fix(deps): move pnpm overrides to pnpm-workspace.yaml

[JohnMcLear]

Problem

The recent dependency sweep added pnpm.overrides to package.json to clear the js-yaml / brace-expansion advisories, and regenerated the lockfile with pnpm 10.

pnpm 11 no longer reads the pnpm field from package.json. It warns:

The "pnpm" field in package.json is no longer read by pnpm … "pnpm.overrides"

…and ignores it. CI's publish job runs pnpm 11, so it sees no overrides while the lockfile still records them, and the frozen install aborts:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides" configuration
doesn't match the value found in the lockfile

The publish job dies in its "Bump version (patch)" step, so no release can go out until this is fixed.

Fix

Move the overrides verbatim from package.json into pnpm-workspace.yaml, which both pnpm 10 (the lint job) and pnpm 11 (the publish job) read. The dependency fix itself was right; only its location was wrong.

Verification

• npx -y pnpm@11 install → lockfile unchanged, lockfileVersion: '9.0' preserved
• npx -y pnpm@11 i --frozen-lockfile → succeeds (Done in 510ms using pnpm v11.27.1)
• pnpm i --frozen-lockfile with pnpm 10.33.0 → succeeds (Done in 1.1s using pnpm v10.33.0)
• No js-yaml@4.1.1 / brace-expansion@1.1.14 in the lockfile; js-yaml@4.3.2 and brace-expansion@1.1.21 present
• pnpm run lint → 0 errors

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Restore pnpm 11 installs by relocating dependency overrides

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Relocates transitive dependency overrides to pnpm's version-compatible workspace configuration.
• Restores frozen pnpm 11 installs while preserving patched dependency resolutions.

Diagram

graph TD
  W["pnpm-workspace.yaml"] --> P10["pnpm 10"] --> L["Lockfile validation"]
  W --> P11["pnpm 11"] --> L
  L --> C["Lint job"]
  L --> R["Publish job"]

Loading

High-Level Assessment

The PR uses pnpm's canonical cross-version override location and preserves the existing lockfile resolutions. Pinning the publish workflow to pnpm 10 would only defer pnpm 11 compatibility, while regenerating the lockfile would not correct the configuration mismatch.

Files changed (2) +10 / -6

Bug fix (1) +0 / -6

package.jsonRemove package-level pnpm overrides +0/-6

Remove package-level pnpm overrides

• Removes the 'pnpm.overrides' field that pnpm 11 ignores. Package metadata and dependency declarations remain unchanged.

package.json

Other (1) +10 / -0

pnpm-workspace.yamlDefine dependency overrides in workspace configuration +10/-0

Define dependency overrides in workspace configuration

• Adds the existing scoped 'js-yaml' and 'brace-expansion' overrides where pnpm 10 and 11 both read them. Comments document the transitive dependency constraints and frozen-lockfile mismatch prevented by this placement.

pnpm-workspace.yaml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Frozen-install failures can recur 📘 Rule violation ▣ Testability

Description

pnpm-workspace.yaml relocates the overrides, but the changeset adds no automated test that runs a
pnpm 11 frozen install against this configuration. A later override-placement or lockfile change can
recreate the mismatch without a dedicated regression case covering the release-blocking scenario.

Code

pnpm-workspace.yaml[R8-10]

+overrides:
+  js-yaml: '^4.3.2'
+  brace-expansion@1: '^1.1.16'

Evidence

PR Compliance ID 565662 requires every bug fix to include a modified or new automated regression
test in the same changeset. The diff only changes dependency configuration, including the relocated
overrides at pnpm-workspace.yaml lines 8-10, and contains no test change covering the documented
pnpm 11 frozen-install failure.

Rule 565662: Require regression test in same changeset for every bug fix
pnpm-workspace.yaml[8-10]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The bug fix moves dependency overrides so pnpm 11 frozen installs succeed, but no automated regression test in this changeset exercises the previously failing scenario.
## Fix Focus Areas
- pnpm-workspace.yaml[8-10]
## Recommended Fix
Add an automated test or CI check that runs pnpm 11 with `--frozen-lockfile` against the committed workspace configuration and lockfile. Ensure the check fails against the pre-fix placement in `package.json` and succeeds with the overrides in `pnpm-workspace.yaml`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

1. Frozen-install failures can recur 📘 Rule violation ▣ Testability

pnpm-workspace.yaml relocates the overrides, but the changeset adds no automated test that runs a
pnpm 11 frozen install against this configuration. A later override-placement or lockfile change can
recreate the mismatch without a dedicated regression case covering the release-blocking scenario.

Agent Prompt

## Issue description
The bug fix moves dependency overrides so pnpm 11 frozen installs succeed, but no automated regression test in this changeset exercises the previously failing scenario.

## Fix Focus Areas
- pnpm-workspace.yaml[8-10]

## Recommended Fix
Add an automated test or CI check that runs pnpm 11 with `--frozen-lockfile` against the committed workspace configuration and lockfile. Ensure the check fails against the pre-fix placement in `package.json` and succeeds with the overrides in `pnpm-workspace.yaml`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools