- Tarball integrity mismatches now cause a hard failure by default; a new opt‑in flag (pnpm install --update-checksums) mirrors Yarn's behavior for refreshing locked checksums.
- Security hardening added: reject malformed git commit fields, path‑traversal in dependency aliases, missing integrity in lockfile entries, unsafe patch files, and enforce engine version validation; also require provenance for trusted pub...
- Unscoped credentials are now automatically rescaled to URL‑scoped form with deprecation warnings, moving runtime defaults to devEngines.runtime and adding several bug fixes around deploy crashes, manifest reading limits, and lockfile han...
