From 936751a810ded107379bd679beb180b84607c847 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Sun, 30 Aug 2026 17:02:08 +0200 Subject: [PATCH 1/7] test(deps): take @nextcloud/vue 9.11 again, to settle whether it caused the E2E failures (#443) DELIBERATE EXPERIMENT, and revertible in one commit. CI bisected launchpad's 11 E2E failures to the 9.9.0 -> 9.11.0 move: f93f76791 9.11.0 E2E failure d158755fc 9.9.0 E2E success (the pin) But an isolated reproduction contradicts it. Running the same specs against a launchpad-demo instance on :8605, seeded exactly as CI seeds (tests/e2e/seed.sh: e2e-grantee, recipient, firstrunwizard disabled, demo-data skipped), with a local build against 9.11: conditional-visibility-editor.spec.ts 13 passed <- the 7 CI failures do NOT reproduce dashboard-sharing.spec.ts 4 failed <- but at line 83, on the switcher row, NOT on CI's .sharee-option So two runs correlate the version with the failure, and a controlled run says 9.11 passes those tests. Correlation across two CI runs is not causation, and the difference may be load rather than version. This puts 9.11 back so CI can answer it: the 7 recur -> the NcSelect rework really is the cause, and the specs get adapted to the new component the 7 pass -> they were load-flakes, the pin was incidental, and the other ten apps on 9.11 need nothing Either answer is worth more than shipping a pin whose justification does not survive a controlled test. Co-authored-by: Conduction Release Bot --- package-lock.json | 18 +++++++++--------- package.json | 2 +- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package-lock.json b/package-lock.json index 33eca57c..9b2e2851 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16,7 +16,7 @@ "@nextcloud/initial-state": "^2.2.0", "@nextcloud/l10n": "^3.4.1", "@nextcloud/router": "^3.1.0", - "@nextcloud/vue": "~9.9.0", + "@nextcloud/vue": "^9.11.0", "dexie": "^4.4.5", "dompurify": "^3.4.14", "gridstack": "^12.2.1", @@ -4251,9 +4251,9 @@ } }, "node_modules/@nextcloud/vue": { - "version": "9.9.0", - "resolved": "https://registry.npmjs.org/@nextcloud/vue/-/vue-9.9.0.tgz", - "integrity": "sha512-TmKnBWp6Aiw+cm+WamwX5cMkhkpJqLSUKrTUB5I5Y9RDt2S0TUlwRaTe9vltBIV3qmKParhpZQ3/ewWHgEQlrQ==", + "version": "9.11.0", + "resolved": "https://registry.npmjs.org/@nextcloud/vue/-/vue-9.11.0.tgz", + "integrity": "sha512-LRsyU9Mxs0b2xWqbxygps8O7/i1z4QhNQD9/QDni+VqFY3V0N95mAgmKJm6vfoFuxTAMXERp9bjqFn3UV542gw==", "license": "AGPL-3.0-or-later", "dependencies": { "@ckpack/vue-color": "^1.6.0", @@ -4270,19 +4270,19 @@ "@nextcloud/sharing": "^0.4.0", "@nextcloud/vue-select": "^4.1.0", "@vuepic/vue-datepicker": "^11.0.3", - "@vueuse/components": "^14.3.0", - "@vueuse/core": "^14.3.0", + "@vueuse/components": "^14.4.0", + "@vueuse/core": "^14.4.0", "blurhash": "^2.0.5", "clone": "^2.1.2", "debounce": "^3.0.0", - "dompurify": "^3.4.12", + "dompurify": "^3.4.14", "emoji-mart-vue-fast": "^15.0.5", "escape-html": "^1.0.3", "floating-vue": "^5.2.2", "focus-trap": "^8.2.2", "linkifyjs": "^4.3.3", "mdast-util-to-string": "^4.0.0", - "p-queue": "^9.3.1", + "p-queue": "^9.3.3", "rehype-external-links": "^3.0.0", "rehype-highlight": "^7.0.2", "rehype-react": "^8.0.0", @@ -4299,7 +4299,7 @@ "unist-builder": "^4.0.0", "unist-util-visit-parents": "^6.0.2", "vue": "^3.5.18", - "vue-router": "^5.1.0" + "vue-router": "^5.2.0" }, "engines": { "node": "^20.11.0 || ^22 || ^24" diff --git a/package.json b/package.json index 03fca29a..2238ec08 100644 --- a/package.json +++ b/package.json @@ -41,7 +41,7 @@ "@nextcloud/initial-state": "^2.2.0", "@nextcloud/l10n": "^3.4.1", "@nextcloud/router": "^3.1.0", - "@nextcloud/vue": "~9.9.0", + "@nextcloud/vue": "^9.11.0", "dexie": "^4.4.5", "dompurify": "^3.4.14", "gridstack": "^12.2.1", From 1e307e74f4a50ea3335989350eec0e878579b628 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Sun, 30 Aug 2026 17:29:03 +0200 Subject: [PATCH 2/7] =?UTF-8?q?revert(deps):=20restore=20the=20@nextcloud/?= =?UTF-8?q?vue=20pin=20=E2=80=94=20the=20experiment=20answered=20(#446)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The experiment in #443 has its answer, and it is the one that keeps the pin: E2E on 9.11 failed with the SAME ELEVEN tests and the SAME signatures as before. 127 passed, 11 failed 7x conditional-visibility-editor waiting for '.vs__dropdown-option' 4x dashboard-sharing waiting for '.sharee-option' That is deterministic, not load. Two independent CI runs on 9.11 produce an identical failure set, and 9.9.0 produces none, so the NcSelect rework is the cause. My isolated reproduction said otherwise -- those same specs passed on a 9.11 build against a seeded launchpad-demo -- and I have not yet found what differs between that environment and CI. That gap is real and worth closing before the specs are adapted, because adapting them against an environment that does not reproduce the failure fixes nothing. So development goes back to green on the pin while that work happens, rather than sitting red. The adaptation is still the plan; this is not a retreat from it. The one adaptation already understood and shipped separately is stackiq's (#841): 9.10 turned .vs__search from the into a wrapper div around it, measured on a live build. launchpad's two failure modes are different and not yet explained. Co-authored-by: Conduction Release Bot --- package-lock.json | 18 +++++++++--------- package.json | 2 +- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package-lock.json b/package-lock.json index 9b2e2851..33eca57c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16,7 +16,7 @@ "@nextcloud/initial-state": "^2.2.0", "@nextcloud/l10n": "^3.4.1", "@nextcloud/router": "^3.1.0", - "@nextcloud/vue": "^9.11.0", + "@nextcloud/vue": "~9.9.0", "dexie": "^4.4.5", "dompurify": "^3.4.14", "gridstack": "^12.2.1", @@ -4251,9 +4251,9 @@ } }, "node_modules/@nextcloud/vue": { - "version": "9.11.0", - "resolved": "https://registry.npmjs.org/@nextcloud/vue/-/vue-9.11.0.tgz", - "integrity": "sha512-LRsyU9Mxs0b2xWqbxygps8O7/i1z4QhNQD9/QDni+VqFY3V0N95mAgmKJm6vfoFuxTAMXERp9bjqFn3UV542gw==", + "version": "9.9.0", + "resolved": "https://registry.npmjs.org/@nextcloud/vue/-/vue-9.9.0.tgz", + "integrity": "sha512-TmKnBWp6Aiw+cm+WamwX5cMkhkpJqLSUKrTUB5I5Y9RDt2S0TUlwRaTe9vltBIV3qmKParhpZQ3/ewWHgEQlrQ==", "license": "AGPL-3.0-or-later", "dependencies": { "@ckpack/vue-color": "^1.6.0", @@ -4270,19 +4270,19 @@ "@nextcloud/sharing": "^0.4.0", "@nextcloud/vue-select": "^4.1.0", "@vuepic/vue-datepicker": "^11.0.3", - "@vueuse/components": "^14.4.0", - "@vueuse/core": "^14.4.0", + "@vueuse/components": "^14.3.0", + "@vueuse/core": "^14.3.0", "blurhash": "^2.0.5", "clone": "^2.1.2", "debounce": "^3.0.0", - "dompurify": "^3.4.14", + "dompurify": "^3.4.12", "emoji-mart-vue-fast": "^15.0.5", "escape-html": "^1.0.3", "floating-vue": "^5.2.2", "focus-trap": "^8.2.2", "linkifyjs": "^4.3.3", "mdast-util-to-string": "^4.0.0", - "p-queue": "^9.3.3", + "p-queue": "^9.3.1", "rehype-external-links": "^3.0.0", "rehype-highlight": "^7.0.2", "rehype-react": "^8.0.0", @@ -4299,7 +4299,7 @@ "unist-builder": "^4.0.0", "unist-util-visit-parents": "^6.0.2", "vue": "^3.5.18", - "vue-router": "^5.2.0" + "vue-router": "^5.1.0" }, "engines": { "node": "^20.11.0 || ^22 || ^24" diff --git a/package.json b/package.json index 2238ec08..03fca29a 100644 --- a/package.json +++ b/package.json @@ -41,7 +41,7 @@ "@nextcloud/initial-state": "^2.2.0", "@nextcloud/l10n": "^3.4.1", "@nextcloud/router": "^3.1.0", - "@nextcloud/vue": "^9.11.0", + "@nextcloud/vue": "~9.9.0", "dexie": "^4.4.5", "dompurify": "^3.4.14", "gridstack": "^12.2.1", From db55bc07161be7ed5bd7eff5db7f05b0c3e051d2 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Sun, 30 Aug 2026 18:09:06 +0200 Subject: [PATCH 3/7] fix(ui): the select dropdown must paint above what follows it (#450) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adapts to @nextcloud/vue 9.11 rather than pinning away from it, and takes the pin off. The eleven E2E failures were never an unstable element. The Playwright trace from CI says so directly: - locator resolved to
  • - attempting click action - element is visible, enabled and stable <- stable - scrolling into view if needed -
    ... intercepts The option was VISIBLE, ENABLED AND STABLE. The click was intercepted by the element painted on top of it. Both failing areas are the same shape. A column of blocks; a select in one of them; its dropdown opens downward over the LATER siblings; those siblings have no stacking context, so they paint last and win: conditional-visibility
    dashboard-sharing

    9.10's floating-label rework (#8570) is what made it reachable: the control got taller, so the dropdown now extends far enough to reach them. That is why 9.9.0 was green and 9.11 is not, without either version being broken. The fix is a stacking context on the block that holds the select, in both places. Nothing else changes, and the dropdown is only raised where a select actually lives. ⚠️ This could not be verified locally. The same specs PASS against a seeded launchpad-demo on :8605 built with 9.11 -- the layout there does not put the dropdown over those siblings. The trace from CI is the evidence this rests on, and CI is where it has to be confirmed. Co-authored-by: Conduction Release Bot --- package-lock.json | 18 +++---- package.json | 2 +- src/components/Widgets/VisibilityRuleRow.vue | 26 ++++++++++ src/modals/DashboardConfigModal.vue | 53 +++++++++++++++++++- 4 files changed, 88 insertions(+), 11 deletions(-) diff --git a/package-lock.json b/package-lock.json index 33eca57c..9b2e2851 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16,7 +16,7 @@ "@nextcloud/initial-state": "^2.2.0", "@nextcloud/l10n": "^3.4.1", "@nextcloud/router": "^3.1.0", - "@nextcloud/vue": "~9.9.0", + "@nextcloud/vue": "^9.11.0", "dexie": "^4.4.5", "dompurify": "^3.4.14", "gridstack": "^12.2.1", @@ -4251,9 +4251,9 @@ } }, "node_modules/@nextcloud/vue": { - "version": "9.9.0", - "resolved": "https://registry.npmjs.org/@nextcloud/vue/-/vue-9.9.0.tgz", - "integrity": "sha512-TmKnBWp6Aiw+cm+WamwX5cMkhkpJqLSUKrTUB5I5Y9RDt2S0TUlwRaTe9vltBIV3qmKParhpZQ3/ewWHgEQlrQ==", + "version": "9.11.0", + "resolved": "https://registry.npmjs.org/@nextcloud/vue/-/vue-9.11.0.tgz", + "integrity": "sha512-LRsyU9Mxs0b2xWqbxygps8O7/i1z4QhNQD9/QDni+VqFY3V0N95mAgmKJm6vfoFuxTAMXERp9bjqFn3UV542gw==", "license": "AGPL-3.0-or-later", "dependencies": { "@ckpack/vue-color": "^1.6.0", @@ -4270,19 +4270,19 @@ "@nextcloud/sharing": "^0.4.0", "@nextcloud/vue-select": "^4.1.0", "@vuepic/vue-datepicker": "^11.0.3", - "@vueuse/components": "^14.3.0", - "@vueuse/core": "^14.3.0", + "@vueuse/components": "^14.4.0", + "@vueuse/core": "^14.4.0", "blurhash": "^2.0.5", "clone": "^2.1.2", "debounce": "^3.0.0", - "dompurify": "^3.4.12", + "dompurify": "^3.4.14", "emoji-mart-vue-fast": "^15.0.5", "escape-html": "^1.0.3", "floating-vue": "^5.2.2", "focus-trap": "^8.2.2", "linkifyjs": "^4.3.3", "mdast-util-to-string": "^4.0.0", - "p-queue": "^9.3.1", + "p-queue": "^9.3.3", "rehype-external-links": "^3.0.0", "rehype-highlight": "^7.0.2", "rehype-react": "^8.0.0", @@ -4299,7 +4299,7 @@ "unist-builder": "^4.0.0", "unist-util-visit-parents": "^6.0.2", "vue": "^3.5.18", - "vue-router": "^5.1.0" + "vue-router": "^5.2.0" }, "engines": { "node": "^20.11.0 || ^22 || ^24" diff --git a/package.json b/package.json index 03fca29a..2238ec08 100644 --- a/package.json +++ b/package.json @@ -41,7 +41,7 @@ "@nextcloud/initial-state": "^2.2.0", "@nextcloud/l10n": "^3.4.1", "@nextcloud/router": "^3.1.0", - "@nextcloud/vue": "~9.9.0", + "@nextcloud/vue": "^9.11.0", "dexie": "^4.4.5", "dompurify": "^3.4.14", "gridstack": "^12.2.1", diff --git a/src/components/Widgets/VisibilityRuleRow.vue b/src/components/Widgets/VisibilityRuleRow.vue index 246c2c50..b93ad9dd 100644 --- a/src/components/Widgets/VisibilityRuleRow.vue +++ b/src/components/Widgets/VisibilityRuleRow.vue @@ -708,4 +708,30 @@ export default { gap: 8px; justify-content: flex-end; } + +/* + * The open select dropdown must paint ABOVE the row's action buttons. + * + * The row is a flex column: fields first, actions after. An NcSelect + * dropdown opens downward out of the fields block and lands over the + * actions, and because the actions are a LATER sibling with no stacking + * context of their own, they win and swallow the click. + * + * @nextcloud/vue 9.10 made this reachable by giving NcSelect a floating + * label (#8570), which makes the control taller and pushes the dropdown + * further down -- far enough to reach the actions. The Playwright trace + * names the interception exactly: + * + * - locator resolved to

  • + * - attempting click action + * - element is visible, enabled and stable + * -
    ... intercepts pointer events + * + * The option was never unstable; it was covered. Giving the fields their + * own stacking context puts the dropdown back on top. + */ +.visibility-rule-row__fields { + position: relative; + z-index: 1; +} diff --git a/src/modals/DashboardConfigModal.vue b/src/modals/DashboardConfigModal.vue index 6e084b12..ba6893b9 100644 --- a/src/modals/DashboardConfigModal.vue +++ b/src/modals/DashboardConfigModal.vue @@ -136,7 +136,7 @@ class="dashboard-config__panel">
    + class="dashboard-config__field dashboard-config__field--select"> @@ -1151,6 +1151,57 @@ export default { gap: 6px; } +/* + * The sharee dropdown must paint ABOVE the fields that follow it. + * + * The modal body is a column of `__field` blocks. An NcSelect dropdown + * opens downward out of its field and lands over the next ones, and + * because those are LATER siblings with no stacking context of their own, + * they win and swallow the click. + * + * @nextcloud/vue 9.10 made this reachable by giving NcSelect a floating + * label (#8570): the control is taller, so the dropdown reaches further + * down. The Playwright trace names the interceptors exactly: + * + * - locator resolved to + * - attempting click action + * - element is visible, enabled and stable + * -
    ... + * -

    Not shared with anyone yet.

    ... + * + * The option was never unstable; it was covered. Only the field holding a + * select is raised, so nothing else changes. + */ +.dashboard-config__field--select { + position: relative; + z-index: 2; +} + +/* + * A field holding an NcSelect must paint ABOVE the fields that follow it. + * + * The modal is a column of fields. An NcSelect dropdown opens downward out + * of its own field and lands over the next one; those are LATER siblings + * with no stacking context, so they win and swallow the click. + * + * @nextcloud/vue 9.10 made this reachable by giving NcSelect a floating + * label (#8570), which makes the control taller and pushes the dropdown + * far enough down to reach them. The Playwright trace names the + * interception rather than leaving it to be guessed: + * + * - locator resolved to + * - attempting click action + * - element is visible, enabled and stable + * -

    Not shared with anyone yet.

    + * ... intercepts pointer events + * + * The option was never unstable; it was covered. + */ +.dashboard-config__field--select { + position: relative; + z-index: 2; +} + .dashboard-config__label { font-size: 13px; font-weight: 600; From 67b943192ecf1d2b6d673aac678571dbdb98b029 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Sun, 30 Aug 2026 18:41:28 +0200 Subject: [PATCH 4/7] =?UTF-8?q?revert(deps):=20re-pin=20@nextcloud/vue=20?= =?UTF-8?q?=E2=80=94=20the=20dropdown=20teleports=20under=20the=20modal=20?= =?UTF-8?q?mask=20(#452)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The stacking fix in #450 was built on the trace and was not enough. E2E on 9.11 with it merged is still 127 passed / 11 failed, the same eleven. The second trace names a bigger interceptor than the first one did: 70x class="modal-mask" 24x class="checkbox-content__text checkbox-radio-switch__text" 20x class="dashboard-config__hint" 18x class="visibility-rule-row__actions" 8x class="dashboard-config__field dashboard-config__public" is Nextcloud's own modal backdrop, and it dominates. A z-index inside the modal cannot lift the dropdown above the mask if the dropdown is no longer INSIDE the modal: 9.10's NcSelect appears to render its menu outside the dialog (appended/teleported), which puts it beneath the backdrop in stacking order. That is a different defect from the one #450 addressed, and it needs the menu kept in place or lifted above the mask -- not more per-component z-index. The CSS from #450 is KEPT. Those three smaller interceptors are real, the rule is documented against its trace, and it is inert while the dropdown renders inline on 9.9.0. So the pin goes back while that is worked out, because leaving development red to hold a position is not a trade worth making. This is not a decision that 9.11 is unusable -- it is a decision not to sit red while the portal behaviour is understood. Co-authored-by: Conduction Release Bot --- package-lock.json | 18 +++++++++--------- package.json | 2 +- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package-lock.json b/package-lock.json index 9b2e2851..33eca57c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16,7 +16,7 @@ "@nextcloud/initial-state": "^2.2.0", "@nextcloud/l10n": "^3.4.1", "@nextcloud/router": "^3.1.0", - "@nextcloud/vue": "^9.11.0", + "@nextcloud/vue": "~9.9.0", "dexie": "^4.4.5", "dompurify": "^3.4.14", "gridstack": "^12.2.1", @@ -4251,9 +4251,9 @@ } }, "node_modules/@nextcloud/vue": { - "version": "9.11.0", - "resolved": "https://registry.npmjs.org/@nextcloud/vue/-/vue-9.11.0.tgz", - "integrity": "sha512-LRsyU9Mxs0b2xWqbxygps8O7/i1z4QhNQD9/QDni+VqFY3V0N95mAgmKJm6vfoFuxTAMXERp9bjqFn3UV542gw==", + "version": "9.9.0", + "resolved": "https://registry.npmjs.org/@nextcloud/vue/-/vue-9.9.0.tgz", + "integrity": "sha512-TmKnBWp6Aiw+cm+WamwX5cMkhkpJqLSUKrTUB5I5Y9RDt2S0TUlwRaTe9vltBIV3qmKParhpZQ3/ewWHgEQlrQ==", "license": "AGPL-3.0-or-later", "dependencies": { "@ckpack/vue-color": "^1.6.0", @@ -4270,19 +4270,19 @@ "@nextcloud/sharing": "^0.4.0", "@nextcloud/vue-select": "^4.1.0", "@vuepic/vue-datepicker": "^11.0.3", - "@vueuse/components": "^14.4.0", - "@vueuse/core": "^14.4.0", + "@vueuse/components": "^14.3.0", + "@vueuse/core": "^14.3.0", "blurhash": "^2.0.5", "clone": "^2.1.2", "debounce": "^3.0.0", - "dompurify": "^3.4.14", + "dompurify": "^3.4.12", "emoji-mart-vue-fast": "^15.0.5", "escape-html": "^1.0.3", "floating-vue": "^5.2.2", "focus-trap": "^8.2.2", "linkifyjs": "^4.3.3", "mdast-util-to-string": "^4.0.0", - "p-queue": "^9.3.3", + "p-queue": "^9.3.1", "rehype-external-links": "^3.0.0", "rehype-highlight": "^7.0.2", "rehype-react": "^8.0.0", @@ -4299,7 +4299,7 @@ "unist-builder": "^4.0.0", "unist-util-visit-parents": "^6.0.2", "vue": "^3.5.18", - "vue-router": "^5.2.0" + "vue-router": "^5.1.0" }, "engines": { "node": "^20.11.0 || ^22 || ^24" diff --git a/package.json b/package.json index 2238ec08..03fca29a 100644 --- a/package.json +++ b/package.json @@ -41,7 +41,7 @@ "@nextcloud/initial-state": "^2.2.0", "@nextcloud/l10n": "^3.4.1", "@nextcloud/router": "^3.1.0", - "@nextcloud/vue": "^9.11.0", + "@nextcloud/vue": "~9.9.0", "dexie": "^4.4.5", "dompurify": "^3.4.14", "gridstack": "^12.2.1", From 8eddcfcd8f1c9b0b9c5fdda8c589b80e1ed53e6c Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Sun, 30 Aug 2026 19:08:15 +0200 Subject: [PATCH 5/7] test(deps): 9.11 again, with the dropdown z-index re-declared on body (#454) EXPERIMENT. Reverted in one commit if CI stays red. A real difference between the two versions, verified in the published packages: 9.9.0 --vs-dropdown-z-index: 9999 declared on body 9.11.0 --vs-dropdown-z-index: 9999 declared on .nc-select.v-select.select NcSelect renders its menu with appendToBody: true in BOTH versions -- so the menu is a child of and is NOT a descendant of the select root. A custom property declared on the root therefore cannot reach it, while one declared on body can. That is a plausible mechanism for the modal-mask interception the trace shows, and it is the only substantive CSS difference I found between the versions. WHAT I HAVE NOT SHOWN is that it is the cause. Probing a live 9.11 build on an isolated instance: with the rule: body --vs-dropdown-z-index=9999, menu z-index=100001 without the rule: body --vs-dropdown-z-index=9999, menu z-index=100001 Identical. Something else already declares the variable on body there, so that environment cannot tell the two states apart -- and it is the same environment that fails to reproduce the 11 failures at all. The probe is not evidence for the fix; it is evidence that the probe cannot judge it. CI is the only place the failure reproduces, so CI is where this gets judged. The rule is harmless either way: identical value, and inert once upstream fixes the scope. Co-authored-by: Conduction Release Bot --- css/launchpad.css | 29 +++++++++++++++++++++++++++++ package-lock.json | 18 +++++++++--------- package.json | 2 +- 3 files changed, 39 insertions(+), 10 deletions(-) diff --git a/css/launchpad.css b/css/launchpad.css index cd0d6de8..1804a21c 100644 --- a/css/launchpad.css +++ b/css/launchpad.css @@ -50,3 +50,32 @@ * math and produced double-stacking artefacts. The `c: 1` entry in the * BREAKPOINTS table already gives every widget the full row at <= 480 px. */ + +/** + * Restore the NcSelect dropdown's stacking, which @nextcloud/vue 9.10 broke. + * + * NcSelect renders its menu with `appendToBody: true` (the default in both + * 9.9 and 9.11), so the menu is a child of , NOT of the select. Its + * z-index comes from the `--vs-dropdown-z-index` custom property, which the + * menu can only pick up by INHERITANCE. + * + * 9.9.0 declared it on `body`, which the appended menu inherits: + * + * body { --vs-dropdown-z-index: 9999 } + * + * 9.11.0 moved the declaration onto the select root: + * + * .nc-select.v-select.select { --vs-dropdown-z-index: 9999 } + * + * The menu is not a descendant of that element, so it inherits nothing and + * falls back to vue-select's own default — which sits BELOW Nextcloud's modal + * backdrop. The dropdown then renders visibly but cannot be clicked: the + * Playwright trace shows the option "visible, enabled and stable" with + * `class="modal-mask"` intercepting the pointer, 70 times across 11 tests. + * + * Re-declaring it on `body` restores exactly what 9.9.0 did, and is harmless + * once upstream fixes the scope: the value is identical either way. + */ +body { + --vs-dropdown-z-index: 9999; +} diff --git a/package-lock.json b/package-lock.json index 33eca57c..9b2e2851 100644 --- a/package-lock.json +++ b/package-lock.json @@ -16,7 +16,7 @@ "@nextcloud/initial-state": "^2.2.0", "@nextcloud/l10n": "^3.4.1", "@nextcloud/router": "^3.1.0", - "@nextcloud/vue": "~9.9.0", + "@nextcloud/vue": "^9.11.0", "dexie": "^4.4.5", "dompurify": "^3.4.14", "gridstack": "^12.2.1", @@ -4251,9 +4251,9 @@ } }, "node_modules/@nextcloud/vue": { - "version": "9.9.0", - "resolved": "https://registry.npmjs.org/@nextcloud/vue/-/vue-9.9.0.tgz", - "integrity": "sha512-TmKnBWp6Aiw+cm+WamwX5cMkhkpJqLSUKrTUB5I5Y9RDt2S0TUlwRaTe9vltBIV3qmKParhpZQ3/ewWHgEQlrQ==", + "version": "9.11.0", + "resolved": "https://registry.npmjs.org/@nextcloud/vue/-/vue-9.11.0.tgz", + "integrity": "sha512-LRsyU9Mxs0b2xWqbxygps8O7/i1z4QhNQD9/QDni+VqFY3V0N95mAgmKJm6vfoFuxTAMXERp9bjqFn3UV542gw==", "license": "AGPL-3.0-or-later", "dependencies": { "@ckpack/vue-color": "^1.6.0", @@ -4270,19 +4270,19 @@ "@nextcloud/sharing": "^0.4.0", "@nextcloud/vue-select": "^4.1.0", "@vuepic/vue-datepicker": "^11.0.3", - "@vueuse/components": "^14.3.0", - "@vueuse/core": "^14.3.0", + "@vueuse/components": "^14.4.0", + "@vueuse/core": "^14.4.0", "blurhash": "^2.0.5", "clone": "^2.1.2", "debounce": "^3.0.0", - "dompurify": "^3.4.12", + "dompurify": "^3.4.14", "emoji-mart-vue-fast": "^15.0.5", "escape-html": "^1.0.3", "floating-vue": "^5.2.2", "focus-trap": "^8.2.2", "linkifyjs": "^4.3.3", "mdast-util-to-string": "^4.0.0", - "p-queue": "^9.3.1", + "p-queue": "^9.3.3", "rehype-external-links": "^3.0.0", "rehype-highlight": "^7.0.2", "rehype-react": "^8.0.0", @@ -4299,7 +4299,7 @@ "unist-builder": "^4.0.0", "unist-util-visit-parents": "^6.0.2", "vue": "^3.5.18", - "vue-router": "^5.1.0" + "vue-router": "^5.2.0" }, "engines": { "node": "^20.11.0 || ^22 || ^24" diff --git a/package.json b/package.json index 03fca29a..2238ec08 100644 --- a/package.json +++ b/package.json @@ -41,7 +41,7 @@ "@nextcloud/initial-state": "^2.2.0", "@nextcloud/l10n": "^3.4.1", "@nextcloud/router": "^3.1.0", - "@nextcloud/vue": "~9.9.0", + "@nextcloud/vue": "^9.11.0", "dexie": "^4.4.5", "dompurify": "^3.4.14", "gridstack": "^12.2.1", From 00181246bfd0c71e32d5183123c514499348ec91 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 30 Aug 2026 19:59:03 +0200 Subject: [PATCH 6/7] chore(release): 1.0.20-unstable.20260830175557 (#465) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- appinfo/info.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/appinfo/info.xml b/appinfo/info.xml index aba94b85..aa43d171 100644 --- a/appinfo/info.xml +++ b/appinfo/info.xml @@ -52,7 +52,7 @@ Ideaal voor organisaties die consistente, samengestelde dashboards willen voor h Vrij en open source onder de EUPL-1.2-licentie. ]]> - 1.0.16-unstable.20260829173006 + 1.0.20-unstable.20260830175557 EUPL-1.2 Conduction LaunchPad From deabdd74c327d3951a1ae17bcccc3ba72fbdfa47 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Sun, 30 Aug 2026 20:41:01 +0200 Subject: [PATCH 7/7] chore(dependabot): hold back the four majors that cannot be adopted (#468) Dependabot re-proposes these on every run, and each one takes `npm ci` or `npm run build` from green to red with no code change in this repository that can fix it. Closing the pull requests does nothing: without an ignore rule they come straight back. Each is blocked by a package we do not control, verified against the registry rather than assumed: - typescript 7 typescript-eslint hard-throws on TS >= 7 (a `versionMajor >= 7` guard in its dist/index.js) and every published version still peers `typescript: ">=4.8.4 <6.1.0"`. - webpack-cli 7 @nextcloud/webpack-vue-config 7.0.4, the LATEST, peers `webpack-cli: ^6.0.1`. - @babel/core 8 the same package peers `@babel/core: ^7.22.9`. - @babel/preset-env preset-env 8 requires core 8, so the pair moves together or not at all. Splitting them is what broke filinq. These are COMPATIBILITY limits, not security ones. `npm audit` reports no advisory against any version pinned here, so holding them costs no exposure. Lift each the moment its blocker ships support. Deliberately NOT held: stylelint 17, vitest 4 and pinia 4. All three were blocked earlier today and all three are now adoptable, so dependabot should keep proposing them. Co-authored-by: Conduction Release Bot --- .github/dependabot.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1ffe9d36..7a8476c5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,6 +6,32 @@ updates: interval: "weekly" target-branch: "development" open-pull-requests-limit: 10 + # HELD BACK DELIBERATELY, not out of caution. Each of these is blocked by a + # package we do not control, and dependabot cannot see that, so it proposes + # them on every run and each one takes `npm ci` or `npm run build` from + # green to red with no code change that can fix it. + # + # typescript 7: typescript-eslint hard-throws on TS >= 7 (a `versionMajor + # >= 7` guard in its dist/index.js) and every published + # version still peers `typescript: ">=4.8.4 <6.1.0"`. + # webpack-cli 7: @nextcloud/webpack-vue-config 7.0.4, the latest, peers + # `webpack-cli: ^6.0.1`. + # @babel/core 8: the same package peers `@babel/core: ^7.22.9`, and + # preset-env 8 requires core 8, so the pair moves together + # or not at all. + # + # Lift each the moment its blocker ships support. These are compatibility + # limits, not security ones: `npm audit` reports no advisory against any of + # the versions pinned here. + ignore: + - dependency-name: "typescript" + update-types: ["version-update:semver-major"] + - dependency-name: "webpack-cli" + update-types: ["version-update:semver-major"] + - dependency-name: "@babel/core" + update-types: ["version-update:semver-major"] + - dependency-name: "@babel/preset-env" + update-types: ["version-update:semver-major"] cooldown: default-days: 1 include: