oUpdate 0.2.6

Security release. Upgrade from 0.2.5 or earlier.

Review

• Package entries resolve the way Node resolves them: main, bin, exports and imports conditions, directory indexes, extensionless and .js specifiers, and bare names that load a bundled node_modules copy in the same artifact.
• An unchanged file that the new release newly loads is shown in full. Imports are parsed with Bun's transpiler, so comments, regexes, templates, string concatenation, re-exports, require.resolve and Worker URLs do not hide a load, and the walk follows newly reached files until it meets what the old release already loaded. A file the parser rejects holds.
• A package.json change that only retargets an entry at an existing, unchanged file is reviewed: the file it now points at is shown.
• Install hooks: a new install hook holds and is shown. Hook text is read after $npm_package_* substitution and through every npm run, run-script, run-s and run-p script it names; node -e, --eval, -p and sh -c / bash -c bodies are read again, and --require, -r and --import paths are files the hook runs.
• A source map named by a concatenated literal path is shown whole.
• Artifact placement is indexed once per map, so large merged diffs review faster.