fix(deps): move pnpm overrides to pnpm-workspace.yaml

[JohnMcLear]

The problem

The recent dependency sweep added pnpm.overrides to package.json to clear the js-yaml / brace-expansion advisories, and regenerated the lockfile with pnpm 10.

pnpm 11 no longer reads the pnpm field from package.json. It warns and ignores it:

The "pnpm" field in package.json is no longer read by pnpm ... "pnpm.overrides"

CI's publish job runs pnpm 11, so it sees no overrides while the lockfile records them, and the frozen install aborts:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides" configuration
doesn't match the value found in the lockfile

The publish job dies in its "Bump version (patch)" step, so this plugin cannot release at all until this is fixed.

The fix

The dependency pins themselves are correct — only their location was wrong. This PR moves them, byte-for-byte unchanged, from package.json into pnpm-workspace.yaml, which both pnpm 10 and pnpm 11 read.

Verification

• npx -y pnpm@11 i --frozen-lockfile → Done in 388ms using pnpm v11.27.1
• pnpm i --frozen-lockfile with pnpm 10.33.0 → Done in 770ms using pnpm v10.33.0
• The lockfile was regenerated with pnpm 11 and lockfileVersion: '9.0' is unchanged, so the lint job (pinned to pnpm 10) still works.
• Patched versions survive: no js-yaml@4.1.1 / brace-expansion@1.1.14 anywhere in the lockfile.
• pnpm run lint → 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Move pnpm overrides to workspace configuration

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Moves dependency overrides to the pnpm 11-compatible workspace configuration.
• Preserves scoped security pins for js-yaml and brace-expansion.
• Restores frozen installs across pnpm 10 and 11 release workflows.

Diagram

graph TD
  P10["pnpm 10"] --> W["Workspace overrides"] --> L["Lockfile settings"] --> I["Frozen install"]
  P11["pnpm 11"] --> W

Loading

High-Level Assessment

The PR uses pnpm's canonical cross-version override location and keeps the security pins unchanged. Pinning publish jobs to pnpm 10 would only defer migration and leave future pnpm 11 installs vulnerable to the same configuration mismatch.

Files changed (2) +10 / -6

Bug fix (1) +0 / -6

package.jsonRemove deprecated package-level pnpm overrides +0/-6

Remove deprecated package-level pnpm overrides

• Removes the 'pnpm.overrides' block that pnpm 11 no longer reads. Package metadata, scripts, and dependency declarations remain unchanged.

package.json

Other (1) +10 / -0

pnpm-workspace.yamlDefine dependency overrides in workspace configuration +10/-0

Define dependency overrides in workspace configuration

• Adds the existing major-scoped js-yaml and brace-expansion overrides at the workspace level, which both pnpm 10 and 11 support. Comments document the transitive dependency constraints and frozen-lockfile compatibility requirement.

pnpm-workspace.yaml