policy-bypass

• CVE-2026-55487 - pnpm allowBuilds identity spoof 2026-06-27
• CVE-2026-42274 - Heimdall policy interpretation bypass cluster 2026-05-08