The npm.jsr.io domain was added to the package registry allowlist, enabling resolution of JSR (JavaScript Registry) packages alongside npm and PyPI.
Evidence
Domain allowlist (search for "npm.jsr.io") — Wo7
Strings lifted out of the shipped bundle, so the claim above can be checked against them.