---
collection: js-toolchain
collection_name: JavaScript Runtimes & Tooling
week_start: 2026-09-28
title: pnpm hardens credentials and trims its footprint as Turborepo tags tasks
release_count: 8
generated: 2026-10-05
canonical: https://releases.sh/collections/js-toolchain/digest/2026-09-28
---

# pnpm hardens credentials and trims its footprint as Turborepo tags tasks

pnpm spent the week closing credential leaks and cutting its own install size, while Turborepo shipped task tags with inherited configuration for finer-scoped builds.

### pnpm closes credential leaks and slims down

pnpm's week was mostly security work. [pnpm login no longer forwards credentials to another origin when a request redirects](https://pnpm.io/blog/releases/11.28.4), and the error message for a tarball that fails its integrity check stopped printing credentials, query strings, and fragments into logs and CI output — the two most common ways a registry token ends up in a build log. The same line also made `pnpm install --frozen-lockfile` accept lockfiles it had been rejecting, started warning when an optional dependency can't be fetched, and stopped `pnpm self-update` from installing a second copy alongside a Homebrew-managed one.

The packaging story is the other half. [The WebAssembly build for StackBlitz WebContainers moved out into a separate `@pnpm/wasm` package](https://pnpm.io/blog/releases/12.9.1), which drops the main `pnpm` and `@pnpm/exe` packages from roughly 55 MB unpacked back to about 4 MB — anyone not running in a WebContainer was carrying that payload for nothing. That follows [pnpm learning to select the WebAssembly build automatically inside StackBlitz WebContainers](https://pnpm.io/blog/releases/12.9.0), including when install scripts are disabled. The same stretch of releases added a per-registry `networkConcurrency` setting so slow or rate-limited registries can be tuned without changing global concurrency, and began recording every installed project in the store.

Earlier in the week, [pnpm fixed a startup crash on Linux ppc64le and `UnknownIssuer` failures on systems with no CA certificates](https://pnpm.io/blog/releases/12.8.2), and stopped `pnpm run` from reinstalling before every script on CI when `autoDedupe` is enabled — a quiet but meaningful CI speedup, alongside faster resolution and hoisted installs on macOS.

### Turborepo tags tasks and tightens cache inputs

Turborepo's headline feature this week is [task tags with configuration inheritance, queryable from the CLI](https://github.com/vercel/turborepo/releases/tag/v2.11.6): tags can be inherited through configuration and then used to filter both tasks and packages in `turbo query`, giving large monorepos a way to select work by intent rather than by hand-maintained package lists. The same run also fixed Yarn patch resolutions being dropped when `prune` encounters npm protocol selectors, normalized task inputs for affected detection and hashing, made query commands infer single-package mode, and completed task query metadata for non-script entrypoints.

A follow-up patch [passed SDKROOT through to repository tasks and stopped Vercel OIDC token rotation in `.env.local` from invalidating cache inputs](https://github.com/vercel/turborepo/releases/tag/v2.11.7) — the kind of fix that turns spurious cache misses into hits for anyone rotating tokens locally.

### Vitest cleans up repeat runs and browser mode

[Vitest isolated `result.status` between repeat runs and scoped cache key generators to projects](https://github.com/vitest-dev/vitest/releases/tag/v5.0.3), fixing a class of flaky failures where state leaked from one repeat into the next. Browser mode got the bulk of the attention: mock path boundary checks were corrected, configs for browser-consumed environments are now retained, and the server no longer starts listening until tests actually begin. Cached module imports are revalidated rather than trusted blindly. The VS Code extension had no significant changes this week.

## Releases covered

### pnpm

- [pnpm 11.28.4](https://pnpm.io/blog/releases/11.28.4)
- [pnpm 12.9.1](https://pnpm.io/blog/releases/12.9.1)
- [pnpm 12.9.0](https://pnpm.io/blog/releases/12.9.0)
- [pnpm 12.8.2](https://pnpm.io/blog/releases/12.8.2)

### Vercel

- [Turborepo v2.11.6 adds task tags with configuration inheritance and query filtering](https://github.com/vercel/turborepo/releases/tag/v2.11.6)
- [Turborepo v2.11.7 passes SDKROOT through to tasks and fixes OIDC token cache inputs](https://github.com/vercel/turborepo/releases/tag/v2.11.7)

### Vitest

- [Vitest v5.0.3 fixes browser mode, cache, and repeat-run bugs](https://github.com/vitest-dev/vitest/releases/tag/v5.0.3)