- Introduce registry‑qualified keys for packages from named registries to prevent substitution attacks, requiring a lockfile diff and coordinated upgrade
- Add security hardening: rebuild now rejects lockfiles with path‑traversal package names and fix proxy configuration errors
- Improve dependency‑resolution performance and fix assorted bugs such as tarball URL matching and proxy handling