chore(deps): upgrade lerna to v9

[jakehobbs]

What

Upgrades lerna ^8.0.2 → ^9.0.7 and trims the pnpm overrides to the minimum still required.

This also unblocks the publish pipeline. The tar@<7.5.18 override is incompatible with lerna 8.2.4 (its packDirectory uses the tar 6 API and crashed with Cannot read properties of undefined (reading 'create')). Lerna 9 uses the tar 7 API, so the override is now compatible and packing works.

Changes

• lerna ^8.0.2 → ^9.0.7
• Ran pnpm lerna repair — reported the config already up to date; no lerna.json changes. The only migration change was nx adding .claude/worktrees to .gitignore (kept). An earlier /.nx/workspace-data addition to .eslintignore was out of scope (redundant with the existing .nx/* pattern) and has been reverted.
• Override cleanup (verified empirically by removing each and re-resolving):
  • Removed js-yaml@<3.15.0 — lerna 9 no longer pulls the js-yaml 3.x chain (@yarnpkg/parsers / front-matter), so nothing resolves below 3.15.0 anymore. Dead override.
  • Kept js-yaml@>=4 <4.3.0 → 4.3.0 — a transitive ~4.1.0 consumer still resolves to 4.1.1 without it.
  • Kept tar@<7.5.18 → 7.5.21.
  • Added postcss@<8.5.12 → 8.5.23 — closes Dependabot alert docs: added pre-deposit info to FAQs #538 (GHSA-6g55-p6wh-862q, high). postcss@8.5.8 was pulled in dev-only via vite/vitest; forced to the patched line.

Resulting resolutions: js-yaml@4.3.0 only, tar@7.5.21 only (no more tar@6.2.1 / 7.2.0 from lerna 8's tooling or prool).

Breaking-change review (lerna 9.0.0)

All lerna 9 breaking changes are in 9.0.0 (9.0.1–9.0.7 add none). Neither affects this repo:

• Node 18 dropped (requires ^20.19 || ^22.12 || >=24) — repo already requires >=22.12.0 (.nvmrc 22.20.0).
• lerna add/bootstrap/link removed — not used here. lerna clean (used by clean:node_modules) still ships in v9.

Verification (Node 22.20.0)

• pnpm install --frozen-lockfile passes.
• pnpm run build:libs — 5/5 tasks succeed.
• pnpm lerna changed reads the workspace, honors forcePublish, lists all 4 packages ready to publish.
• Publish flags used by the workflow (--conventional-commits, --no-private, --no-verify-access, from-package/from-git) are all accepted by lerna 9.
• Could not exercise a real npm publish (needs registry auth) — but the pack-step crash was a tar 6-vs-7 API mismatch, resolved by lerna 9 targeting tar 7.

Note

Supersedes #2550 (the temporary tar-override revert) — this fixes the pack step and keeps all four dependency alerts closed. #2550 can be closed.

🤖 Generated with Claude Code

---

PR-Codex overview

This PR focuses on updating dependencies in the package.json and related files, enhancing compatibility and performance by upgrading various packages.

Detailed summary

• Added .claude/worktrees to .gitignore.
• Updated lerna from ^8.0.2 to ^9.0.7.
• Added postcss@<8.5.12: 8.5.23 as a dependency.
• Updated js-yaml to ^4.3.0 and removed js-yaml@<3.15.0.
• Updated vite to use yaml@2.9.0.
• Updated vitest to use yaml@2.9.0.
• Added multiple new packages with specific versions and resolutions.
• Updated npm related packages and fixed their versions.
• Removed deprecated packages and updated their alternatives.

The following files were skipped due to too many changes: pnpm-lock.yaml

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

[Copilot]

Pull request overview

This PR upgrades the monorepo toolchain by moving lerna from ^8.0.2 to ^9.0.7, and updates the workspace lockfile accordingly. It also trims pnpm override rules and updates ESLint ignore patterns to accommodate Nx workspace metadata introduced by the migration.

Changes:

• Upgraded lerna to ^9.0.7 (and refreshed pnpm-lock.yaml resolutions accordingly).
• Removed the now-dead js-yaml@<3.15.0 override while retaining the targeted js-yaml and tar overrides.
• Added /.nx/workspace-data to .eslintignore to avoid linting Nx workspace artifacts.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
package.json	Bumps lerna to v9 and simplifies pnpm.overrides by removing the js-yaml@<3.15.0 rule.
pnpm-lock.yaml	Updates the dependency graph for lerna@9.0.7 and related transitive packages; reflects override cleanup.
.eslintignore	Ignores Nx workspace metadata directory (/.nx/workspace-data).