- Added a lockfile‑only flag to `pnpm list` and improved handling of aliased packages and Node.js mirror URLs.
- Changed self‑update to always fetch the plain pnpm package from the configured registry and drop the @pnpm/exe fallback, affecting v11+ installs.
- Installation now aborts when an optional dependency fails a trust‑policy check, enhancing security.