Deno hands the runtime to Cloudflare as pnpm hardens the supply chain

Deno's endgame

The biggest news of the week doesn't come from a feature: the entire Deno team is joining Cloudflare, folding its work into the Workers and Durable Objects teams. The Deno runtime itself is winding down — monthly bug fix and security releases continue for one year, after which development ends. Deno Deploy shuts down in six months, with migration support for paying customers moving to Cloudflare Workers, while JSR keeps operating with its infrastructure relocating to Cloudflare. For anyone building on Deno, the practical takeaway is a one-year runway to either ride the maintenance cadence or start migrating. For the broader ecosystem, it's a signal that the standalone runtime race has consolidated around a smaller set of hosts — and that JSR, at least for now, survives the transition.

pnpm's security-heavy week

pnpm cut eight releases, and the throughline across most of them was trust: what pnpm verifies before it installs, and what a lockfile is allowed to override. The security fixes to package archives, git dependencies, and config dependencies land in the 11.x line, and the 12.x line carries its own hardening — stopping a dependency version from writing files outside the global virtual store in the same release that introduced the experimental loaded node linker. That linker is the week's most interesting structural change: compatible dependencies load straight from the content-addressable store through a registered Node.js loader, and subsequent fixes kept its generated files inside node_modules, where projects already ignore them. On the auth side, pnpm dist-tag gained OIDC support and pnpm publish now checks which registry an NPM_ID_TOKEN was issued for before trusting it, skipping tokens issued for a different registry.

Distribution got attention too. pnpm now shares task results and dependency builds through a remote cache speaking the Turborepo Remote Cache API, and it added Rust toolchain management plus a permissions setting — linking the agent skills that dependencies ship into project skill directories, but only after explicit approval. The remaining fixes are the unglamorous reliability work: installs no longer failing when packageManager pins a version the registry hasn't mirrored, --workspace-concurrency=Infinity working again, and an overrides change no longer breaking the next install.

Toolchain odds and ends

Bun shipped its latest patch release with a modest contributor list, mostly incremental. Turborepo's canary channel continued its run toward the next minor, adding task tags with config inheritance and query filtering so tasks and packages can be selected by tag, alongside fixes for input normalization and Yarn patch resolutions lost during prune. A follow-up canary shared setup TLS with a guard for official source policy and stopped the add-package-names codemod from producing duplicate names.