fix(deps): move pnpm overrides to pnpm-workspace.yaml

[JohnMcLear]

The problem

The recent dependency sweep added pnpm.overrides to package.json to clear the js-yaml / brace-expansion advisories, and regenerated the lockfile with pnpm 10.

pnpm 11 no longer reads the pnpm field from package.json. It warns and ignores it:

The "pnpm" field in package.json is no longer read by pnpm ... "pnpm.overrides"

CI's publish job runs pnpm 11, so it sees no overrides while the lockfile records them, and the frozen install aborts:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides" configuration
doesn't match the value found in the lockfile

The publish job dies in its "Bump version (patch)" step, so this plugin cannot release at all until this is fixed.

The fix

The dependency pins themselves are correct — only their location was wrong. This PR moves them, byte-for-byte unchanged, from package.json into pnpm-workspace.yaml, which both pnpm 10 and pnpm 11 read.

Verification

• npx -y pnpm@11 i --frozen-lockfile → Done in 397ms using pnpm v11.27.1
• pnpm i --frozen-lockfile with pnpm 10.33.0 → Done in 836ms using pnpm v10.33.0
• The lockfile was regenerated with pnpm 11 and lockfileVersion: '9.0' is unchanged, so the lint job (pinned to pnpm 10) still works.
• Patched versions survive: no js-yaml@4.1.1 / brace-expansion@1.1.14 anywhere in the lockfile.
• pnpm run lint → 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Move pnpm overrides to pnpm 11-compatible workspace configuration

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Move transitive security overrides to pnpm’s pnpm 10/11-compatible workspace configuration.
• Restore frozen installs and unblock package publishing without changing pinned versions.

Diagram

sequenceDiagram
  participant CI as Publish CI
  participant P as pnpm 10/11
  participant W as Workspace config
  participant L as Lockfile
  CI->>P: Run frozen install
  P->>W: Read overrides
  W-->>P: Return scoped pins
  P->>L: Validate configuration
  L-->>P: Configuration matches
  P-->>CI: Continue release

Loading

High-Level Assessment

The PR uses pnpm’s canonical cross-version location for workspace overrides while preserving the existing security pins. Pinning CI permanently to pnpm 10 would only mask the compatibility issue, so relocating the configuration is the appropriate durable fix.

Files changed (2) +10 / -6

Bug fix (1) +0 / -6

package.jsonRemove obsolete package-level pnpm overrides +0/-6

Remove obsolete package-level pnpm overrides

• Removes the 'pnpm.overrides' field that pnpm 11 ignores. Dependency declarations and override versions remain otherwise unchanged.

package.json

Other (1) +10 / -0

pnpm-workspace.yamlDefine security overrides in pnpm workspace configuration +10/-0

Define security overrides in pnpm workspace configuration

• Adds the existing major-scoped js-yaml and brace-expansion overrides in the location supported by pnpm 10 and 11. Comments explain the transitive dependency constraints and frozen-lockfile compatibility requirement.

pnpm-workspace.yaml