A patch across the package-manager engine and the runtime.

Package manager

bundleDependencies are honored on the lockfile-restore install path. (#226)
The linker promotes the most-referenced version to the hoisted root slot, while a direct dependency still wins that slot over a transitive majority. (#227, #231)
Git deps resolve in the yarn-classic reader, fixing a 0.2.7 regression. (#228)
The no-integrity warm binding is keyed by registry URL in the global store. (#232)
No-downgrade trust validation now overlaps with the tarball fetch. (#230)

Runtime

When oxc rejects plain JavaScript that V8 tolerates, Nub falls back to the original source instead of failing. (#229, closes #225)

The full release notes list every change in this release.