- Security: stop expanding ${ENV_VAR} placeholders in repository‑controlled .npmrc and workspace.yaml, requiring tokens be moved to user/global config, and add signature verification for pnpm binaries, pacquet, self‑updates, and Node.js ru...
- Bugfixes and stability: restore globalconfig path, fix CLI flag parsing for color, respect enableGlobalVirtualStore, make peer deduplication deterministic, reject unsafe bin names and invalid tarball manifests, tighten lockfile verificat...
- Deprecation warning for $ version override syntax, encouraging catalog usage.
