chore(deps): declare pnpm overrides only in pnpm-workspace.yaml

[clay-good]

Status: ready for review. Follow-up to #1815 — removes the cause of the failure that PR patched by hand.

What was wrong: the pnpm security overrides were declared twice — in pnpm-workspace.yaml, where each pin carries an inline advisory comment, and again under pnpm.overrides in package.json (root and website/). Dependabot rewrites plain-name entries in package.json when it bumps the same package. #1812 did exactly that (postcss: ^8.5.26 → ^8.5.28), left pnpm-workspace.yaml untouched, and failed Test on all three platforms against the equality assertion in test/pnpm-workspace-config.test.ts.

The duplicate is worse than redundant. The two blocks are not additive: when package.json declares pnpm.overrides, pnpm 10 uses that list instead of the workspace file's. Verified on this repo's manifests with pnpm 10.34.5 — replacing the block with a single unrelated entry produced a lockfile whose overrides: contained only that entry, silently dropping every advisory pin (brace-expansion, js-yaml, nanoid, postcss). So a Dependabot rewrite of the mirror does not just drift from the real pins, it displaces them; today only the equality test stands between that and a quietly unpatched dependency graph.

How it was fixed: deleted the pnpm.overrides block from both package.json files. pnpm-workspace.yaml — the file that already documents why each pin exists — is now the single declaration, and the test asserts the mirror stays gone instead of asserting the two copies match. .github/dependabot.yml's comment about the surfaces Dependabot doesn't manage is corrected: it claimed Dependabot never bumps these, which #1812 disproved.

Proof it works:

• pnpm install --frozen-lockfile at the root and --dir website both succeed with zero lockfile drift, which is the direct evidence that pnpm was already resolving these overrides from the workspace file and nothing about the installed graph changes.
• The new guard fails first: re-adding a pnpm.overrides block to package.json fails the root test, and removing it passes (3/3).
• Full local suite: 4416 passed. The 4 failures (config-profile, artifact-workflow Cursor skills, 2 workset 10s timeouts) reproduce on unmodified main in this sandbox and touch none of these files.

Notes / nits:

• Only pnpm 10 is in play here — packageManager pins pnpm@10.34.5, pnpm/action-setup reads it, and the Nix build uses pnpm_10 — so no supported install path loses the pins. Anyone on pnpm 9 would have been getting the package.json copy alone, which was already the drifting one.
• Adjacent landmine left alone: allowBuilds in both workspace files pins an exact esbuild@<version> that the same test derives from the lockfile, so a transitive esbuild bump will break the suite the same way. Worth a separate look — the fix depends on whether pnpm accepts an unversioned allowBuilds key, which I did not want to change blind.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Consolidated dependency security override configuration into workspace-level settings.
  • Removed duplicate package-level override declarations to prevent conflicting dependency resolutions.

• Documentation

  • Clarified how workspace and package-level dependency overrides interact with package management and automated updates.

• Tests

  • Updated configuration checks to enforce a single source of truth and verify that workspace overrides remain aligned with lockfiles.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: d0fb653a-6739-484a-8c23-975163804279

📥 Commits

Reviewing files that changed from the base of the PR and between e062b95 and b0d9c16.

📒 Files selected for processing (6)

• .github/dependabot.yml
• package.json
• pnpm-workspace.yaml
• test/pnpm-workspace-config.test.ts
• website/package.json
• website/pnpm-workspace.yaml

Included review availability: Your plan provides up to 10 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The change removes duplicate pnpm.overrides blocks from the root and website package files. Workspace comments document override precedence and Dependabot behavior. Tests now require overrides to remain single-sourced.

Changes

pnpm override configuration

Layer / File(s)	Summary
Single-source override configuration package.json, website/package.json, pnpm-workspace.yaml, website/pnpm-workspace.yaml, test/pnpm-workspace-config.test.ts, .github/dependabot.yml	The root and website package files no longer define pnpm.overrides. Workspace files and Dependabot comments document precedence and rewrite behavior. Tests verify that package-level overrides are undefined.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to b0d9c

Security overrides are now single-sourced in each workspace configuration, avoiding package-level override precedence and Dependabot drift while preserving the recorded dependency resolutions. The change is ready to merge.

Suggested reviewers: tabishb

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (5 skipped: 5 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely describes the main change: pnpm overrides now remain only in pnpm-workspace.yaml.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (5 skipped: 5 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/single-source-pnpm-overrides

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying openspec-docs with    Cloudflare Pages

Latest commit:	b0d9c16
Status:	✅  Deploy successful!
Preview URL:	https://f431b55b.openspec-docs.pages.dev
Branch Preview URL:	https://chore-single-source-pnpm-ove.openspec-docs.pages.dev

View logs

[openspec-cloud]

No PR-relevant drift confirmed.

AI-generated · A citation proves the line exists, not that it makes the case — verify before acting.
Checked the 18 requirements selected for this PR at b0d9c16 (255 total).
This is not a full-repository clean result; see the check for coverage and any broader findings.
View results · Click Refresh, then Scan again in the check. Or comment /openspec-cloud.

[clay-good]

Independently verified both halves of this, with the repo's own pnpm (10.34.5), since the claim is a security one and the PR ships no lockfile change to demonstrate it.

1. Removing the mirrors changes nothing. pnpm install --lockfile-only at this head leaves both lockfiles byte-identical, and every advisory pin is still recorded:

# pnpm-lock.yaml
overrides:
  brace-expansion@<=5.0.8: '>=5.0.9 <6'
  postcss@<8.5.23: '>=8.5.23 <9'
  js-yaml@>=3.0.0 <3.15.1: '>=3.15.1 <4'
  js-yaml@>=4.0.0 <4.3.1: '>=4.3.1 <5'
  nanoid@<3.3.17: '>=3.3.17 <4'

# website/pnpm-lock.yaml
overrides:
  postcss: ^8.5.26
  sharp: ^0.35.3
  brace-expansion@<=5.0.8: '>=5.0.9 <6'
  fast-uri@<3.1.6: ^3.1.6
  nanoid@<3.3.17: '>=3.3.17 <4'

2. The replace-not-merge behavior is real, and worse than "drift". I reproduced the hazard directly: added a single "pnpm": { "overrides": { "postcss": "^8.5.26" } } to the root package.json, nothing else, and reinstalled. The resolved lockfile became:

overrides:
  postcss: ^8.5.26

Four advisory pins gone from resolution: both js-yaml ranges, brace-expansion and nanoid. So one Dependabot rewrite of one plain-name entry silently drops every other patched advisory, which makes this a security fix rather than tidying. Restored the files afterward; nothing from that experiment is in the branch.

The guard is the right shape too: asserting packageJson.pnpm.overrides is undefined catches the mirror coming back, which is exactly how the hazard would return, whereas the old equality assertion would have passed happily while Dependabot narrowed both copies in step.

The 3 workspace-config tests pass, and the branch is current with main. Looks correct and merge-ready to me.

[alfred-openspec]

Approved at exact head b0d9c16a4903835cdcb264c0534b6dc53116a136.

The single-source guard matches pnpm 10 precedence: a package-level pnpm.overrides block would replace, not merge with, the workspace pins. I independently confirmed that lockfile-only installs leave both lockfiles unchanged and that the focused workspace-config suite passes 3/3. Hosted CI and security checks are green.

The adjacent version-qualified allowBuilds/esbuild drift risk is real but separate from this fix.