- Added frozenStore mode to run installs against a read‑only package store, with clear errors for missing builds and node version requirements; incompatible with force and pnpr server.
- Introduced a batch publish flag for recursive publishing, sending all packages in a single request and handling unsupported registries gracefully.
- Implemented lockfile validation that rejects path‑traversal and reserved aliases, tightening security against crafted lockfiles; also added per‑scope auth tokens and delegated Rust pacquet resolution as optional features.
