fix(deps): move pnpm overrides to pnpm-workspace.yaml

[JohnMcLear]

Problem

The recent dependency sweep added pnpm.overrides to package.json to clear the js-yaml / brace-expansion advisories, and regenerated the lockfile with pnpm 10.

pnpm 11 no longer reads the pnpm field from package.json. It warns:

The "pnpm" field in package.json is no longer read by pnpm … "pnpm.overrides"

…and ignores it. CI's publish job runs pnpm 11, so it sees no overrides while the lockfile still records them, and the frozen install aborts:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides" configuration
doesn't match the value found in the lockfile

The publish job dies in its "Bump version (patch)" step, so no release can go out until this is fixed.

Fix

Move the overrides verbatim from package.json into pnpm-workspace.yaml, which both pnpm 10 (the lint job) and pnpm 11 (the publish job) read. The dependency fix itself was right; only its location was wrong.

Verification

• npx -y pnpm@11 install → lockfile unchanged, lockfileVersion: '9.0' preserved
• npx -y pnpm@11 i --frozen-lockfile → succeeds (Done in 571ms using pnpm v11.27.1)
• pnpm i --frozen-lockfile with pnpm 10.33.0 → succeeds (Done in 1s using pnpm v10.33.0)
• No js-yaml@4.1.1 / brace-expansion@1.1.14 in the lockfile; js-yaml@4.3.2 and brace-expansion@1.1.21 present
• pnpm run lint → 0 errors

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Move pnpm overrides to the pnpm 11-compatible workspace config

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Moves security overrides to the configuration location supported by pnpm 10 and 11.
• Restores frozen installs and unblocks the release publishing workflow.
• Preserves patched transitive dependency versions without changing the lockfile.

Diagram

graph TD
  P10["pnpm 10"] --> W["Workspace config"] --> L["Lockfile overrides"] --> I["Frozen install"] --> C["Publish job"]
  P11["pnpm 11"] --> W

Loading

High-Level Assessment

The PR uses the canonical configuration location supported by both pnpm 10 and pnpm 11. Duplicating overrides or changing CI package-manager versions would introduce drift or defer the compatibility issue, so the relocation is the lowest-risk approach.

Files changed (2) +10 / -6

Bug fix (1) +10 / -0

pnpm-workspace.yamlDefine dependency overrides in workspace configuration +10/-0

Define dependency overrides in workspace configuration

• Adds scoped overrides for 'js-yaml' and 'brace-expansion@1' in the location recognized by pnpm 10 and 11. Comments document the transitive dependency constraints and frozen-lockfile compatibility requirement.

pnpm-workspace.yaml

Other (1) +0 / -6

package.jsonRemove legacy package-level pnpm overrides +0/-6

Remove legacy package-level pnpm overrides

• Removes the 'pnpm.overrides' block that pnpm 11 no longer reads. Dependency declarations and package metadata remain unchanged.

package.json

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗