fix(deps): move pnpm overrides to pnpm-workspace.yaml

[JohnMcLear]

Problem

The recent dependency sweep added pnpm.overrides to package.json (to clear the js-yaml / brace-expansion advisories) and regenerated the lockfile with pnpm 10.

pnpm 11 no longer reads the pnpm field from package.json. It warns:

The "pnpm" field in package.json is no longer read by pnpm ... "pnpm.overrides"

CI's publish job runs pnpm 11, so it sees no overrides while the lockfile records them, and the frozen install aborts:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides" configuration
doesn't match the value found in the lockfile

The publish job dies in its "Bump version (patch)" step, so this plugin cannot release at all until this is fixed. The dependency fix itself was right; only its location was wrong.

Fix

• Remove the pnpm key from package.json.
• Put the same overrides, values unchanged, in pnpm-workspace.yaml, where pnpm 11 reads them, with a comment explaining why the selectors are scoped to a major line and why they can't live in package.json any more.

Verification

• pnpm-lock.yaml is byte-for-byte unchanged — still lockfileVersion: '9.0', so the lint job (pinned to pnpm 10) keeps working.
• npx -y pnpm@11 i --frozen-lockfile → succeeds
• pnpm i --frozen-lockfile with pnpm 10 → succeeds
• Patched versions survive: js-yaml@4,js-yaml@4.3.2 and brace-expansion@1,brace-expansion@1.1.21 brace-expansion@5.0.12 (no js-yaml@4.1.1, no brace-expansion@1.1.14).
• pnpm run lint → 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Restore pnpm 11 frozen installs with workspace-level overrides

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Relocates scoped transitive dependency overrides to pnpm 11’s supported workspace configuration.
• Restores frozen installs and publishing without changing resolved dependency versions.
• Documents major-scoped selectors and pnpm 10/11 compatibility requirements.

Diagram

graph TD
  A["pnpm-workspace.yaml"] --> B["Scoped overrides"] --> C{"Config matches lockfile"}
  D["pnpm-lock.yaml"] --> C
  C -->|Yes| E["Frozen install"] --> F["CI publish"]

Loading

High-Level Assessment

The chosen approach is optimal because pnpm-workspace.yaml is the supported override location for pnpm 11 while remaining compatible with pnpm 10 and the existing lockfile. Pinning publishing to pnpm 10 would defer compatibility, while removing the security overrides or regenerating resolutions would weaken the dependency fix or introduce unnecessary lockfile churn.

Files changed (2) +10 / -6

Bug fix (1) +0 / -6

package.jsonRemove deprecated package-level pnpm overrides +0/-6

Remove deprecated package-level pnpm overrides

• Removes the pnpm.overrides field that pnpm 11 no longer reads, preventing package metadata from conflicting with the lockfile configuration.

package.json

Other (1) +10 / -0

pnpm-workspace.yamlDefine scoped overrides in the pnpm workspace configuration +10/-0

Define scoped overrides in the pnpm workspace configuration

• Adds the unchanged js-yaml 4.x and brace-expansion 1.x overrides in pnpm’s supported workspace configuration. Comments explain the major-version scoping and pnpm 11 lockfile mismatch failure.

pnpm-workspace.yaml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗