Summary & Key Takeaways ​

• Catalogs now resolve workspace dependencies using the workspace: protocol.
• pnpm remove and pnpm update gain new --trust-lockfile and --trust-policy options.
• A new pnpm change check command validates package versions against workspace policies.
• Fetch and tarball error logs now hide sensitive URL credentials.
• Fixed a race condition during config dependency updates that could redirect lockfile writes.
• pnpm audit --fix now correctly respects saveExact and savePrefix for overrides.
• pnpm audit now reports ignored advisories separately from vulnerability totals.
• Concurrent installs sharing a store no longer fail with ENOENT errors.

Our Commentary ​

We're always happy to see continuous improvements in our build tools. The workspace: protocol resolution is a nice touch for monorepo users. I'm particularly interested in the new trust-lockfile options; managing lockfile integrity can be a headache, so any tools to streamline that are welcome. The pnpm change check for CI validation also feels like a solid win for team workflows. Small releases like this often contain the most impactful DX improvements.