--- collection: js-toolchain collection_name: JavaScript Runtimes & Tooling week_start: 2026-10-26 title: pnpm hardens installs and globals while Turborepo tightens cache correctness release_count: 6 generated: 2026-11-02 canonical: https://releases.sh/collections/js-toolchain/digest/2026-10-26 --- # pnpm hardens installs and globals while Turborepo tightens cache correctness pnpm shipped five releases spanning two majors, closing two security holes, adding dotenv-style env loading and global peer checks, and fixing globals, packaging, and Docker permissions; Turborepo, meanwhile, went after cache hashing correctness. ### pnpm's security and install-integrity week pnpm spent the week closing holes and shoring up trust in what actually lands on disk. Two vulnerabilities got patched: a registry response with too many content encodings could crash the client — now fixed via an undici bump in [the crash-hardening patch](https://pnpm.io/blog/releases/11.28.9) — and [zstd decompression and signing flaws were closed](https://pnpm.io/blog/releases/12.16.0) alongside several features. Install correctness got equal attention: [repeat installs now notice changes to local dependencies](https://pnpm.io/blog/releases/12.17.0) instead of quietly reusing stale state, the install worker pool [sizes itself by the container's CPU quota](https://pnpm.io/blog/releases/11.28.9) so CI boxes behave, and workspaces that mix in Cargo crates [no longer hang on a cold store](https://pnpm.io/blog/releases/12.16.1). ### Globals, stores, and packaging Global installs had a rough patch and got cleaned up. Globally installed commands [now find the dependencies they were hoisted with](https://pnpm.io/blog/releases/11.28.10), and `pnpm peers check` [grew a `--global` flag](https://pnpm.io/blog/releases/12.17.0) so you can audit peer warnings on globally installed packages after an update. A nastier footgun is gone too: [store prune no longer wipes sibling stores](https://pnpm.io/blog/releases/11.28.10) when `cacheDir` points at their parent directory. On the publishing side, [pnpm pack respects `files` exclusions by name](https://pnpm.io/blog/releases/12.16.1) the way npm does, so a `!dist/index.js` entry stays excluded even when globs would otherwise pull it in. ### Config and environment ergonomics The feature work landed in [the minor release that also fixed a Docker permission bug](https://pnpm.io/blog/releases/12.17.0): a repeatable global `--env-file` flag loads dotenv-style files before any command runs, with later files overriding earlier ones and existing environment variables preserved. The same line of releases [symlinks pnpm-lock.yaml in some cases](https://pnpm.io/blog/releases/12.16.0), adds `pnpm setup --no-modify-path` for people who manage their own shell config, and [adds dependency-group selectors and wildcards to `overrides`](https://pnpm.io/blog/releases/12.17.0). `pnpm outdated` and `pnpm update` also learned to report runtime, package-manager, Cargo, and Python versions, making them a broader staleness check than a JavaScript-only one. And [Docker images no longer ship files other users can't read](https://pnpm.io/blog/releases/12.17.0), which matters for anyone running installs as a non-root user. ### Turborepo tightens cache correctness Turborepo's canary focused narrowly on making the cache tell the truth. [Its cache-correctness work](https://github.com/vercel/turborepo/releases/tag/v2.11.11-canary.1) hashes symlink input contents within repository boundaries, Bun patch contents, tracked outputs used as task inputs, and executable permissions behind a future flag — the kind of detail that decides whether a cache hit is safe or silently wrong. Local restores got sturdier too: the restore manifest is written before returning, and cached symlinks are restored even when outputs already exist on disk. There's also a trust-side cleanup, distrusting a compromised intermediate certificate authority and scoping saved Vercel credentials to Vercel endpoints only. Together the week reads as maintenance with teeth: pnpm closed the gaps that bite in CI and shared hosts, and Turborepo attacked the class of bugs where a cache makes you faster and wrong at the same time. ## Releases covered ### pnpm - [pnpm 11.28.9](https://pnpm.io/blog/releases/11.28.9) - [pnpm 12.16.0](https://pnpm.io/blog/releases/12.16.0) - [pnpm 12.17.0](https://pnpm.io/blog/releases/12.17.0) - [pnpm 12.16.1](https://pnpm.io/blog/releases/12.16.1) - [pnpm 11.28.10](https://pnpm.io/blog/releases/11.28.10) ### Vercel - [Turborepo v2.11.11-canary.1 hardens cache hashing and local restore](https://github.com/vercel/turborepo/releases/tag/v2.11.11-canary.1)