- pnpm install now fails on tarball integrity mismatches by default, requiring an explicit opt‑in flag to update checksums
- Added security hardening: rejects non‑SHA git commits, malicious .patch files, and dependency aliases with path traversal, and pins unscoped per‑registry credentials to their original registry source
- Fixed several bugs: abbreviated metadata handling with minimumReleaseAge, workspace root detection with prefix, and other minor edge‑case issues