fix(deps): move pnpm overrides to pnpm-workspace.yaml

[JohnMcLear]

The problem

The recent dependency sweep added pnpm.overrides to package.json to clear the js-yaml / brace-expansion advisories, and regenerated the lockfile with pnpm 10.

pnpm 11 no longer reads the pnpm field from package.json. It warns and ignores it:

The "pnpm" field in package.json is no longer read by pnpm ... "pnpm.overrides"

CI's publish job runs pnpm 11, so it sees no overrides while the lockfile records them, and the frozen install aborts:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides" configuration
doesn't match the value found in the lockfile

The publish job dies in its "Bump version (patch)" step, so this plugin cannot release at all until this is fixed.

The fix

The dependency pins themselves are correct — only their location was wrong. This PR moves them, byte-for-byte unchanged, from package.json into pnpm-workspace.yaml, which both pnpm 10 and pnpm 11 read.

Verification

• npx -y pnpm@11 i --frozen-lockfile → Done in 395ms using pnpm v11.27.1
• pnpm i --frozen-lockfile with pnpm 10.33.0 → Done in 752ms using pnpm v10.33.0
• The lockfile was regenerated with pnpm 11 and lockfileVersion: '9.0' is unchanged, so the lint job (pinned to pnpm 10) still works.
• Patched versions survive: no js-yaml@4.1.1 / brace-expansion@1.1.14 anywhere in the lockfile.
• pnpm run lint → 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Move pnpm overrides to workspace configuration

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Relocates security overrides to the pnpm 10 and 11-compatible workspace configuration.
• Restores frozen installs and publishing without changing pinned dependency versions.

Diagram

graph TD
  W["pnpm-workspace.yaml"] --> P10["pnpm 10"] --> I["Frozen install"] --> R["Publish workflow"]
  W --> P11["pnpm 11"] --> I
  L["pnpm lockfile"] --> I

Loading

High-Level Assessment

The PR uses pnpm's supported cross-version configuration location and preserves the existing security pins, making it the appropriate minimal fix. Keeping overrides in package.json is incompatible with pnpm 11, while pinning CI to pnpm 10 would defer rather than resolve the compatibility issue.

Files changed (2) +10 / -6

Bug fix (1) +10 / -0

pnpm-workspace.yamlDefine dependency overrides in the pnpm workspace +10/-0

Define dependency overrides in the pnpm workspace

• Adds the unchanged js-yaml and brace-expansion security overrides in the configuration supported by pnpm 10 and 11. Comments document the scoped selectors and lockfile mismatch avoided by this placement.

pnpm-workspace.yaml

Other (1) +0 / -6

package.jsonRemove deprecated package-level pnpm overrides +0/-6

Remove deprecated package-level pnpm overrides

• Removes the pnpm override block that pnpm 11 no longer reads. Dependency declarations remain unchanged.

package.json