepo-v2-11-0), the first stable cut of a release cycle whose canaries had been landing daily. The theme across the whole run is introspection: Turborepo is getting much better at understanding what kind of repository it's sitting in, and which packages actually changed.\n\nThat started the week with [Remix framework inference and compact task planning through turbo query](/release/rel_kXT1Pb2TLZbFoWgcYHtTI-turborepo-v2-10-14-canary-1-adds-remix-inference-and-turbo-query-task-planning), which also added a `NUXT_ENV_*` wildcard and `NEXT_DEPLOYMENT_ID` to Next.js inference — small additions that matter for anyone whose affected-package calculations were previously blind to those signals. [Static repository discovery with safe affected candidates](/release/rel_ND97x5q2fJj_vqWt7cy0a-turborepo-v2-10-14-canary-4-adds-static-repository-discovery-and-go-workspace) followed the next day, deriving short names for Go workspace packages and preserving task env mode when pruning.\n\nThe infrastructure kept tightening: [co-located package discovery](/release/rel_CsCPij-AET6n0eCZZEFtW-turborepo-v2-10-14-canary-2-fixes-co-located-package-discovery-and-task-log) now infers packages from the working directory and keeps task logs isolated per package, [package queries and pruning became task-aware](/release/rel_lbI0P1N9Zx02sBNIoL6iw-turborepo-v2-10-14-canary-3-makes-package-queries-and-pruning-task-aware), and [Cargo and uv affectedness can now be inferred from static package inputs](/release/rel_d91vjA_W61ar7Gt5sLSL8-turborepo-v2-10-14-canary-5-infers-cargo-and-uv-affectedness-from-static-package) — with hardened cache archive restoration on the side. Earlier in the cycle, [Python virtual environment and uv workspace support](/release/rel_Lv1k8gubV9KY4dTSJFwrf-turborepo-v2-10-13-adds-python-virtual-environment-and-uv-workspace-support) landed alongside bounded memory for streamed task output and a tar bump fixing CVE-2026-73566 in the releaser.\n\nThe stable release came with [esbuild builds allowed for pnpm generators](/release/rel_IN_EmNBS0htGGNSbEDFCN-turborepo-v2-11-1-allows-esbuild-builds-for-pnpm-generators), which also carried the 2.11 blog post. Then the patch train started immediately: [repeatable CLI flags were restored](/release/rel_6eNJ5PnMqHlHiFqRxRdR_-turborepo-v2-11-2-restores-repeatable-cli-flags) after regressing, and both the [canary with the same flag fix plus pnpm esbuild work](/release/rel_W2IgBvG1KYp71bq-Nd5ex-turborepo-v2-11-3-canary-1-restores-repeatable-cli-flags) and the [canary that silences spurious microfrontend polyrepo warnings](/release/rel_iwJqYQh6xYKKtE8ivfZQ_-turborepo-v2-11-3-canary-2-fixes-microfrontend-polyrepo-warnings) followed, the latter refactoring the run and execution selector DTOs.\n\n### pnpm 12.5 leans into Python too\n\nNot to be outdone, [pnpm 12.5](/release/rel_7VyW_OfbR6Be2994i_Ogq-pnpm-12-5) expanded its Python story considerably: editable project packages, shared workspace environments, automatic interpreter downloads, and lockfiles that span multiple platforms and Python versions. It also accepts Package URLs in `pnpm add`, adds machine-wide task concurrency groups, and introduces `pnpm cache prune` for clearing obsolete registry metadata. Read together with Turborepo's uv work, the JS package managers are clearly staking a claim on polyglot monorepos.\n\n### Security and compat patches\n\n[Deno 2.9.7](/release/rel_5xjuuTfw1qsWa7JRBw7fy-deno-v2-9-7-patches-permission-lockfile-validation-and-node-compat-bugs) was the week's most security-tilted release: it clears supplementary groups before changing process identity, refuses symlink SQLite database paths, checks permissions for multicast membership, and validates lockfile tarball origins. Node compatibility fixes cover repeated child process signals, AsyncLocalStorage exit context, and `node:dns` error codes.\n\nOn the testing side, [Vitest 5.0.1](/release/rel_i7jkJlbmo2_RvsjFjOj1f-vitest-v5-0-1-fixes-list-collection-exit-code-and-cache-metadata-loss) fixed `vitest list` exiting 0 when collection failed — a quiet but real CI correctness bug — preserved parse error details in static collection, and fixed `deepMerge` prototype handling, with a focused trace view layout mode added to the UI.","releaseIds":["rel_xtsait5P9kIHdinQFBDNo","rel_kXT1Pb2TLZbFoWgcYHtTI","rel_ND97x5q2fJj_vqWt7cy0a","rel_CsCPij-AET6n0eCZZEFtW","rel_lbI0P1N9Zx02sBNIoL6iw","rel_d91vjA_W61ar7Gt5sLSL8","rel_Lv1k8gubV9KY4dTSJFwrf","rel_IN_EmNBS0htGGNSbEDFCN","rel_6eNJ5PnMqHlHiFqRxRdR_","rel_W2IgBvG1KYp71bq-Nd5ex","rel_iwJqYQh6xYKKtE8ivfZQ_","rel_7VyW_OfbR6Be2994i_Ogq","rel_5xjuuTfw1qsWa7JRBw7fy","rel_i7jkJlbmo2_RvsjFjOj1f"],"releaseCount":14,"generatedAt":"2026-09-21T06:17:59.128Z","releases":[{"id":"rel_xtsait5P9kIHdinQFBDNo","title":"Turborepo v2.11.0","path":"/release/rel_xtsait5P9kIHdinQFBDNo-turborepo-v2-11-0","org":{"slug":"vercel","name":"Vercel"},"importance":null},{"id":"rel_kXT1Pb2TLZbFoWgcYHtTI","title":"Turborepo v2.10.14-canary.1 adds Remix inference and turbo query task planning","path":"/release/rel_kXT1Pb2TLZbFoWgcYHtTI-remix-inference-compact-task-planning-in-turbo-query","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_ND97x5q2fJj_vqWt7cy0a","title":"Turborepo v2.10.14-canary.4 adds static repository discovery and Go workspace short names","path":"/release/rel_ND97x5q2fJj_vqWt7cy0a-static-repo-discovery-go-workspace-package-short-names","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_CsCPij-AET6n0eCZZEFtW","title":"Turborepo v2.10.14-canary.2 fixes co-located package discovery and task log isolation","path":"/release/rel_CsCPij-AET6n0eCZZEFtW-co-located-packages-inferred-from-cwd-task-logs-isolated","org":{"slug":"vercel","name":"Vercel"},"importance":1},{"id":"rel_lbI0P1N9Zx02sBNIoL6iw","title":"Turborepo v2.10.14-canary.3 makes package queries and pruning task-aware","path":"/release/rel_lbI0P1N9Zx02sBNIoL6iw-package-queries-and-pruning-now-task-aware","org":{"slug":"vercel","name":"Vercel"},"importance":1},{"id":"rel_d91vjA_W61ar7Gt5sLSL8","title":"Turborepo v2.10.14-canary.5 infers Cargo and uv affectedness from static package inputs","path":"/release/rel_d91vjA_W61ar7Gt5sLSL8-cargo-and-uv-affectedness-inferred-from-package-inputs","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_Lv1k8gubV9KY4dTSJFwrf","title":"Turborepo v2.10.13 adds Python virtual environment and uv workspace support","path":"/release/rel_Lv1k8gubV9KY4dTSJFwrf-python-venvs-and-uv-workspaces-supported-cve-patched","org":{"slug":"vercel","name":"Vercel"},"importance":3},{"id":"rel_IN_EmNBS0htGGNSbEDFCN","title":"Turborepo v2.11.1 allows esbuild builds for pnpm generators","path":"/release/rel_IN_EmNBS0htGGNSbEDFCN-esbuild-builds-now-work-with-pnpm-generators","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_6eNJ5PnMqHlHiFqRxRdR_","title":"Turborepo v2.11.2 restores repeatable CLI flags","path":"/release/rel_6eNJ5PnMqHlHiFqRxRdR_-repeatable-cli-flags-restored","org":{"slug":"vercel","name":"Vercel"},"importance":1},{"id":"rel_W2IgBvG1KYp71bq-Nd5ex","title":"Turborepo v2.11.3-canary.1 restores repeatable CLI flags","path":"/release/rel_W2IgBvG1KYp71bq-Nd5ex-repeatable-cli-flags-restored-pnpm-esbuild-builds-allowed","org":{"slug":"vercel","name":"Vercel"},"importance":1},{"id":"rel_iwJqYQh6xYKKtE8ivfZQ_","title":"Turborepo v2.11.3-canary.2 fixes microfrontend polyrepo warnings","path":"/release/rel_iwJqYQh6xYKKtE8ivfZQ_-microfrontend-polyrepo-warnings-no-longer-triggered","org":{"slug":"vercel","name":"Vercel"},"importance":1},{"id":"rel_7VyW_OfbR6Be2994i_Ogq","title":"pnpm 12.5","path":"/release/rel_7VyW_OfbR6Be2994i_Ogq-pnpm-12-5","org":{"slug":"pnpm","name":"pnpm"},"importance":null},{"id":"rel_5xjuuTfw1qsWa7JRBw7fy","title":"Deno v2.9.7 patches permission, lockfile validation, and Node compat bugs","path":"/release/rel_5xjuuTfw1qsWa7JRBw7fy-permission-and-lockfile-validation-hardened-node-compat-fixes","org":{"slug":"deno","name":"Deno"},"importance":2},{"id":"rel_i7jkJlbmo2_RvsjFjOj1f","title":"Vitest v5.0.1 fixes list collection exit code and cache metadata loss","path":"/release/rel_i7jkJlbmo2_RvsjFjOj1f-vitest-list-exits-1-on-collection-failure-deepmerge-prototype-fixed","org":{"slug":"vitest","name":"Vitest"},"importance":2}]}}