Summary

Package packing and publishing now flag .env and .env.* files that are not explicitly listed in package metadata. The release also records pnpmfile checksums in pnpr lockfiles and avoids running unapproved build scripts while preparing certain git dependencies.

Why it matters

The changes address two practical supply-chain risks: accidentally publishing secrets and accepting dependency state that no longer matches the lockfile.

Sources