{"collection":{"slug":"js-toolchain","name":"JavaScript Runtimes & Tooling"},"digest":{"id":"cwd_x4MdbX-ppjOlBtzn9y49-","weekStart":"2026-10-19","title":"Testing gets smarter and the supply chain gets stricter","intro":"Vitest added flags to rerun only failed or recently affected tests, while Deno, Turborepo, and pnpm all moved to distrust the compromised eMudhra certificate authorities and tightened package link validation.","body":"### The trust chain gets audited everywhere at once\n\nThe week's most consistent thread ran through certificate handling. Following the October distrust of certain certificate authority intermediates, three of the collection's members hardened their trust stores. [Deno began refusing the compromised eMudhra CAs outright](/release/rel_futssl8bdUIYvC8-kI5Wo-deno-v2-9-8-distrusts-compromised-emudhra-cas-and-fixes-npm-package-link), pairing that with validation of npm package link names so a dependency can't quietly point at a different package than the one requested. [Turborepo took the same step against the eMudhra intermediates](/release/rel_ww9oMI_Sl1gPouUiZs-rd-turborepo-v2-11-10-fixes-pnpm-windows-shutdown-hangs-and-cache-symlink-restore), which matters most for anyone pulling remote caches across the network. And [pnpm's standalone `@pnpm/exe` builds now embed Node.js 26.12.1](/release/rel_W_tlLyYugSa0bxptEXgoO-pnpm-11-28-8) specifically because the older embedded runtime still trusted those same roots — a standalone binary that ships its own runtime inherits that runtime's trust decisions, so this was a real exposure rather than a formality.\n\n### Vitest narrows the test loop\n\n[Vitest's latest beta turns test selection into a first-class workflow](/release/rel_3Ti9APFB8QBxqHwWI_iQK-vitest-v5-1-0-beta-1-adds-last-failed-and-since-last-run-flags): a `--last-failed` flag reruns only the tests that failed, and `--since-last-run` targets everything affected since the previous run. Together they let a local or CI loop stop paying for a full suite when only a slice is in question. The same beta rounds out fake timers with support for `node:timers` and `node:timers/promise`, extends `vi.setSystemTime()` to `Temporal.Instant` and `Temporal.ZonedDateTime`, and surfaces per-retry attempt results so flaky-test triage doesn't require guesswork about which attempt actually passed.\n\n### pnpm rethinks configuration and reproducibility\n\n[pnpm's 12.15.0 gives `pnpm-workspace.yaml` a delegation mechanism](/release/rel_UldQW-GW8uisWNb3ADCt0-pnpm-12-15-0), letting workspace settings and config dependencies live in other files via `include` — the kind of change that matters in monorepos where a single flat workspace file has grown unwieldy. Alongside it come a `lockfile.integrityTarget: tar` option with tar-registry support, zstd-compressed registry responses, and honoring of `SOURCE_DATE_EPOCH` in `pnpm deploy` and `pnpm install` for reproducible builds. pnpm also started rejecting registry metadata that names a different package than the one requested, closing the same class of substitution gap Deno addressed, and sped up workspace installs and macOS file linking.\n\n### Turborepo and Bun round out the fixes\n\n[Turborepo cleaned up several sharp edges](/release/rel_ww9oMI_Sl1gPouUiZs-rd-turborepo-v2-11-10-fixes-pnpm-windows-shutdown-hangs-and-cache-symlink-restore): pnpm batch-shim shutdown hangs on Windows are gone, cached symlinks are now restored when outputs already exist on disk, and hashing got more faithful through git `text=auto` binary detection, alongside fixes to affected-detection and lockfile parsing. [Bun shipped its weekly patch release](/release/rel_393a1sKtf6ZNwXcyE3k_O-bun-v1-4-4-release) with contributions from 39 people — routine churn, but part of Bun's steady cadence, and worth a look if you're tracking the runtime's stability between minor versions.","releaseIds":["rel_futssl8bdUIYvC8-kI5Wo","rel_ww9oMI_Sl1gPouUiZs-rd","rel_W_tlLyYugSa0bxptEXgoO","rel_3Ti9APFB8QBxqHwWI_iQK","rel_UldQW-GW8uisWNb3ADCt0","rel_393a1sKtf6ZNwXcyE3k_O"],"releaseCount":6,"generatedAt":"2026-10-26T06:23:35.248Z","releases":[{"id":"rel_futssl8bdUIYvC8-kI5Wo","title":"Deno v2.9.8 distrusts compromised eMudhra CAs and fixes npm package link validation","path":"/release/rel_futssl8bdUIYvC8-kI5Wo-emudhra-cas-distrusted-npm-link-names-validated","url":"https://github.com/denoland/deno/releases/tag/v2.9.8","org":{"slug":"deno","name":"Deno","avatarUrl":"https://media.releases.sh/orgs/deno.png","githubHandle":"denoland"},"product":null,"importance":3,"composition":{"bugs":13,"features":0,"enhancements":0},"publishedAt":"2026-10-21T15:28:53.000Z"},{"id":"rel_ww9oMI_Sl1gPouUiZs-rd","title":"Turborepo v2.11.10 fixes pnpm Windows shutdown hangs and cache symlink restore","path":"/release/rel_ww9oMI_Sl1gPouUiZs-rd-pnpm-windows-shutdown-hangs-fixed-cached-symlinks-restored","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.10","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2,"composition":{"bugs":10,"features":1,"enhancements":0},"publishedAt":"2026-10-20T20:36:23.000Z"},{"id":"rel_W_tlLyYugSa0bxptEXgoO","title":"pnpm 11.28.8","path":"/release/rel_W_tlLyYugSa0bxptEXgoO-pnpm-11-28-8","url":"https://pnpm.io/blog/releases/11.28.8","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-22T00:00:00.000Z"},{"id":"rel_3Ti9APFB8QBxqHwWI_iQK","title":"Vitest v5.1.0-beta.1 adds --last-failed and --since-last-run flags","path":"/release/rel_3Ti9APFB8QBxqHwWI_iQK-last-failed-and-since-last-run-target-test-reruns","url":"https://github.com/vitest-dev/vitest/releases/tag/v5.1.0-beta.1","org":{"slug":"vitest","name":"Vitest","avatarUrl":"https://media.releases.sh/orgs/vitest.jpg","githubHandle":"vitest-dev"},"product":null,"importance":3,"composition":{"bugs":7,"features":9,"enhancements":2},"publishedAt":"2026-10-19T16:42:33.000Z"},{"id":"rel_UldQW-GW8uisWNb3ADCt0","title":"pnpm 12.15.0","path":"/release/rel_UldQW-GW8uisWNb3ADCt0-pnpm-12-15-0","url":"https://pnpm.io/blog/releases/12.15.0","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-21T00:00:00.000Z"},{"id":"rel_393a1sKtf6ZNwXcyE3k_O","title":"Bun v1.4.4 release","path":"/release/rel_393a1sKtf6ZNwXcyE3k_O-bun-v1-4-4-release","url":"https://github.com/oven-sh/bun/releases/tag/bun-v1.4.4","org":{"slug":"bun","name":"Bun","avatarUrl":"https://media.releases.sh/orgs/bun.png","githubHandle":"oven-sh"},"product":null,"importance":1,"composition":null,"publishedAt":"2026-10-22T10:11:32.000Z"}],"sections":[{"heading":"The trust chain gets audited everywhere at once","anchor":"the-trust-chain-gets-audited-everywhere-at-once","lede":"The week's most consistent thread ran through certificate handling.","releaseIds":["rel_futssl8bdUIYvC8-kI5Wo","rel_ww9oMI_Sl1gPouUiZs-rd","rel_W_tlLyYugSa0bxptEXgoO"],"releases":[{"id":"rel_futssl8bdUIYvC8-kI5Wo","title":"Deno v2.9.8 distrusts compromised eMudhra CAs and fixes npm package link validation","path":"/release/rel_futssl8bdUIYvC8-kI5Wo-emudhra-cas-distrusted-npm-link-names-validated","url":"https://github.com/denoland/deno/releases/tag/v2.9.8","org":{"slug":"deno","name":"Deno","avatarUrl":"https://media.releases.sh/orgs/deno.png","githubHandle":"denoland"},"product":null,"importance":3,"composition":{"bugs":13,"features":0,"enhancements":0},"publishedAt":"2026-10-21T15:28:53.000Z"},{"id":"rel_ww9oMI_Sl1gPouUiZs-rd","title":"Turborepo v2.11.10 fixes pnpm Windows shutdown hangs and cache symlink restore","path":"/release/rel_ww9oMI_Sl1gPouUiZs-rd-pnpm-windows-shutdown-hangs-fixed-cached-symlinks-restored","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.10","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2,"composition":{"bugs":10,"features":1,"enhancements":0},"publishedAt":"2026-10-20T20:36:23.000Z"},{"id":"rel_W_tlLyYugSa0bxptEXgoO","title":"pnpm 11.28.8","path":"/release/rel_W_tlLyYugSa0bxptEXgoO-pnpm-11-28-8","url":"https://pnpm.io/blog/releases/11.28.8","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-22T00:00:00.000Z"}]},{"heading":"Vitest narrows the test loop","anchor":"vitest-narrows-the-test-loop","lede":"Vitest's latest beta turns test selection into a first-class workflow: a --last-failed flag reruns only the tests that failed, and --since-last-run targets everything affected since the previous run.","releaseIds":["rel_3Ti9APFB8QBxqHwWI_iQK"],"releases":[{"id":"rel_3Ti9APFB8QBxqHwWI_iQK","title":"Vitest v5.1.0-beta.1 adds --last-failed and --since-last-run flags","path":"/release/rel_3Ti9APFB8QBxqHwWI_iQK-last-failed-and-since-last-run-target-test-reruns","url":"https://github.com/vitest-dev/vitest/releases/tag/v5.1.0-beta.1","org":{"slug":"vitest","name":"Vitest","avatarUrl":"https://media.releases.sh/orgs/vitest.jpg","githubHandle":"vitest-dev"},"product":null,"importance":3,"composition":{"bugs":7,"features":9,"enhancements":2},"publishedAt":"2026-10-19T16:42:33.000Z"}]},{"heading":"pnpm rethinks configuration and reproducibility","anchor":"pnpm-rethinks-configuration-and-reproducibility","lede":"pnpm's 12.15.0 gives pnpm-workspace.yaml a delegation mechanism, letting workspace settings and config dependencies live in other files via include — the kind of change that matters in monorepos where a single flat workspace file has grown unwieldy.","releaseIds":["rel_UldQW-GW8uisWNb3ADCt0"],"releases":[{"id":"rel_UldQW-GW8uisWNb3ADCt0","title":"pnpm 12.15.0","path":"/release/rel_UldQW-GW8uisWNb3ADCt0-pnpm-12-15-0","url":"https://pnpm.io/blog/releases/12.15.0","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-21T00:00:00.000Z"}]},{"heading":"Turborepo and Bun round out the fixes","anchor":"turborepo-and-bun-round-out-the-fixes","lede":"Turborepo cleaned up several sharp edges: pnpm batch-shim shutdown hangs on Windows are gone, cached symlinks are now restored when outputs already exist on disk, and hashing got more faithful through git text=auto binary detection, alongside fixes to affected-detection and lockfile parsing.","releaseIds":["rel_ww9oMI_Sl1gPouUiZs-rd","rel_393a1sKtf6ZNwXcyE3k_O"],"releases":[{"id":"rel_ww9oMI_Sl1gPouUiZs-rd","title":"Turborepo v2.11.10 fixes pnpm Windows shutdown hangs and cache symlink restore","path":"/release/rel_ww9oMI_Sl1gPouUiZs-rd-pnpm-windows-shutdown-hangs-fixed-cached-symlinks-restored","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.10","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2,"composition":{"bugs":10,"features":1,"enhancements":0},"publishedAt":"2026-10-20T20:36:23.000Z"},{"id":"rel_393a1sKtf6ZNwXcyE3k_O","title":"Bun v1.4.4 release","path":"/release/rel_393a1sKtf6ZNwXcyE3k_O-bun-v1-4-4-release","url":"https://github.com/oven-sh/bun/releases/tag/bun-v1.4.4","org":{"slug":"bun","name":"Bun","avatarUrl":"https://media.releases.sh/orgs/bun.png","githubHandle":"oven-sh"},"product":null,"importance":1,"composition":null,"publishedAt":"2026-10-22T10:11:32.000Z"}]}]}}