fix(deps): move pnpm overrides to pnpm-workspace.yaml

[JohnMcLear]

Problem

The recent dependency sweep put the js-yaml / brace-expansion overrides into the
pnpm.overrides field of package.json, and regenerated the lockfile with pnpm 10.

pnpm 11 no longer reads the pnpm field from package.json. It warns:

The "pnpm" field in package.json is no longer read by pnpm ... "pnpm.overrides"

and then ignores it. CI's publish job runs pnpm 11, so it sees no overrides while
the lockfile records them, and the frozen install aborts:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides" configuration
doesn't match the value found in the lockfile

The publish job dies in its "Bump version (patch)" step, so this plugin cannot
release at all until this is fixed. The dependency fix itself is correct — only
its location was wrong.

Fix

Move the overrides verbatim from package.json into pnpm-workspace.yaml, which
pnpm 11 does read. The override values are unchanged, and so is the lockfile
(lockfileVersion: '9.0'), so the lint job's pinned pnpm 10 still works.

Verification

• npx -y pnpm@11 install → lockfile unchanged, still lockfileVersion: '9.0'
• npx -y pnpm@11 i --frozen-lockfile → succeeds
• pnpm i --frozen-lockfile with pnpm 10.33.0 → succeeds
• The patched transitive versions survive: no js-yaml@4.1.1 or
  brace-expansion@1.1.14 in the lockfile
• pnpm run lint → 0 errors

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Move pnpm overrides to workspace configuration

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Moves dependency overrides to the pnpm 11-compatible workspace configuration.
• Restores frozen installs and publishing without changing resolved dependency versions.
• Preserves compatibility with pnpm 10 and lockfile version 9.

Diagram

graph TD
  P10["pnpm 10"] --> W["Workspace config"] --> O["Scoped overrides"] --> L["Lockfile v9"] --> CI["Frozen CI install"]
  P11["pnpm 11"] --> W

Loading

High-Level Assessment

The PR uses pnpm 11's supported override location while retaining pnpm 10 compatibility and the existing lockfile. Pinning publishing to pnpm 10 would only defer the migration, while removing the overrides would reintroduce vulnerable transitive versions, so the relocation is the appropriate fix.

Files changed (2) +10 / -6

Bug fix (1) +10 / -0

pnpm-workspace.yamlDefine scoped dependency overrides in workspace configuration +10/-0

Define scoped dependency overrides in workspace configuration

• Adds the existing js-yaml and brace-expansion override ranges in the pnpm 11-supported workspace file. Comments document the transitive dependency constraints and lockfile mismatch prevented by this placement.

pnpm-workspace.yaml

Other (1) +0 / -6

package.jsonRemove unsupported package-level pnpm overrides +0/-6

Remove unsupported package-level pnpm overrides

• Removes the pnpm.overrides section that pnpm 11 ignores. Dependency declarations remain unchanged.

package.json