- Block git‑hosted dependencies from running prepare scripts and add blockExoticSubdeps to restrict exotic protocols in transitive deps, enhancing supply‑chain security.
- Compute integrity hashes for HTTP tarball dependencies and normalize tarball URLs in the lockfile to prevent tampering and ensure reproducible installs.
- Introduce allowBuilds field for unified script permission management and add dry‑run support to the pack command.