Summary
The release prevents dependency executables from taking over another package’s POSIX bin shim and requires HTTPS for GitHub server URLs except on loopback hosts. It also improves installs, peer-dependency resolution, Python lockfile reuse, workspace performance and several platform-specific behaviours.
Why it matters
The fixes address supply-chain and credential risks in a widely used JavaScript package manager while improving reproducibility in polyglot repositories.
Related coverage
- Claude Code 2.1.271 adds remote fast mode and tighter agent controls
- Next.js 16.4 canary.31 fixes proxy detection and Turbopack shutdown handling
- Cline SDK 0.0.83 introduces hub-managed Agent Plugins