--- collection: js-toolchain collection_name: JavaScript Runtimes & Tooling week_start: 2026-09-21 title: Turborepo patches two CVEs as pnpm lands dedupe and relocatable modules release_count: 15 generated: 2026-09-28 canonical: https://releases.sh/collections/js-toolchain/digest/2026-09-21 --- # Turborepo patches two CVEs as pnpm lands dedupe and relocatable modules Turborepo shipped a security release patching two vulnerabilities in js-yaml and its docs toolchain while reworking remote-cache behavior, and pnpm rolled out automatic dependency deduplication, relocatable node_modules, and repo-config-aware Node shims across three releases. ### Turborepo hardens the supply chain Turborepo's week was dominated by a security patch and a run of resilience work around the remote cache. The headline fix upgraded js-yaml to [close CVE-2026-84375 and bumped Next.js in docs and factory builds for CVE-2026-94545](https://github.com/vercel/turborepo/releases/tag/v2.11.5), with the js-yaml update also landing on the canary line alongside [lockfile-hash stabilization for pnpm workspaces](https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.3). Teams auditing their build dependencies should treat this as the release to pull forward. The remote cache got noticeably more defensive. Turborepo now [backs off artifact requests during outages](https://github.com/vercel/turborepo/releases/tag/v2.11.5), [disables the cache after unrecoverable forbidden responses and shares concurrent token recovery](https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.1) so rate limiting doesn't strand parallel tasks, and [stops tasks when the parent process exits](https://github.com/vercel/turborepo/releases/tag/v2.11.4) instead of leaving orphans behind. Signing now covers [complete on-disk artifacts after local cache writes](https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.1), closing a gap where partial artifacts could slip through. Correctness fixes clustered around affected detection and file handling. Negated global dependencies are now [respected in affected detection](https://github.com/vercel/turborepo/releases/tag/v2.11.4), root internal dependency changes are [treated as global](https://github.com/vercel/turborepo/releases/tag/v2.11.3-canary.4), gitignored files are [properly ignored in boundaries](https://github.com/vercel/turborepo/releases/tag/v2.11.3-canary.3), and affected task input globs are [normalized rather than mangled](https://github.com/vercel/turborepo/releases/tag/v2.11.3). A fix for [secondary go.work files Go reads for workspace members](https://github.com/vercel/turborepo/releases/tag/v2.11.4) will matter to monorepos with Go packages. The plumbing changes are quieter but useful: the turbo npm package now [bundles documentation](https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.2), versioned standalone archives are [published with a working installer job](https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.4), and curl | bash users finally get [standalone installer URLs](https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.5). After the long refactor that split run orchestration and task-graph crates out of turborepo-lib, the CLI is shedding legacy baggage while keeping the surface stable. ### pnpm: dedupe by default, modules you can move pnpm's three releases this week read as one arc toward less manual dependency wrangling. The centerpiece is [automatic deduplication during install](https://pnpm.io/blog/releases/12.6), which collapses compatible version ranges without a separate command, alongside relocatable node_modules, a `--save-types` flag for installing `@types/*` next to their packages, and catalog support for `file:` and `link:` protocols. Later releases pulled features down to the JavaScript CLI and reconnected it to the repo. There's now a [global node shim that follows .nvmrc and .node-version](https://pnpm.io/blog/releases/12.7), `pnpm install --allow-build` and `pnpm publish --publish-wait-timeout`, plus automatic creation of pnpm-workspace.yaml from package.json's workspaces field — and `--force` no longer drags in optional deps built for other platforms. The 11.x line received a parallel backport of platform-ignore and peer-update settings with [fixes across deploy, filtering, and hoisted nodeLinker setups](https://pnpm.io/blog/releases/11.28), plus security patches for shell completion, Nix bin shims, and lifecycle scripts running inside a custom modulesDir. ### Vitest steadies the test loop Two Vitest fixes shipped for developers who live in the editor. The VS Code extension [no longer crashes on the newest VS Code release](https://github.com/vitest-dev/vscode/releases/tag/v1.52.1), and it now tolerates unexpected coverage output while keeping a single scoped watcher. On the runner side, [toMatchObject handles asymmetric matchers correctly again](https://github.com/vitest-dev/vitest/releases/tag/v5.0.2) and spying Set.prototype.add no longer overflows the stack — a relief for jsdom 28+ users whose Request bodies carry Blobs. ## Releases covered ### pnpm - [pnpm 12.6](https://pnpm.io/blog/releases/12.6) - [pnpm 12.7](https://pnpm.io/blog/releases/12.7) - [pnpm 11.28](https://pnpm.io/blog/releases/11.28) ### Vercel - [Turborepo v2.11.5 patches CVE-2026-84375 and CVE-2026-94545](https://github.com/vercel/turborepo/releases/tag/v2.11.5) - [Turborepo v2.11.5-canary.3 patches js-yaml CVE and stabilizes pnpm lockfile hashes](https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.3) - [Turborepo v2.11.5-canary.1 fixes remote cache forbidden handling and negated global deps](https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.1) - [Turborepo v2.11.4 fixes affected detection for negated global dependencies](https://github.com/vercel/turborepo/releases/tag/v2.11.4) - [Turborepo v2.11.3-canary.4 fixes affected detection for root dependency changes](https://github.com/vercel/turborepo/releases/tag/v2.11.3-canary.4) - [Turborepo v2.11.3-canary.3 fixes boundaries gitignore and prune tag order](https://github.com/vercel/turborepo/releases/tag/v2.11.3-canary.3) - [Turborepo v2.11.3 fixes affected task globs and boundaries gitignore handling](https://github.com/vercel/turborepo/releases/tag/v2.11.3) - [Turborepo v2.11.5-canary.2 bundles docs in turbo npm package](https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.2) - [Turborepo v2.11.5-canary.4 publishes versioned standalone turbo archives](https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.4) - [Turborepo v2.11.5-canary.5 adds standalone installer URLs for curl | bash](https://github.com/vercel/turborepo/releases/tag/v2.11.5-canary.5) ### Vitest - [Vitest VS Code extension v1.52.1 fixes crash in new VS Code version](https://github.com/vitest-dev/vscode/releases/tag/v1.52.1) - [Vitest v5.0.2 fixes toMatchObject asymmetric matchers and spy stack overflow](https://github.com/vitest-dev/vitest/releases/tag/v5.0.2)