build: move web/ from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. The three security overrides
move from pnpm-workspace.yaml to package.json#overrides, where npm reads them
natively. Only the postcss floor is still live; @babel/core and js-yaml left
the tree with Next.js but are kept so the declared floors survive if a
dependency reintroduces them.

.github/workflows/ci.yml

@@ -21,25 +21,24 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v6
         with:
           package_json_file: web/package.json
 
       - uses: actions/setup-node@v7
         with:
           node-version: '24'
-          cache: 'pnpm'
-          cache-dependency-path: web/pnpm-lock.yaml
+          cache: 'npm'
+          cache-dependency-path: web/package-lock.json
 
-      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - run: npm ci --ignore-scripts
 
-      - run: pnpm test
+      - run: npm test
 
-      - run: pnpm lint
+      - run: npm run lint
 
       # No BASE_PATH here: this checks that the app compiles. The base-path
       # behaviour is verified against a real preview before release.
-      - run: pnpm build
+      - run: npm run build
 
   scraper:
     runs-on: ubuntu-latest

.github/workflows/deploy.yml

@@ -23,19 +23,18 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v6
         with:
           package_json_file: web/package.json
 
       - uses: actions/setup-node@v7
         with:
           node-version: '24'
-          cache: 'pnpm'
-          cache-dependency-path: web/pnpm-lock.yaml
+          cache: 'npm'
+          cache-dependency-path: web/package-lock.json
 
-      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - run: npm ci --ignore-scripts
 
-      - run: pnpm build
+      - run: npm run build
         env:
           BASE_PATH: /${{ github.event.repository.name }}
 

web/.gitignore

@@ -32,7 +32,7 @@ chrome-dev-tools
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
-.pnpm-debug.log*
+.npm-debug.log*
 
 # env files
 .env*.local

web/README.md

@@ -9,18 +9,18 @@ Built with SvelteKit and Svelte 5, styled with Tailwind CSS, and prerendered to
 ## Quick start
 
 ```bash
-pnpm install
-pnpm dev
+npm install
+npm run dev
 ```
 
 ## Commands
 
 ```bash
-pnpm dev      # dev server
-pnpm build    # static build into build/
-pnpm preview  # serve the production build
-pnpm test     # unit tests
-pnpm lint     # eslint
+npm run dev      # dev server
+npm run build    # static build into build/
+npm run preview  # serve the production build
+npm test         # unit tests
+npm run lint     # eslint
 ```
 
 Champion data lives in `static/champions.json` and is refreshed weekly by the sync workflow.

web/package.json

@@ -3,7 +3,6 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
-  "packageManager": "pnpm@11.1.1",
   "scripts": {
     "dev": "vite dev",
     "build": "vite build",
@@ -25,5 +24,10 @@
     "tailwindcss": "^4.3.3",
     "vite": "^8.1.5",
     "vitest": "^4.1.10"
+  },
+  "overrides": {
+    "@babel/core": "^7.29.7",
+    "js-yaml": "^4.3.0",
+    "postcss": ">=8.5.16"
   }
 }

web/pnpm-workspace.yaml

@@ -1,4 +0,0 @@
-overrides:
-  '@babel/core': '^7.29.7'
-  js-yaml: '^4.3.0'
-  postcss: '>=8.5.16'