fix(deps): move pnpm overrides to pnpm-workspace.yaml

[JohnMcLear]

Problem

The recent dependency sweep added pnpm.overrides to package.json to clear the js-yaml / brace-expansion advisories, and regenerated the lockfile with pnpm 10.

pnpm 11 no longer reads the pnpm field from package.json. It warns:

The "pnpm" field in package.json is no longer read by pnpm … "pnpm.overrides"

…and ignores it. CI's publish job runs pnpm 11, so it sees no overrides while the lockfile still records them, and the frozen install aborts:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides" configuration
doesn't match the value found in the lockfile

The publish job dies in its "Bump version (patch)" step, so no release can go out until this is fixed.

Fix

Move the overrides verbatim from package.json into pnpm-workspace.yaml, which both pnpm 10 (the lint job) and pnpm 11 (the publish job) read. The dependency fix itself was right; only its location was wrong.

Verification

• npx -y pnpm@11 install → lockfile unchanged, lockfileVersion: '9.0' preserved
• npx -y pnpm@11 i --frozen-lockfile → succeeds (Done in 427ms using pnpm v11.27.1)
• pnpm i --frozen-lockfile with pnpm 10.33.0 → succeeds (Done in 956ms using pnpm v10.33.0)
• No js-yaml@4.1.1 / brace-expansion@1.1.14 in the lockfile; js-yaml@4 and brace-expansion@1.1.21 present
• pnpm run lint → 0 errors

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Move pnpm overrides to workspace configuration

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Relocates transitive dependency overrides to pnpm's version-compatible workspace configuration.
• Restores frozen installs across pnpm 10 and 11, unblocking releases.

Diagram

graph TD
  A["pnpm 10/11"] -->|reads| B["Workspace config"] -->|defines| C["Override policy"] -->|matches| D["Lockfile"] -->|enables| E["Frozen install"] -->|unblocks| F["Publish job"]

Loading

High-Level Assessment

The chosen approach is optimal because pnpm-workspace.yaml is the canonical override location supported by both pnpm 10 and 11. Pinning publication to pnpm 10 or regenerating the lockfile without relocating the configuration would only defer or preserve the compatibility problem.

Files changed (2) +10 / -6

Bug fix (1) +10 / -0

pnpm-workspace.yamlDefine dependency overrides in pnpm workspace configuration +10/-0

Define dependency overrides in pnpm workspace configuration

• Adds major-scoped overrides for js-yaml and brace-expansion in the location supported by pnpm 10 and 11. Comments document the transitive dependency constraints and frozen-lockfile failure being prevented.

pnpm-workspace.yaml

Other (1) +0 / -6

package.jsonRemove deprecated package-level pnpm overrides +0/-6

Remove deprecated package-level pnpm overrides

• Removes the pnpm.overrides field that pnpm 11 ignores. Package metadata and scripts remain unchanged.

package.json