chore(deps): pin js-yaml and tar via pnpm overrides - #2549
Conversation
Add pnpm overrides so transitive resolutions of js-yaml and tar land on current releases (js-yaml 3.15.0 / 4.3.0, tar 7.5.21) instead of the older versions the lockfile was resolving. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the workspace’s pnpm dependency resolution behavior so transitive installs of js-yaml and tar are forced onto newer patched versions via pnpm.overrides, and refreshes the lockfile accordingly.
Changes:
- Add range-based
pnpm.overridesentries to forcejs-yaml(3.15.0/4.3.0) andtar(7.5.21). - Update
pnpm-lock.yamlto reflect the new override rules and resolved versions, removing oldertar/js-yamlentries.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Adds pnpm.overrides rules to force patched js-yaml and tar transitive resolutions. |
| pnpm-lock.yaml | Updates overrides + resolved dependency graph to match the new forced versions. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
| js-yaml: | ||
| specifier: ^4.2.0 | ||
| version: 4.2.0 | ||
| specifier: 4.3.0 | ||
| version: 4.3.0 |
There was a problem hiding this comment.
Good catch — fixed in 546e3f2. Root cause was that js-yaml is a direct devDependency declared as ^4.2.0, and the js-yaml@>=4 <4.3.0 override matched it and rewrote the importer's specifier to 4.3.0, creating the mismatch you flagged.
Rather than keep the override fighting the declared range, I bumped the direct devDependency to ^4.3.0 so package.json and the lockfile specifier agree (specifier: ^4.3.0, version: 4.3.0). The >=4 <4.3.0 override is retained only to catch transitive consumers that request the older range (e.g. js-yaml@~4.1.0 via eslint/lerna/cosmiconfig), which no longer overlaps the direct dependency.
Verified pnpm install --frozen-lockfile now succeeds.
Aligns the root js-yaml devDependency specifier with the version the lockfile resolves, so package.json and pnpm-lock.yaml agree and --frozen-lockfile checks pass. Transitive overrides are unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
What
Adds pnpm
overridesso transitive resolutions ofjs-yamlandtarland on current releases instead of the older versions the lockfile had pinned:All three are dev-only, transitive dependencies. Range-based selectors are used (not exact pins) so any future sub-dependency that resolves into the old range is caught too.
Why overrides instead of bumping the parent packages
I looked at bumping the packages that pull these in rather than using overrides, and overrides are the cleaner lever here:
3.15.0,4.3.0) are published under thev3-legacy/v4-legacydist-tags (latestis on a newer major line the parents don't track). The parents (front-matter,@yarnpkg/parsers) stay within^3/^4, and these are the highest versions in those ranges, so the override just makes that resolution explicit and regression-proof.6.2.1copies come fromlerna's tooling (node-gyp,cacache,pacote), which are transitive and can't be bumped directly. The only direct handle islerna, and moving it forward is a major bump that touches the release workflow — more risk and churn than warranted here.proolpinstarto exactly7.2.0, even on its latest release, so no upstream bump reaches that copy at all. Thetaroverride is the only single change that covers every path, including this one.Verification
pnpm installcompletes cleanly on Node 22.20.0 (per.nvmrc), including thehalpbuild + husky postinstall steps — thetar6 → 7 major bump does not break the dependency tree.js-yaml < 3.15.0,js-yaml 4.0–4.2, ortar < 7.5.18entries inpnpm-lock.yaml.🤖 Generated with Claude Code
PR-Codex overview
This PR focuses on updating dependencies in the
package.jsonandpnpm-lock.yamlfiles, particularly the version ofjs-yamlandtar, along with adjusting their specifications.Detailed summary
js-yamlfrom4.2.0to4.3.0.js-yaml@<3.15.0with version3.15.0.js-yaml@>=4 <4.3.0with version4.3.0.tar@<7.5.18with version7.5.21.js-yamlreferences inpnpm-lock.yaml.