{"collection":{"slug":"js-toolchain","name":"JavaScript Runtimes & Tooling"},"digest":{"id":"cwd_NKfGiqDcgY-sGdbosT5Dm","weekStart":"2026-09-21","title":"Turborepo patches two CVEs as pnpm lands dedupe and relocatable modules","intro":"Turborepo shipped a security release patching two vulnerabilities in js-yaml and its docs toolchain while reworking remote-cache behavior, and pnpm rolled out automatic dependency deduplication, relocatable node_modules, and repo-config-aware Node shims across three releases.","body":"### Turborepo hardens the supply chain\n\nTurborepo's week was dominated by a security patch and a run of resilience work around the remote cache. The headline fix upgraded js-yaml to [close CVE-2026-84375 and bumped Next.js in docs and factory builds for CVE-2026-94545](/release/rel_rTPg0wSVQ_9WcblUBGPSJ-turborepo-v2-11-5-patches-cve-2026-84375-and-cve-2026-94545), with the js-yaml update also landing on the canary line alongside [lockfile-hash stabilization for pnpm workspaces](/release/rel_MW_l3bX1_-AadWSlaPSud-turborepo-v2-11-5-canary-3-patches-js-yaml-cve-and-stabilizes-pnpm-lockfile). Teams auditing their build dependencies should treat this as the release to pull forward.\n\nThe remote cache got noticeably more defensive. Turborepo now [backs off artifact requests during outages](/release/rel_rTPg0wSVQ_9WcblUBGPSJ-turborepo-v2-11-5-patches-cve-2026-84375-and-cve-2026-94545), [disables the cache after unrecoverable forbidden responses and shares concurrent token recovery](/release/rel_viASy0q0ZglBk0A57rvrU-turborepo-v2-11-5-canary-1-fixes-remote-cache-forbidden-handling-and-negated) so rate limiting doesn't strand parallel tasks, and [stops tasks when the parent process exits](/release/rel_0pnOFLfbKPPtvmedXZfZo-turborepo-v2-11-4-fixes-affected-detection-for-negated-global-dependencies) instead of leaving orphans behind. Signing now covers [complete on-disk artifacts after local cache writes](/release/rel_viASy0q0ZglBk0A57rvrU-turborepo-v2-11-5-canary-1-fixes-remote-cache-forbidden-handling-and-negated), closing a gap where partial artifacts could slip through.\n\nCorrectness fixes clustered around affected detection and file handling. Negated global dependencies are now [respected in affected detection](/release/rel_0pnOFLfbKPPtvmedXZfZo-turborepo-v2-11-4-fixes-affected-detection-for-negated-global-dependencies), root internal dependency changes are [treated as global](/release/rel_vrMRars4Mu2yixwkSnb8P-turborepo-v2-11-3-canary-4-fixes-affected-detection-for-root-dependency-changes), gitignored files are [properly ignored in boundaries](/release/rel_NtN7FCXGo3qQGbL__Tg13-turborepo-v2-11-3-canary-3-fixes-boundaries-gitignore-and-prune-tag-order), and affected task input globs are [normalized rather than mangled](/release/rel_ievJi9Fd6SY_GbJJGdbhc-turborepo-v2-11-3-fixes-affected-task-globs-and-boundaries-gitignore-handling). A fix for [secondary go.work files Go reads for workspace members](/release/rel_0pnOFLfbKPPtvmedXZfZo-turborepo-v2-11-4-fixes-affected-detection-for-negated-global-dependencies) will matter to monorepos with Go packages.\n\nThe plumbing changes are quieter but useful: the turbo npm package now [bundles documentation](/release/rel_zFeqDIs1fY6rKj1oykuHn-turborepo-v2-11-5-canary-2-bundles-docs-in-turbo-npm-package), versioned standalone archives are [published with a working installer job](/release/rel_Y_zfZJtjkORVRGl6BYXCV-turborepo-v2-11-5-canary-4-publishes-versioned-standalone-turbo-archives), and curl | bash users finally get [standalone installer URLs](/release/rel_eCyk_Zm03PmhfAs2Ia7iS-turborepo-v2-11-5-canary-5-adds-standalone-installer-urls-for-curl-bash). After the long refactor that split run orchestration and task-graph crates out of turborepo-lib, the CLI is shedding legacy baggage while keeping the surface stable.\n\n### pnpm: dedupe by default, modules you can move\n\npnpm's three releases this week read as one arc toward less manual dependency wrangling. The centerpiece is [automatic deduplication during install](/release/rel_suNm_Irj1NAANC0UYitYW-pnpm-12-6), which collapses compatible version ranges without a separate command, alongside relocatable node_modules, a `--save-types` flag for installing `@types/*` next to their packages, and catalog support for `file:` and `link:` protocols.\n\nLater releases pulled features down to the JavaScript CLI and reconnected it to the repo. There's now a [global node shim that follows .nvmrc and .node-version](/release/rel_hMdl7RA428vbYn7aQFhYm-pnpm-12-7), `pnpm install --allow-build` and `pnpm publish --publish-wait-timeout`, plus automatic creation of pnpm-workspace.yaml from package.json's workspaces field — and `--force` no longer drags in optional deps built for other platforms. The 11.x line received a parallel backport of platform-ignore and peer-update settings with [fixes across deploy, filtering, and hoisted nodeLinker setups](/release/rel_uIwEOa9M7Ez9dJKI02q3D-pnpm-11-28), plus security patches for shell completion, Nix bin shims, and lifecycle scripts running inside a custom modulesDir.\n\n### Vitest steadies the test loop\n\nTwo Vitest fixes shipped for developers who live in the editor. The VS Code extension [no longer crashes on the newest VS Code release](/release/rel_8FKMM2xLOklMxlEbqLT1W-vitest-vs-code-extension-v1-52-1-fixes-crash-in-new-vs-code-version), and it now tolerates unexpected coverage output while keeping a single scoped watcher. On the runner side, [toMatchObject handles asymmetric matchers correctly again](/release/rel_j4PinFfvNKkg7FY8oHz7z-vitest-v5-0-2-fixes-tomatchobject-asymmetric-matchers-and-spy-stack-overflow) and spying Set.prototype.add no longer overflows the stack — a relief for jsdom 28+ users whose Request bodies carry Blobs.","releaseIds":["rel_rTPg0wSVQ_9WcblUBGPSJ","rel_MW_l3bX1_-AadWSlaPSud","rel_viASy0q0ZglBk0A57rvrU","rel_0pnOFLfbKPPtvmedXZfZo","rel_vrMRars4Mu2yixwkSnb8P","rel_NtN7FCXGo3qQGbL__Tg13","rel_ievJi9Fd6SY_GbJJGdbhc","rel_zFeqDIs1fY6rKj1oykuHn","rel_Y_zfZJtjkORVRGl6BYXCV","rel_eCyk_Zm03PmhfAs2Ia7iS","rel_suNm_Irj1NAANC0UYitYW","rel_hMdl7RA428vbYn7aQFhYm","rel_uIwEOa9M7Ez9dJKI02q3D","rel_8FKMM2xLOklMxlEbqLT1W","rel_j4PinFfvNKkg7FY8oHz7z"],"releaseCount":15,"generatedAt":"2026-09-28T06:19:45.790Z","releases":[{"id":"rel_rTPg0wSVQ_9WcblUBGPSJ","title":"Turborepo v2.11.5 patches CVE-2026-84375 and CVE-2026-94545","path":"/release/rel_rTPg0wSVQ_9WcblUBGPSJ-js-yaml-and-next-js-cves-patched-remote-artifact-backoff","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.5","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":3},{"id":"rel_MW_l3bX1_-AadWSlaPSud","title":"Turborepo v2.11.5-canary.3 patches js-yaml CVE and stabilizes pnpm lockfile hashes","path":"/release/rel_MW_l3bX1_-AadWSlaPSud-js-yaml-cve-patched-pnpm-lockfile-hashes-stabilized","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.3","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2},{"id":"rel_viASy0q0ZglBk0A57rvrU","title":"Turborepo v2.11.5-canary.1 fixes remote cache forbidden handling and negated global deps","path":"/release/rel_viASy0q0ZglBk0A57rvrU-remote-cache-disables-on-forbidden-responses-negated-global-deps-respected","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.1","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2},{"id":"rel_0pnOFLfbKPPtvmedXZfZo","title":"Turborepo v2.11.4 fixes affected detection for negated global dependencies","path":"/release/rel_0pnOFLfbKPPtvmedXZfZo-negated-global-deps-respected-in-affected-detection","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.4","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2},{"id":"rel_vrMRars4Mu2yixwkSnb8P","title":"Turborepo v2.11.3-canary.4 fixes affected detection for root dependency changes","path":"/release/rel_vrMRars4Mu2yixwkSnb8P-root-internal-dependency-changes-now-treated-as-global","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.3-canary.4","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":1},{"id":"rel_NtN7FCXGo3qQGbL__Tg13","title":"Turborepo v2.11.3-canary.3 fixes boundaries gitignore and prune tag order","path":"/release/rel_NtN7FCXGo3qQGbL__Tg13-boundaries-ignore-gitignored-files-affected-globs-normalized","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.3-canary.3","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":1},{"id":"rel_ievJi9Fd6SY_GbJJGdbhc","title":"Turborepo v2.11.3 fixes affected task globs and boundaries gitignore handling","path":"/release/rel_ievJi9Fd6SY_GbJJGdbhc-affected-task-input-globs-normalized-gitignored-files-skipped-in-boundaries","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.3","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2},{"id":"rel_zFeqDIs1fY6rKj1oykuHn","title":"Turborepo v2.11.5-canary.2 bundles docs in turbo npm package","path":"/release/rel_zFeqDIs1fY6rKj1oykuHn-docs-bundled-into-turbo-npm-package","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.2","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2},{"id":"rel_Y_zfZJtjkORVRGl6BYXCV","title":"Turborepo v2.11.5-canary.4 publishes versioned standalone turbo archives","path":"/release/rel_Y_zfZJtjkORVRGl6BYXCV-standalone-turbo-archives-now-versioned","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.4","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":1},{"id":"rel_eCyk_Zm03PmhfAs2Ia7iS","title":"Turborepo v2.11.5-canary.5 adds standalone installer URLs for curl | bash","path":"/release/rel_eCyk_Zm03PmhfAs2Ia7iS-standalone-installer-urls-for-curl-bash","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.5","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2},{"id":"rel_suNm_Irj1NAANC0UYitYW","title":"pnpm 12.6","path":"/release/rel_suNm_Irj1NAANC0UYitYW-pnpm-12-6","url":"https://pnpm.io/blog/releases/12.6","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null},{"id":"rel_hMdl7RA428vbYn7aQFhYm","title":"pnpm 12.7","path":"/release/rel_hMdl7RA428vbYn7aQFhYm-pnpm-12-7","url":"https://pnpm.io/blog/releases/12.7","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null},{"id":"rel_uIwEOa9M7Ez9dJKI02q3D","title":"pnpm 11.28","path":"/release/rel_uIwEOa9M7Ez9dJKI02q3D-pnpm-11-28","url":"https://pnpm.io/blog/releases/11.28","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null},{"id":"rel_8FKMM2xLOklMxlEbqLT1W","title":"Vitest VS Code extension v1.52.1 fixes crash in new VS Code version","path":"/release/rel_8FKMM2xLOklMxlEbqLT1W-crash-in-new-vs-code-version-fixed-coverage-failures-prevented","url":"https://github.com/vitest-dev/vscode/releases/tag/v1.52.1","org":{"slug":"vitest","name":"Vitest","avatarUrl":"https://media.releases.sh/orgs/vitest.jpg","githubHandle":"vitest-dev"},"product":null,"importance":2},{"id":"rel_j4PinFfvNKkg7FY8oHz7z","title":"Vitest v5.0.2 fixes toMatchObject asymmetric matchers and spy stack overflow","path":"/release/rel_j4PinFfvNKkg7FY8oHz7z-tomatchobject-asymmetric-matchers-fixed-spy-stack-overflow-fixed","url":"https://github.com/vitest-dev/vitest/releases/tag/v5.0.2","org":{"slug":"vitest","name":"Vitest","avatarUrl":"https://media.releases.sh/orgs/vitest.jpg","githubHandle":"vitest-dev"},"product":null,"importance":2}],"sections":[{"heading":"Turborepo hardens the supply chain","anchor":"turborepo-hardens-the-supply-chain","lede":"Turborepo's week was dominated by a security patch and a run of resilience work around the remote cache.","releaseIds":["rel_rTPg0wSVQ_9WcblUBGPSJ","rel_MW_l3bX1_-AadWSlaPSud","rel_viASy0q0ZglBk0A57rvrU","rel_0pnOFLfbKPPtvmedXZfZo","rel_vrMRars4Mu2yixwkSnb8P","rel_NtN7FCXGo3qQGbL__Tg13","rel_ievJi9Fd6SY_GbJJGdbhc","rel_zFeqDIs1fY6rKj1oykuHn","rel_Y_zfZJtjkORVRGl6BYXCV","rel_eCyk_Zm03PmhfAs2Ia7iS"],"releases":[{"id":"rel_rTPg0wSVQ_9WcblUBGPSJ","title":"Turborepo v2.11.5 patches CVE-2026-84375 and CVE-2026-94545","path":"/release/rel_rTPg0wSVQ_9WcblUBGPSJ-js-yaml-and-next-js-cves-patched-remote-artifact-backoff","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.5","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":3},{"id":"rel_MW_l3bX1_-AadWSlaPSud","title":"Turborepo v2.11.5-canary.3 patches js-yaml CVE and stabilizes pnpm lockfile hashes","path":"/release/rel_MW_l3bX1_-AadWSlaPSud-js-yaml-cve-patched-pnpm-lockfile-hashes-stabilized","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.3","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2},{"id":"rel_viASy0q0ZglBk0A57rvrU","title":"Turborepo v2.11.5-canary.1 fixes remote cache forbidden handling and negated global deps","path":"/release/rel_viASy0q0ZglBk0A57rvrU-remote-cache-disables-on-forbidden-responses-negated-global-deps-respected","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.1","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2},{"id":"rel_0pnOFLfbKPPtvmedXZfZo","title":"Turborepo v2.11.4 fixes affected detection for negated global dependencies","path":"/release/rel_0pnOFLfbKPPtvmedXZfZo-negated-global-deps-respected-in-affected-detection","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.4","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2},{"id":"rel_vrMRars4Mu2yixwkSnb8P","title":"Turborepo v2.11.3-canary.4 fixes affected detection for root dependency changes","path":"/release/rel_vrMRars4Mu2yixwkSnb8P-root-internal-dependency-changes-now-treated-as-global","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.3-canary.4","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":1},{"id":"rel_NtN7FCXGo3qQGbL__Tg13","title":"Turborepo v2.11.3-canary.3 fixes boundaries gitignore and prune tag order","path":"/release/rel_NtN7FCXGo3qQGbL__Tg13-boundaries-ignore-gitignored-files-affected-globs-normalized","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.3-canary.3","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":1},{"id":"rel_ievJi9Fd6SY_GbJJGdbhc","title":"Turborepo v2.11.3 fixes affected task globs and boundaries gitignore handling","path":"/release/rel_ievJi9Fd6SY_GbJJGdbhc-affected-task-input-globs-normalized-gitignored-files-skipped-in-boundaries","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.3","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2},{"id":"rel_zFeqDIs1fY6rKj1oykuHn","title":"Turborepo v2.11.5-canary.2 bundles docs in turbo npm package","path":"/release/rel_zFeqDIs1fY6rKj1oykuHn-docs-bundled-into-turbo-npm-package","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.2","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2},{"id":"rel_Y_zfZJtjkORVRGl6BYXCV","title":"Turborepo v2.11.5-canary.4 publishes versioned standalone turbo archives","path":"/release/rel_Y_zfZJtjkORVRGl6BYXCV-standalone-turbo-archives-now-versioned","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.4","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":1},{"id":"rel_eCyk_Zm03PmhfAs2Ia7iS","title":"Turborepo v2.11.5-canary.5 adds standalone installer URLs for curl | bash","path":"/release/rel_eCyk_Zm03PmhfAs2Ia7iS-standalone-installer-urls-for-curl-bash","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.5","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2}]},{"heading":"pnpm: dedupe by default, modules you can move","anchor":"pnpm-dedupe-by-default-modules-you-can-move","lede":"pnpm's three releases this week read as one arc toward less manual dependency wrangling.","releaseIds":["rel_suNm_Irj1NAANC0UYitYW","rel_hMdl7RA428vbYn7aQFhYm","rel_uIwEOa9M7Ez9dJKI02q3D"],"releases":[{"id":"rel_suNm_Irj1NAANC0UYitYW","title":"pnpm 12.6","path":"/release/rel_suNm_Irj1NAANC0UYitYW-pnpm-12-6","url":"https://pnpm.io/blog/releases/12.6","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null},{"id":"rel_hMdl7RA428vbYn7aQFhYm","title":"pnpm 12.7","path":"/release/rel_hMdl7RA428vbYn7aQFhYm-pnpm-12-7","url":"https://pnpm.io/blog/releases/12.7","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null},{"id":"rel_uIwEOa9M7Ez9dJKI02q3D","title":"pnpm 11.28","path":"/release/rel_uIwEOa9M7Ez9dJKI02q3D-pnpm-11-28","url":"https://pnpm.io/blog/releases/11.28","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null}]},{"heading":"Vitest steadies the test loop","anchor":"vitest-steadies-the-test-loop","lede":"Two Vitest fixes shipped for developers who live in the editor.","releaseIds":["rel_8FKMM2xLOklMxlEbqLT1W","rel_j4PinFfvNKkg7FY8oHz7z"],"releases":[{"id":"rel_8FKMM2xLOklMxlEbqLT1W","title":"Vitest VS Code extension v1.52.1 fixes crash in new VS Code version","path":"/release/rel_8FKMM2xLOklMxlEbqLT1W-crash-in-new-vs-code-version-fixed-coverage-failures-prevented","url":"https://github.com/vitest-dev/vscode/releases/tag/v1.52.1","org":{"slug":"vitest","name":"Vitest","avatarUrl":"https://media.releases.sh/orgs/vitest.jpg","githubHandle":"vitest-dev"},"product":null,"importance":2},{"id":"rel_j4PinFfvNKkg7FY8oHz7z","title":"Vitest v5.0.2 fixes toMatchObject asymmetric matchers and spy stack overflow","path":"/release/rel_j4PinFfvNKkg7FY8oHz7z-tomatchobject-asymmetric-matchers-fixed-spy-stack-overflow-fixed","url":"https://github.com/vitest-dev/vitest/releases/tag/v5.0.2","org":{"slug":"vitest","name":"Vitest","avatarUrl":"https://media.releases.sh/orgs/vitest.jpg","githubHandle":"vitest-dev"},"product":null,"importance":2}]}]}}