chore(deps): swap to pnpm-lock.yaml as source of truth

The repo uses pnpm (packageManager pinned in package.json, pnpm-lock.yaml tracked, pnpm-workspace.yaml present) but package-lock.json was also tracked from an earlier npm install. Dependabot reads stale npm metadata from it that doesn't match what pnpm actually installs. - Untrack and delete package-lock.json - Add it to .gitignore so a stray npm install can't reintroduce it
2026-07-22 02:02:51 +02:00 · 2026-05-20 09:18:37 -04:00
parent 8cdda62779
commit b2d24f242b
2 changed files with 2 additions and 4270 deletions
@@ -3,6 +3,8 @@ node_modules/
 dist/
 build/
 *.log
+# pnpm is the package manager — npm's lockfile is not the source of truth
+package-lock.json

 # Cloudflare Workers
 .wrangler/