TAG
#lockfiles
Stories connected through a shared idea, actor, technology or theme.
pnpm 12.8 warns about accidental environment-file publicationPackage packing and publishing now flag `.env` and `.env.*` files that are not explicitly listed in package metadata. The release also records pnpmfile checksums in pnpr lockfiles and avoids running unapproved build scripts while preparing certain git dependencies.→Microsoft APM 0.29.1 hardens agent package managementAPM 0.29.1 adds support for catalog-only marketplace plugins and improves diagnostics for malformed executable trust configuration. It also fixes staging cleanup, plugin hooks during reinstall, private cache authentication, deterministic lockfiles and MCP dependency resolution.→pnpm 12.3 adds trust-policy checks and native global-command shimspnpm 12.3 adds trust-policy flags to pnpm remove and pnpm update, verifying the lockfile against active policies. It also makes context-aware global commands such as node, deno, bun and pnpm-added shims native executables on every platform and improves local and tarball installs.→pnpm 12 makes dependency resolution and runtime selection more deterministicpnpm 12 canonicalises known-host Git dependencies to HTTPS identities, makes peer-dependency cycle breaking deterministic and fails or warns on unrecognised workspace settings instead of silently ignoring them. It adds project-aware shims for pinned runtimes, can provision other package managers and introduces an opt-in signed remote side-effects cache.→