fix(deps): move pnpm overrides to pnpm-workspace.yaml

[JohnMcLear]

Problem

The recent dependency sweep added pnpm.overrides to package.json (to clear the js-yaml / brace-expansion advisories) and regenerated the lockfile with pnpm 10.

pnpm 11 no longer reads the pnpm field from package.json. It warns:

The "pnpm" field in package.json is no longer read by pnpm ... "pnpm.overrides"

CI's publish job runs pnpm 11, so it sees no overrides while the lockfile records them, and the frozen install aborts:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides" configuration
doesn't match the value found in the lockfile

The publish job dies in its "Bump version (patch)" step, so this plugin cannot release at all until this is fixed. The dependency fix itself was right; only its location was wrong.

Fix

• Remove the pnpm key from package.json.
• Put the same overrides, values unchanged, in pnpm-workspace.yaml, where pnpm 11 reads them, with a comment explaining why the selectors are scoped to a major line and why they can't live in package.json any more.

Verification

• pnpm-lock.yaml is byte-for-byte unchanged — still lockfileVersion: '9.0', so the lint job (pinned to pnpm 10) keeps working.
• npx -y pnpm@11 i --frozen-lockfile → succeeds
• pnpm i --frozen-lockfile with pnpm 10 → succeeds
• Patched versions survive: js-yaml@4.3.2 and brace-expansion@1.1.21 (no js-yaml@4.1.1, no brace-expansion@1.1.14).
• pnpm run lint → 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Publish regressions can go undetected 📘 Rule violation ▣ Testability

Description

pnpm-workspace.yaml relocates the dependency overrides without adding or updating an automated
regression test for the frozen-install failure. A later configuration change can therefore recreate
the package-manager mismatch without being detected before the publish job runs.

Code

pnpm-workspace.yaml[R6-9]

+# pnpm 11 no longer reads `pnpm.overrides` from package.json — these must live
+# here or the lockfile and the install disagree (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH).
+overrides:
+  js-yaml@4: '^4.3.2'

Evidence

Rule 565552 requires every explicitly identified bug fix to add or update an automated test that
reproduces the corrected behavior. The PR changes only dependency configuration, and the cited
workspace configuration contains the fix for the pnpm 11 mismatch without any accompanying automated
regression-test change.

Rule 565552: Require regression test for every bug fix
pnpm-workspace.yaml[6-10]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
This bug fix moves dependency overrides so pnpm 11 can complete a frozen installation, but it adds no automated regression test for the previously failing publish path.
## Fix Focus Areas
- pnpm-workspace.yaml[6-10]
## Recommended Fix
Add an automated CI test that runs the supported pnpm 11 version with `install --frozen-lockfile` and verifies that the configured overrides agree with the lockfile. Name the test or job after the pnpm 11 override-location regression so it would fail against the pre-fix configuration.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

1. Publish regressions can go undetected 📘 Rule violation ▣ Testability

pnpm-workspace.yaml relocates the dependency overrides without adding or updating an automated
regression test for the frozen-install failure. A later configuration change can therefore recreate
the package-manager mismatch without being detected before the publish job runs.

Agent Prompt

## Issue description
This bug fix moves dependency overrides so pnpm 11 can complete a frozen installation, but it adds no automated regression test for the previously failing publish path.

## Fix Focus Areas
- pnpm-workspace.yaml[6-10]

## Recommended Fix
Add an automated CI test that runs the supported pnpm 11 version with `install --frozen-lockfile` and verifies that the configured overrides agree with the lockfile. Name the test or job after the pnpm 11 override-location regression so it would fail against the pre-fix configuration.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Move pnpm overrides to pnpm 11-compatible workspace configuration

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Relocates dependency overrides where pnpm 10 and 11 consistently read them.
• Restores frozen installs in release CI without changing resolved dependency versions.
• Documents major-scoped selectors that prevent incompatible transitive dependency upgrades.

Diagram

graph TD
  PUBLISH["Publish CI"] -->|"runs"| P11["pnpm 11"] -->|"reads"| CONFIG["Workspace overrides"] -->|"matches"| LOCK["Frozen lockfile"] -->|"resolves"| DEPS["Patched dependencies"]
  LINT["Lint CI"] -->|"runs"| P10["pnpm 10"] -->|"reads"| CONFIG

Loading

High-Level Assessment

The chosen approach is optimal because pnpm-workspace.yaml is the supported override location for pnpm 11 and remains compatible with pnpm 10. Pinning CI to one pnpm version or regenerating the lockfile would only mask the configuration mismatch and reduce cross-version compatibility.

Files changed (2) +10 / -6

Bug fix (1) +10 / -0

pnpm-workspace.yamlDefine major-scoped overrides in workspace configuration +10/-0

Define major-scoped overrides in workspace configuration

• Adds the unchanged js-yaml and brace-expansion overrides in pnpm's cross-version workspace configuration. Comments explain the transitive dependencies, major-line scoping, and frozen-lockfile mismatch avoided by this location.

pnpm-workspace.yaml

Other (1) +0 / -6

package.jsonRemove deprecated package-level pnpm overrides +0/-6

Remove deprecated package-level pnpm overrides

• Removes the 'pnpm.overrides' block that pnpm 11 no longer reads. Package metadata, scripts, and dependency declarations remain unchanged.

package.json