--- collection: js-toolchain collection_name: JavaScript Runtimes & Tooling week_start: 2026-10-05 title: Deno hands the runtime to Cloudflare as pnpm hardens the supply chain release_count: 12 generated: 2026-10-12 canonical: https://releases.sh/collections/js-toolchain/digest/2026-10-05 --- # Deno hands the runtime to Cloudflare as pnpm hardens the supply chain The Deno team is joining Cloudflare, with the Deno runtime entering a one-year maintenance window before development ends, while pnpm shipped eight releases focused on supply-chain security, a new remote cache, and an experimental node linker. ### Deno's endgame The biggest news of the week doesn't come from a feature: the entire Deno team is joining Cloudflare, folding its work into the Workers and Durable Objects teams. The [Deno runtime itself is winding down](https://deno.com/blog/cloudflare) — monthly bug fix and security releases continue for one year, after which development ends. Deno Deploy shuts down in six months, with migration support for paying customers moving to Cloudflare Workers, while JSR keeps operating with its infrastructure relocating to Cloudflare. For anyone building on Deno, the practical takeaway is a one-year runway to either ride the maintenance cadence or start migrating. For the broader ecosystem, it's a signal that the standalone runtime race has consolidated around a smaller set of hosts — and that JSR, at least for now, survives the transition. ### pnpm's security-heavy week pnpm cut eight releases, and the throughline across most of them was trust: what pnpm verifies before it installs, and what a lockfile is allowed to override. The [security fixes to package archives, git dependencies, and config dependencies](https://pnpm.io/blog/releases/11.28.5) land in the 11.x line, and the 12.x line carries its own hardening — [stopping a dependency version from writing files outside the global virtual store](https://pnpm.io/blog/releases/12.10.0) in the same release that introduced the experimental `loaded` node linker. That linker is the week's most interesting structural change: compatible dependencies load straight from the content-addressable store through a registered Node.js loader, and [subsequent fixes kept its generated files inside `node_modules`](https://pnpm.io/blog/releases/12.10.1), where projects already ignore them. On the auth side, `pnpm dist-tag` gained OIDC support and `pnpm publish` now [checks which registry an `NPM_ID_TOKEN` was issued for](https://pnpm.io/blog/releases/12.12.1) before trusting it, skipping tokens issued for a different registry. Distribution got attention too. pnpm now [shares task results and dependency builds through a remote cache](https://pnpm.io/blog/releases/12.12.0) speaking the Turborepo Remote Cache API, and it added Rust toolchain management plus a `permissions` setting — [linking the agent skills that dependencies ship](https://pnpm.io/blog/releases/12.11.0) into project skill directories, but only after explicit approval. The remaining fixes are the unglamorous reliability work: [installs no longer failing when `packageManager` pins a version the registry hasn't mirrored](https://pnpm.io/blog/releases/12.11.1), [`--workspace-concurrency=Infinity` working again](https://pnpm.io/blog/releases/12.11.2), and an [overrides change no longer breaking the next install](https://pnpm.io/blog/releases/12.10.1). ### Toolchain odds and ends Bun [shipped its latest patch release](https://github.com/oven-sh/bun/releases/tag/bun-v1.4.3) with a modest contributor list, mostly incremental. Turborepo's canary channel continued its run toward the next minor, adding [task tags with config inheritance and query filtering](https://github.com/vercel/turborepo/releases/tag/v2.11.8-canary.1) so tasks and packages can be selected by tag, alongside fixes for input normalization and Yarn patch resolutions lost during prune. A follow-up canary [shared setup TLS with a guard for official source policy](https://github.com/vercel/turborepo/releases/tag/v2.11.8-canary.2) and stopped the `add-package-names` codemod from producing duplicate names. ## Releases covered ### Bun - [Bun v1.4.3](https://github.com/oven-sh/bun/releases/tag/bun-v1.4.3) ### Deno - [Deno team joins Cloudflare, Deno runtime support ends after one year](https://deno.com/blog/cloudflare) ### pnpm - [pnpm 11.28.5](https://pnpm.io/blog/releases/11.28.5) - [pnpm 12.10.0](https://pnpm.io/blog/releases/12.10.0) - [pnpm 12.10.1](https://pnpm.io/blog/releases/12.10.1) - [pnpm 12.12.1](https://pnpm.io/blog/releases/12.12.1) - [pnpm 12.12.0](https://pnpm.io/blog/releases/12.12.0) - [pnpm 12.11.0](https://pnpm.io/blog/releases/12.11.0) - [pnpm 12.11.1](https://pnpm.io/blog/releases/12.11.1) - [pnpm 12.11.2](https://pnpm.io/blog/releases/12.11.2) ### Vercel - [Turborepo v2.11.8-canary.1 adds task tags with config inheritance and query filtering](https://github.com/vercel/turborepo/releases/tag/v2.11.8-canary.1) - [Turborepo v2.11.8-canary.2 fixes duplicate codemod names and shares setup TLS](https://github.com/vercel/turborepo/releases/tag/v2.11.8-canary.2)