pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
npm pnpm · Upgrade to 11.8.0 or 10.34.4 by release line · < 10.34.4; >= 11.0.0, < 11.8.0 · CVE-2026-59195 · GHSA-qrv3-253h-g69c · amended