- Prevent crafted lockfile or scoped package names from causing path‑traversal writes outside the virtual store (security fix).
- Fix self‑updating to pnpm v12: relink native binary correctly and verify its registry signature before execution.
- Stop expanding ${...} placeholders in proxy settings from workspace yaml, applying registry‑level protection.