fix(deps): move pnpm overrides to pnpm-workspace.yaml

[JohnMcLear]

Problem

The recent dependency sweep added pnpm.overrides to package.json to clear the js-yaml / brace-expansion advisories, and regenerated the lockfile with pnpm 10.

pnpm 11 no longer reads the pnpm field from package.json. It warns:

The "pnpm" field in package.json is no longer read by pnpm … "pnpm.overrides"

…and ignores it. CI's publish job runs pnpm 11, so it sees no overrides while the lockfile still records them, and the frozen install aborts:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides" configuration
doesn't match the value found in the lockfile

The publish job dies in its "Bump version (patch)" step, so no release can go out until this is fixed.

Fix

Move the overrides verbatim from package.json into pnpm-workspace.yaml, which both pnpm 10 (the lint job) and pnpm 11 (the publish job) read. The dependency fix itself was right; only its location was wrong.

Verification

• npx -y pnpm@11 install → lockfile unchanged, lockfileVersion: '9.0' preserved
• npx -y pnpm@11 i --frozen-lockfile → succeeds (Done in 574ms using pnpm v11.27.1)
• pnpm i --frozen-lockfile with pnpm 10.33.0 → succeeds (Done in 1.1s using pnpm v10.33.0)
• No js-yaml@4.1.1 / brace-expansion@1.1.14 in the lockfile; js-yaml@4.3.2 and brace-expansion@1.1.21 present
• pnpm run lint → 0 errors

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Move pnpm overrides to the pnpm 11-compatible workspace config

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Relocates dependency overrides to the configuration read by pnpm 10 and 11.
• Restores frozen publish installs while preserving patched transitive dependency versions.

Diagram

graph TD
  M["Package manifest"] -->|"move overrides"| W["Workspace config"] --> K["Frozen lockfile"] --> D["Patched dependencies"]
  L["pnpm 10 lint"] --> W
  P["pnpm 11 publish"] --> W

Loading

High-Level Assessment

The workspace-level configuration is the appropriate approach because it is natively supported by both pnpm 10 and 11 and preserves one lockfile across CI jobs. Pinning publishing to pnpm 10 would only defer migration and retain reliance on a deprecated configuration location.

Files changed (2) +10 / -6

Bug fix (1) +0 / -6

package.jsonRemove deprecated package-level pnpm overrides +0/-6

Remove deprecated package-level pnpm overrides

• Removes the 'pnpm.overrides' field that pnpm 11 ignores, preventing the manifest from presenting a configuration inconsistent with the lockfile.

package.json

Other (1) +10 / -0

pnpm-workspace.yamlDefine transitive dependency overrides in workspace configuration +10/-0

Define transitive dependency overrides in workspace configuration

• Adds scoped overrides for js-yaml 4.x and brace-expansion 1.x in the configuration recognized by pnpm 10 and 11. Comments document the security rationale, major-version constraints, and frozen-lockfile compatibility requirement.

pnpm-workspace.yaml