From 0836d1a175cbfe2f81b1c19dcad5124e53b53437 Mon Sep 17 00:00:00 2001 From: John McLear Date: Mon, 21 Sep 2026 18:54:43 +0100 Subject: [PATCH] fix(deps): move pnpm overrides to pnpm-workspace.yaml pnpm 11 no longer reads the `pnpm` field from package.json, so the overrides added by the recent dependency sweep were silently ignored while the lockfile still recorded them. Frozen installs under pnpm 11 therefore abort with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH, which kills the publish job in its "Bump version (patch)" step and blocks releases. Move the overrides verbatim into pnpm-workspace.yaml, where both pnpm 10 and pnpm 11 read them. The lockfile is unchanged (lockfileVersion 9.0) and the patched js-yaml / brace-expansion versions are preserved. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw --- package.json | 6 ------ pnpm-workspace.yaml | 10 ++++++++++ 2 files changed, 10 insertions(+), 6 deletions(-) create mode 100644 pnpm-workspace.yaml diff --git a/package.json b/package.json index b485768..dcdcce1 100644 --- a/package.json +++ b/package.json @@ -52,11 +52,5 @@ "scripts": { "lint": "eslint .", "lint:fix": "eslint --fix ." - }, - "pnpm": { - "overrides": { - "js-yaml": "^4.3.2", - "brace-expansion@1": "^1.1.16" - } } } diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml new file mode 100644 index 0000000..627ed0a --- /dev/null +++ b/pnpm-workspace.yaml @@ -0,0 +1,10 @@ +# js-yaml and brace-expansion arrive only as transitive dev dependencies (via +# eslint and minimatch@3), so `pnpm update` cannot move them. The selectors are +# scoped to the affected major line: an unbounded range would drag minimatch@3 +# onto brace-expansion 5.x and eslint onto js-yaml 5.x. +# +# pnpm 11 no longer reads `pnpm.overrides` from package.json — these must live +# here or the lockfile and the install disagree (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH). +overrides: + js-yaml: '^4.3.2' + brace-expansion@1: '^1.1.16'