Summary & Key Takeaways ​

• Introduces the pnpm access command for managing package access and visibility on the registry.
• Allows allowBuilds entries for git-hosted packages to match by repository URL.
• Reduces peak memory usage during cold-cache dependency resolution by approximately 30%.
• Prevents crafted pnpm-lock.yaml files from writing package content outside the virtual store.
• Rejects symlinked pnpm-lock.yaml files to enhance security.

Our Commentary ​

This is a solid minor release. The memory optimization is a big win for large projects, and the security fixes are absolutely critical. I'm always a fan of tools that prioritize both performance and hardening. The pnpm access command also seems like a useful addition for managing private packages.