fix(deps): move pnpm overrides to pnpm-workspace.yaml

[JohnMcLear]

Problem

The recent dependency sweep put the js-yaml / brace-expansion overrides into the
pnpm.overrides field of package.json, and regenerated the lockfile with pnpm 10.

pnpm 11 no longer reads the pnpm field from package.json. It warns:

The "pnpm" field in package.json is no longer read by pnpm ... "pnpm.overrides"

and then ignores it. CI's publish job runs pnpm 11, so it sees no overrides while
the lockfile records them, and the frozen install aborts:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH
Cannot proceed with the frozen installation. The current "overrides" configuration
doesn't match the value found in the lockfile

The publish job dies in its "Bump version (patch)" step, so this plugin cannot
release at all until this is fixed. The dependency fix itself is correct — only
its location was wrong.

Fix

Move the overrides verbatim from package.json into pnpm-workspace.yaml, which
pnpm 11 does read. The override values are unchanged, and so is the lockfile
(lockfileVersion: '9.0'), so the lint job's pinned pnpm 10 still works.

Verification

• npx -y pnpm@11 install → lockfile unchanged, still lockfileVersion: '9.0'
• npx -y pnpm@11 i --frozen-lockfile → succeeds
• pnpm i --frozen-lockfile with pnpm 10.33.0 → succeeds
• The patched transitive versions survive: no js-yaml@4.1.1 or
  brace-expansion@1.1.14 in the lockfile
• pnpm run lint → 0 errors

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Move pnpm overrides to workspace configuration

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Moves transitive dependency overrides to pnpm 11-supported workspace configuration.
• Restores frozen publishing installs while preserving pnpm 10 compatibility and lockfile state.

Diagram

graph TD
  M["Package manifest"] -->|moves overrides| W["Workspace config"] --> P11["pnpm 11"] --> L["Lockfile"] --> C["Publish job"]
  W --> P10["pnpm 10"] --> L

Loading

High-Level Assessment

The PR uses pnpm 11's canonical override location while retaining pnpm 10 compatibility. Pinning publishing to pnpm 10 would only defer the migration and preserve reliance on a deprecated configuration location, so the proposed relocation is the appropriate fix.

Files changed (2) +10 / -6

Bug fix (1) +10 / -0

pnpm-workspace.yamlDefine dependency overrides in pnpm workspace configuration +10/-0

Define dependency overrides in pnpm workspace configuration

• Adds the existing scoped 'js-yaml' and 'brace-expansion' overrides in the location supported by pnpm 10 and 11. Comments document the transitive dependency constraints and lockfile mismatch prevented by this placement.

pnpm-workspace.yaml

Other (1) +0 / -6

package.jsonRemove obsolete package-level pnpm overrides +0/-6

Remove obsolete package-level pnpm overrides

• Removes the 'pnpm.overrides' block that pnpm 11 ignores. Package metadata, scripts, and dependency declarations remain unchanged.

package.json

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. pnpm 11 override changes lack regression coverage 📘 Rule violation ▣ Testability

Description

The dependency configuration moves the override declarations from package.json into
pnpm-workspace.yaml without adding or modifying an automated test. A pnpm 11 frozen install could
regress to ignoring the overrides and aborting with a lockfile configuration mismatch without any
repository test detecting it.

Code

pnpm-workspace.yaml[R8-10]

+overrides:
+  js-yaml@^4: '>=4.3.2 <5'
+  brace-expansion@^1: '>=1.1.16 <2'

Evidence

The PR is explicitly a dependency bug fix, but the diff only removes the overrides from
package.json and adds them to pnpm-workspace.yaml; no test file is changed or added. This fails
the requirement that every bug fix include a regression test targeting the previously failing
behavior.

Rule 565427: Every bug fix must add a regression test
pnpm-workspace.yaml[8-10]
package.json[36-42]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The bug-fix PR moves the dependency overrides into `pnpm-workspace.yaml`, but it adds no automated regression test for pnpm 11 reading those overrides and completing a frozen install.
## Fix Focus Areas
- pnpm-workspace.yaml[8-10]
- package.json[36-37]
## Recommended Fix
Add an automated regression test that runs the supported pnpm 11 installation or validates the workspace override configuration and asserts that a frozen install succeeds with the patched transitive versions. Ensure the test would fail when the overrides are placed only in the removed `package.json` `pnpm` field.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

1. Pnpm 11 override changes lack regression coverage 📘 Rule violation ▣ Testability

The dependency configuration moves the override declarations from package.json into
pnpm-workspace.yaml without adding or modifying an automated test. A pnpm 11 frozen install could
regress to ignoring the overrides and aborting with a lockfile configuration mismatch without any
repository test detecting it.

Agent Prompt

## Issue description
The bug-fix PR moves the dependency overrides into `pnpm-workspace.yaml`, but it adds no automated regression test for pnpm 11 reading those overrides and completing a frozen install.

## Fix Focus Areas
- pnpm-workspace.yaml[8-10]
- package.json[36-37]

## Recommended Fix
Add an automated regression test that runs the supported pnpm 11 installation or validates the workspace override configuration and asserts that a frozen install succeeds with the patched transitive versions. Ensure the test would fail when the overrides are placed only in the removed `package.json` `pnpm` field.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools