lockfile

• CVE-2026-55698 - pnpm env lockfile short-circuit 2026-06-27
• GHSA-qrv3-253h-g69c - pnpm configDependencies symlink traversal 2026-06-27