pnpm hardens credentials and trims its footprint as Turborepo tags tasks

pnpm closes credential leaks and slims down

pnpm's week was mostly security work. pnpm login no longer forwards credentials to another origin when a request redirects, and the error message for a tarball that fails its integrity check stopped printing credentials, query strings, and fragments into logs and CI output — the two most common ways a registry token ends up in a build log. The same line also made pnpm install --frozen-lockfile accept lockfiles it had been rejecting, started warning when an optional dependency can't be fetched, and stopped pnpm self-update from installing a second copy alongside a Homebrew-managed one.

The packaging story is the other half. The WebAssembly build for StackBlitz WebContainers moved out into a separate @pnpm/wasm package, which drops the main pnpm and @pnpm/exe packages from roughly 55 MB unpacked back to about 4 MB — anyone not running in a WebContainer was carrying that payload for nothing. That follows pnpm learning to select the WebAssembly build automatically inside StackBlitz WebContainers, including when install scripts are disabled. The same stretch of releases added a per-registry networkConcurrency setting so slow or rate-limited registries can be tuned without changing global concurrency, and began recording every installed project in the store.

Earlier in the week, pnpm fixed a startup crash on Linux ppc64le and UnknownIssuer failures on systems with no CA certificates, and stopped pnpm run from reinstalling before every script on CI when autoDedupe is enabled — a quiet but meaningful CI speedup, alongside faster resolution and hoisted installs on macOS.

Turborepo tags tasks and tightens cache inputs

Turborepo's headline feature this week is task tags with configuration inheritance, queryable from the CLI: tags can be inherited through configuration and then used to filter both tasks and packages in turbo query, giving large monorepos a way to select work by intent rather than by hand-maintained package lists. The same run also fixed Yarn patch resolutions being dropped when prune encounters npm protocol selectors, normalized task inputs for affected detection and hashing, made query commands infer single-package mode, and completed task query metadata for non-script entrypoints.

A follow-up patch passed SDKROOT through to repository tasks and stopped Vercel OIDC token rotation in .env.local from invalidating cache inputs — the kind of fix that turns spurious cache misses into hits for anyone rotating tokens locally.

Vitest cleans up repeat runs and browser mode

Vitest isolated result.status between repeat runs and scoped cache key generators to projects, fixing a class of flaky failures where state leaked from one repeat into the next. Browser mode got the bulk of the attention: mock path boundary checks were corrected, configs for browser-consumed environments are now retained, and the server no longer starts listening until tests actually begin. Cached module imports are revalidated rather than trusted blindly. The VS Code extension had no significant changes this week.