Turborepo banks a week of speed as Vitest and pnpm widen their tooling

Performance as the headline

Turborepo's week was mostly about going faster, and it went faster nearly everywhere. The bulk of the work lands in lockfile parsing and cache archive handling, with glob matching, task output rendering, and file watching all getting tuned as well. Berry lockfile closures are now computed once across workspaces and Cargo metadata is prefetched during lazy graph construction, so the gains compound on larger monorepos where every task pays the startup tax. Buried in the same batch are the fixes that make it stick: non-UTF-8 arguments no longer crash the turbo shim, setup roots resolve correctly when Git isn't present, and Homebrew's bundled npm prefix is handled in setup source preflight. A root-only turbo setup policy in turbo.json rounds out the controls.

The setup surface itself is the other half of the story. Turborepo's experimental setup command verifies checksums on downloads and writes locks atomically, giving managed tool installation a bounded, auditable path rather than an ad-hoc one. That same stretch of work fixed npm patches in pruned workspaces, preserved symlinked AGENTS.md files, and repaired a codemod that was generating duplicate package names — the kind of cleanup that matters most to teams already automating their workspace provisioning.

Vitest turns on caching and reopens its trace viewer

Vitest's week centered on fsModuleCache enabled by default, which should trim repeated module loading across runs without any opt-in from users. The trace viewer picked up fit and zoom controls and now highlights when a selector matches more than one element, a small change that saves real debugging time. Underneath, coverage memory leaks and a V8 browser leak between test files were closed, module mock resolution now works in directories with spaces, and Map/Set deep equality in assertions was corrected.

The hardening continued in the fixes that followed. Hook cleanups now run when a later hook fails, mocks of finished test files are released to stop leaking memory, and cancelling a run aborts every test still in flight. Browser mode got attention too, with global setup and closed-session issues resolved, and Vite's default fs.deny survives when an API token file is present — as does quoted file name handling in --changed. The v4 line wasn't left behind either: manual and redirect mocks were hardened there as a backport, so projects not yet on v5 get the same protection.

pnpm grows its registry-side commands

pnpm filled two obvious gaps in its registry workflow at once: pnpm profile views and updates registry user profile settings, and pnpm token lists, creates, and revokes authentication tokens — both things users previously had to leave the terminal for. The release also adds a storeIndexFormat setting, letting a store shared over a network filesystem keep its package index as one file per package, and speeds up Python dependency resolution for projects mixing ecosystems.

The thread running through it

Three products, one direction: tooling that assumes it will be run constantly and at scale. Turborepo shaved milliseconds out of every stage of a pipeline and made installing its own tools safe to automate, Vitest cached what it can and stopped leaking what it can't, and pnpm moved account administration out of the browser and into the CLI. For teams whose CI bills and developer patience both depend on these tools, this was a good week to upgrade.