- Lockfiles now store a `gitHosted: true` flag and tarball integrity for Git‑hosted dependencies, preventing tampered or substituted tarballs on install.
- Fixed a regression in `pnpm recursive` filters where a negative filter inadvertently included the workspace root; the root is now excluded by default.