fix: stop package-lock.json drift

[mariechatfield]

Summary

package-lock.json has been flapping on nearly every dependabot merge, including two prior one-off fixes (#2393, and an earlier "chore: fix package-lock.json sync issue") that didn't hold — see #2446 for the latest recurrence.

Root cause: @conventional-changelog/git-client (transitive dep of @commitlint/cli via @commitlint/read) declares conventional-commits-parser and conventional-commits-filter as optional peer dependencies with no other hard consumer anywhere in the tree:

"peerDependencies": {
  "conventional-commits-filter": "^5.0.0",
  "conventional-commits-parser": "^6.4.0"
},
"peerDependenciesMeta": {
  "conventional-commits-filter": { "optional": true },
  "conventional-commits-parser": { "optional": true }
}

npm's resolution of an unclaimed optional peer like this is order-sensitive rather than input-sensitive — the same package.json can resolve either way depending on install state. git log -S on the relevant lockfile block shows it flipping in and out across ~15 unrelated commits (dependabot and human PRs alike), unrelated to whatever each commit was actually about.

Fix

Add both packages to the existing overrides block, forcing a single deterministic resolution instead of leaving it to the optional-peer coin flip:

"overrides": {
  "conventional-commits-parser": "^7.1.0",
  "conventional-commits-filter": "^5.0.0"
}

This also collapses duplicated nested copies (@commitlint/parse/node_modules/..., @commitlint/types/node_modules/...) into one hoisted resolution.

Test plan

• rm -rf node_modules && npm install — verified byte-identical package-lock.json across repeated clean installs (no more drift)
• npm run build, npm run lint:staged ran clean via lint-staged pre-commit hook

🤖 Generated with Claude Code