- pnpm self‑update now resolves and verifies downloads using registry, authentication, proxy and TLS settings from trusted non‑project configuration, and project config can no longer redirect or disable verification.
- Update notifications now suggest `pnpm self update` or the standalone install script, including when running under Corepack, removing outdated Corepack guidance.
- adm‑zip upgraded to v0.6.0 fixing a memory‑exhaustion vulnerability; embedded Node.js release keys and npm registry signing keys refreshed.
