Testing gets smarter and the supply chain gets stricter

The trust chain gets audited everywhere at once

The week's most consistent thread ran through certificate handling. Following the October distrust of certain certificate authority intermediates, three of the collection's members hardened their trust stores. Deno began refusing the compromised eMudhra CAs outright, pairing that with validation of npm package link names so a dependency can't quietly point at a different package than the one requested. Turborepo took the same step against the eMudhra intermediates, which matters most for anyone pulling remote caches across the network. And pnpm's standalone @pnpm/exe builds now embed Node.js 26.12.1 specifically because the older embedded runtime still trusted those same roots — a standalone binary that ships its own runtime inherits that runtime's trust decisions, so this was a real exposure rather than a formality.

Vitest narrows the test loop

Vitest's latest beta turns test selection into a first-class workflow: a --last-failed flag reruns only the tests that failed, and --since-last-run targets everything affected since the previous run. Together they let a local or CI loop stop paying for a full suite when only a slice is in question. The same beta rounds out fake timers with support for node:timers and node:timers/promise, extends vi.setSystemTime() to Temporal.Instant and Temporal.ZonedDateTime, and surfaces per-retry attempt results so flaky-test triage doesn't require guesswork about which attempt actually passed.

pnpm rethinks configuration and reproducibility

pnpm's 12.15.0 gives pnpm-workspace.yaml a delegation mechanism, letting workspace settings and config dependencies live in other files via include — the kind of change that matters in monorepos where a single flat workspace file has grown unwieldy. Alongside it come a lockfile.integrityTarget: tar option with tar-registry support, zstd-compressed registry responses, and honoring of SOURCE_DATE_EPOCH in pnpm deploy and pnpm install for reproducible builds. pnpm also started rejecting registry metadata that names a different package than the one requested, closing the same class of substitution gap Deno addressed, and sped up workspace installs and macOS file linking.

Turborepo and Bun round out the fixes

Turborepo cleaned up several sharp edges: pnpm batch-shim shutdown hangs on Windows are gone, cached symlinks are now restored when outputs already exist on disk, and hashing got more faithful through git text=auto binary detection, alongside fixes to affected-detection and lockfile parsing. Bun shipped its weekly patch release with contributions from 39 people — routine churn, but part of Bun's steady cadence, and worth a look if you're tracking the runtime's stability between minor versions.