fix(deps): move pnpm overrides to pnpm-workspace.yaml

[JohnMcLear]

Problem

The recent dependency sweep put the js-yaml / brace-expansion overrides into the
pnpm.overrides field of package.json, and regenerated the lockfile with pnpm 10.

pnpm 11 no longer reads the pnpm field from package.json. It warns:

The "pnpm" field in package.json is no longer read by pnpm ... "pnpm.overrides"

and then ignores it. CI's publish job runs pnpm 11, so it sees no overrides while
the lockfile records them, and the frozen install aborts:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides" configuration
doesn't match the value found in the lockfile

The publish job dies in its "Bump version (patch)" step, so this plugin cannot
release at all until this is fixed. The dependency fix itself is correct — only
its location was wrong.

Fix

Move the overrides verbatim from package.json into pnpm-workspace.yaml, which
pnpm 11 does read. The override values are unchanged, and so is the lockfile
(lockfileVersion: '9.0'), so the lint job's pinned pnpm 10 still works.

Verification

• npx -y pnpm@11 install → lockfile unchanged, still lockfileVersion: '9.0'
• npx -y pnpm@11 i --frozen-lockfile → succeeds
• pnpm i --frozen-lockfile with pnpm 10.33.0 → succeeds
• The patched transitive versions survive: no js-yaml@4.1.1 or
  brace-expansion@1.1.14 in the lockfile
• pnpm run lint → 0 errors

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Move pnpm overrides to workspace configuration

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Relocates transitive dependency overrides to pnpm 11’s supported workspace configuration.
• Restores frozen installs and releases while preserving pnpm 10 lockfile compatibility.

Diagram

graph TD
  M["package.json"] -->|package metadata| P["pnpm 10/11"] -->|validates| V{"Config matches?"} -->|yes| I["Frozen install"] --> R["Publish job"]
  W["pnpm-workspace.yaml"] -->|overrides| P
  L["pnpm-lock.yaml"] -->|resolved config| V

Loading

High-Level Assessment

The PR uses pnpm’s supported workspace-level override location while preserving the existing selectors and lockfile. Pinning every workflow to pnpm 10 was considered but would retain deprecated configuration and leave releases vulnerable to future pnpm upgrades.

Files changed (2) +10 / -6

Bug fix (1) +10 / -0

pnpm-workspace.yamlDefine dependency overrides in pnpm workspace configuration +10/-0

Define dependency overrides in pnpm workspace configuration

• Adds the existing scoped overrides for 'js-yaml' and 'brace-expansion' in the location supported by pnpm 11. Comments document the transitive dependency constraints and frozen-lockfile mismatch being prevented.

pnpm-workspace.yaml

Other (1) +0 / -6

package.jsonRemove deprecated package-level pnpm overrides +0/-6

Remove deprecated package-level pnpm overrides

• Removes the 'pnpm.overrides' block that pnpm 11 ignores. Package dependencies and scripts remain unchanged.

package.json