Summary & Key Takeaways ​

• A new global --env-file flag allows loading environment variables from dotenv-style files.
• pnpm can now update symlinked pnpm-lock.yaml files.
• The pnpm setup command gains a --no-modify-path option for manual PATH configuration.
• Two security vulnerabilities related to zstd decompression and signing have been fixed.
• Improved error handling for dependency symlinks that fail to resolve.

Our Commentary ​

The --env-file flag is a nice quality-of-life improvement for managing configurations. Symlinked lockfile updates are a niche but welcome fix for specific setups. The security patches are, of course, the most critical part here. It's good to see pnpm staying on top of these things.