chore: update deps

.github/workflows/ci.yml

@@ -20,17 +20,14 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
           node-version: 24
-          cache: 'pnpm'
+          cache: 'npm'
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: npm ci
 
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@v3
@@ -39,12 +36,12 @@ jobs:
           extended: true
 
       - name: Run linting tests
-        run: pnpm test
+        run: npm test
 
       - name: Build site with Hugo
         run: hugo -d $GITHUB_WORKSPACE/public
 
       - name: Run broken links test
-        run: pnpm run test:links
+        run: npm run test:links
         env:
           CI: true

.npmrc

@@ -1,19 +1,2 @@
 # Reject registry connections that fail TLS verification.
 strict-ssl=true
-
-# Supply-chain cooldown: refuse versions published < 7 days ago (minutes).
-# Honored by pnpm >= 10.16. Applies to future updates; the conversion
-# bypassed it so already-locked versions still installed.
-minimum-release-age=10080
-
-# ignore-scripts is intentionally NOT set — under pnpm it also suppresses
-# the root project's prepare/preinstall hooks. Dependency scripts are blocked
-# by pnpm 10 default-deny + the empty pnpm.onlyBuiltDependencies.
-
-# Flat node_modules (like npm) so Docsy's postcss.config.js can resolve its
-# plugins (autoprefixer, postcss-import) from the project root.
-# NOTE: this does NOT fix Hugo's "binary postcss is not a Node.js script"
-# error — pnpm still writes node_modules/.bin/postcss as a /bin/sh cmd-shim.
-# The postinstall script (scripts/link-postcss-bin.mjs) replaces that shim
-# with an npm-style symlink so Hugo can exec it.
-node-linker=hoisted