{"collection":{"slug":"js-toolchain","name":"JavaScript Runtimes & Tooling"},"digest":{"id":"cwd_jrnVOS8Qt4G1y5UoWTtnu","weekStart":"2026-10-26","title":"pnpm hardens installs and globals while Turborepo tightens cache correctness","intro":"pnpm shipped five releases spanning two majors, closing two security holes, adding dotenv-style env loading and global peer checks, and fixing globals, packaging, and Docker permissions; Turborepo, meanwhile, went after cache hashing correctness.","body":"### pnpm's security and install-integrity week\n\npnpm spent the week closing holes and shoring up trust in what actually lands on disk. Two vulnerabilities got patched: a registry response with too many content encodings could crash the client — now fixed via an undici bump in [the crash-hardening patch](/release/rel_YPp6gPRRNIJlKLU_kNl_c-pnpm-11-28-9) — and [zstd decompression and signing flaws were closed](/release/rel_cuUjFHhWmPI-X2y2pLY-r-pnpm-12-16-0) alongside several features. Install correctness got equal attention: [repeat installs now notice changes to local dependencies](/release/rel_TpOIWSztXIVL24ernh9s--pnpm-12-17-0) instead of quietly reusing stale state, the install worker pool [sizes itself by the container's CPU quota](/release/rel_YPp6gPRRNIJlKLU_kNl_c-pnpm-11-28-9) so CI boxes behave, and workspaces that mix in Cargo crates [no longer hang on a cold store](/release/rel_aowyA0KOihhgCxcUz4Q9x-pnpm-12-16-1).\n\n### Globals, stores, and packaging\n\nGlobal installs had a rough patch and got cleaned up. Globally installed commands [now find the dependencies they were hoisted with](/release/rel_FxIpeIlvnYlw9lUN_URDa-pnpm-11-28-10), and `pnpm peers check` [grew a `--global` flag](/release/rel_TpOIWSztXIVL24ernh9s--pnpm-12-17-0) so you can audit peer warnings on globally installed packages after an update. A nastier footgun is gone too: [store prune no longer wipes sibling stores](/release/rel_FxIpeIlvnYlw9lUN_URDa-pnpm-11-28-10) when `cacheDir` points at their parent directory. On the publishing side, [pnpm pack respects `files` exclusions by name](/release/rel_aowyA0KOihhgCxcUz4Q9x-pnpm-12-16-1) the way npm does, so a `!dist/index.js` entry stays excluded even when globs would otherwise pull it in.\n\n### Config and environment ergonomics\n\nThe feature work landed in [the minor release that also fixed a Docker permission bug](/release/rel_TpOIWSztXIVL24ernh9s--pnpm-12-17-0): a repeatable global `--env-file` flag loads dotenv-style files before any command runs, with later files overriding earlier ones and existing environment variables preserved. The same line of releases [symlinks pnpm-lock.yaml in some cases](/release/rel_cuUjFHhWmPI-X2y2pLY-r-pnpm-12-16-0), adds `pnpm setup --no-modify-path` for people who manage their own shell config, and [adds dependency-group selectors and wildcards to `overrides`](/release/rel_TpOIWSztXIVL24ernh9s--pnpm-12-17-0). `pnpm outdated` and `pnpm update` also learned to report runtime, package-manager, Cargo, and Python versions, making them a broader staleness check than a JavaScript-only one. And [Docker images no longer ship files other users can't read](/release/rel_TpOIWSztXIVL24ernh9s--pnpm-12-17-0), which matters for anyone running installs as a non-root user.\n\n### Turborepo tightens cache correctness\n\nTurborepo's canary focused narrowly on making the cache tell the truth. [Its cache-correctness work](/release/rel_I59oVSQTHyKpA5PSvD1-3-turborepo-v2-11-11-canary-1-hardens-cache-hashing-and-local-restore) hashes symlink input contents within repository boundaries, Bun patch contents, tracked outputs used as task inputs, and executable permissions behind a future flag — the kind of detail that decides whether a cache hit is safe or silently wrong. Local restores got sturdier too: the restore manifest is written before returning, and cached symlinks are restored even when outputs already exist on disk. There's also a trust-side cleanup, distrusting a compromised intermediate certificate authority and scoping saved Vercel credentials to Vercel endpoints only.\n\nTogether the week reads as maintenance with teeth: pnpm closed the gaps that bite in CI and shared hosts, and Turborepo attacked the class of bugs where a cache makes you faster and wrong at the same time.","releaseIds":["rel_YPp6gPRRNIJlKLU_kNl_c","rel_cuUjFHhWmPI-X2y2pLY-r","rel_TpOIWSztXIVL24ernh9s-","rel_aowyA0KOihhgCxcUz4Q9x","rel_FxIpeIlvnYlw9lUN_URDa","rel_I59oVSQTHyKpA5PSvD1-3"],"releaseCount":6,"generatedAt":"2026-11-02T06:19:49.604Z","releases":[{"id":"rel_YPp6gPRRNIJlKLU_kNl_c","title":"pnpm 11.28.9","path":"/release/rel_YPp6gPRRNIJlKLU_kNl_c-pnpm-11-28-9","url":"https://pnpm.io/blog/releases/11.28.9","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-27T00:00:00.000Z"},{"id":"rel_cuUjFHhWmPI-X2y2pLY-r","title":"pnpm 12.16.0","path":"/release/rel_cuUjFHhWmPI-X2y2pLY-r-pnpm-12-16-0","url":"https://pnpm.io/blog/releases/12.16.0","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-27T00:00:00.000Z"},{"id":"rel_TpOIWSztXIVL24ernh9s-","title":"pnpm 12.17.0","path":"/release/rel_TpOIWSztXIVL24ernh9s--pnpm-12-17-0","url":"https://pnpm.io/blog/releases/12.17.0","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-30T00:00:00.000Z"},{"id":"rel_aowyA0KOihhgCxcUz4Q9x","title":"pnpm 12.16.1","path":"/release/rel_aowyA0KOihhgCxcUz4Q9x-pnpm-12-16-1","url":"https://pnpm.io/blog/releases/12.16.1","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-27T00:00:00.000Z"},{"id":"rel_FxIpeIlvnYlw9lUN_URDa","title":"pnpm 11.28.10","path":"/release/rel_FxIpeIlvnYlw9lUN_URDa-pnpm-11-28-10","url":"https://pnpm.io/blog/releases/11.28.10","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-30T00:00:00.000Z"},{"id":"rel_I59oVSQTHyKpA5PSvD1-3","title":"Turborepo v2.11.11-canary.1 hardens cache hashing and local restore","path":"/release/rel_I59oVSQTHyKpA5PSvD1-3-cache-hashing-fixes-for-symlinks-bun-patches-tracked-outputs","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.11-canary.1","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2,"composition":{"bugs":28,"features":3,"enhancements":5},"publishedAt":"2026-10-29T22:51:13.000Z"}],"sections":[{"heading":"pnpm's security and install-integrity week","anchor":"pnpms-security-and-install-integrity-week","lede":"pnpm spent the week closing holes and shoring up trust in what actually lands on disk.","releaseIds":["rel_YPp6gPRRNIJlKLU_kNl_c","rel_cuUjFHhWmPI-X2y2pLY-r","rel_TpOIWSztXIVL24ernh9s-","rel_aowyA0KOihhgCxcUz4Q9x"],"releases":[{"id":"rel_YPp6gPRRNIJlKLU_kNl_c","title":"pnpm 11.28.9","path":"/release/rel_YPp6gPRRNIJlKLU_kNl_c-pnpm-11-28-9","url":"https://pnpm.io/blog/releases/11.28.9","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-27T00:00:00.000Z"},{"id":"rel_cuUjFHhWmPI-X2y2pLY-r","title":"pnpm 12.16.0","path":"/release/rel_cuUjFHhWmPI-X2y2pLY-r-pnpm-12-16-0","url":"https://pnpm.io/blog/releases/12.16.0","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-27T00:00:00.000Z"},{"id":"rel_TpOIWSztXIVL24ernh9s-","title":"pnpm 12.17.0","path":"/release/rel_TpOIWSztXIVL24ernh9s--pnpm-12-17-0","url":"https://pnpm.io/blog/releases/12.17.0","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-30T00:00:00.000Z"},{"id":"rel_aowyA0KOihhgCxcUz4Q9x","title":"pnpm 12.16.1","path":"/release/rel_aowyA0KOihhgCxcUz4Q9x-pnpm-12-16-1","url":"https://pnpm.io/blog/releases/12.16.1","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-27T00:00:00.000Z"}]},{"heading":"Globals, stores, and packaging","anchor":"globals-stores-and-packaging","lede":"Global installs had a rough patch and got cleaned up.","releaseIds":["rel_FxIpeIlvnYlw9lUN_URDa","rel_TpOIWSztXIVL24ernh9s-","rel_aowyA0KOihhgCxcUz4Q9x"],"releases":[{"id":"rel_FxIpeIlvnYlw9lUN_URDa","title":"pnpm 11.28.10","path":"/release/rel_FxIpeIlvnYlw9lUN_URDa-pnpm-11-28-10","url":"https://pnpm.io/blog/releases/11.28.10","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-30T00:00:00.000Z"},{"id":"rel_TpOIWSztXIVL24ernh9s-","title":"pnpm 12.17.0","path":"/release/rel_TpOIWSztXIVL24ernh9s--pnpm-12-17-0","url":"https://pnpm.io/blog/releases/12.17.0","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-30T00:00:00.000Z"},{"id":"rel_aowyA0KOihhgCxcUz4Q9x","title":"pnpm 12.16.1","path":"/release/rel_aowyA0KOihhgCxcUz4Q9x-pnpm-12-16-1","url":"https://pnpm.io/blog/releases/12.16.1","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-27T00:00:00.000Z"}]},{"heading":"Config and environment ergonomics","anchor":"config-and-environment-ergonomics","lede":"The feature work landed in the minor release that also fixed a Docker permission bug: a repeatable global --env-file flag loads dotenv-style files before any command runs, with later files overriding earlier ones and existing environment variables preserved.","releaseIds":["rel_TpOIWSztXIVL24ernh9s-","rel_cuUjFHhWmPI-X2y2pLY-r"],"releases":[{"id":"rel_TpOIWSztXIVL24ernh9s-","title":"pnpm 12.17.0","path":"/release/rel_TpOIWSztXIVL24ernh9s--pnpm-12-17-0","url":"https://pnpm.io/blog/releases/12.17.0","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-30T00:00:00.000Z"},{"id":"rel_cuUjFHhWmPI-X2y2pLY-r","title":"pnpm 12.16.0","path":"/release/rel_cuUjFHhWmPI-X2y2pLY-r-pnpm-12-16-0","url":"https://pnpm.io/blog/releases/12.16.0","org":{"slug":"pnpm","name":"pnpm","avatarUrl":"https://media.releases.sh/orgs/pnpm.svg","githubHandle":"pnpm"},"product":null,"importance":null,"composition":null,"publishedAt":"2026-10-27T00:00:00.000Z"}]},{"heading":"Turborepo tightens cache correctness","anchor":"turborepo-tightens-cache-correctness","lede":"Turborepo's canary focused narrowly on making the cache tell the truth.","releaseIds":["rel_I59oVSQTHyKpA5PSvD1-3"],"releases":[{"id":"rel_I59oVSQTHyKpA5PSvD1-3","title":"Turborepo v2.11.11-canary.1 hardens cache hashing and local restore","path":"/release/rel_I59oVSQTHyKpA5PSvD1-3-cache-hashing-fixes-for-symlinks-bun-patches-tracked-outputs","url":"https://github.com/vercel/turborepo/releases/tag/v2.11.11-canary.1","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"turborepo","name":"Turborepo"},"importance":2,"composition":{"bugs":28,"features":3,"enhancements":5},"publishedAt":"2026-10-29T22:51:13.000Z"}]}]}}