[bug]: pnpm 10 ignores root dependency overrides and build allowlist

Platform

Development tooling / package installation

Browser

Other

Operating System

Windows

Bug Description

At the current main commit (ac145e7f758151b41fd46d3e5f513886ce9068ba), the root package.json declares [email protected] but stores the dependency overrides and onlyBuiltDependencies allowlist under package.json's pnpm object. Running pnpm 10.34.5 in a clean checkout prints: The pnpm field in package.json is no longer read by pnpm. The following keys were ignored: pnpm.overrides, pnpm.onlyBuiltDependencies. pnpm config get overrides and pnpm config get onlyBuiltDependencies both return undefined.

Expected behavior: the committed dependency overrides and approved dependency build-script allowlist are active for pnpm 10 installs.

Actual behavior: pnpm does not load either setting. The existing lockfile still contains resolved overrides, but future dependency resolution and install-script policy reads do not receive the declarations from package.json.

The pnpm 10 settings documentation says overrides can only be set at the root of pnpm-workspace.yaml, and documents onlyBuiltDependencies there as well: https://pnpm.io/10.x/settings

A focused fix would move these settings to pnpm-workspace.yaml (or use the current allowBuilds equivalent where appropriate) and verify that pnpm no longer warns and reports the settings as active.