fix(deps): node-polyfill-webpack-plugin is pinned to 4.0.0 by webpack-vue-config

[rubenvdlinde]

npm ci cannot resolve, so every check dies before it runs:

npm error ERESOLVE could not resolve
While resolving: @nextcloud/webpack-vue-config@7.0.4
Found: node-polyfill-webpack-plugin@4.1.0

@nextcloud/webpack-vue-config declares the plugin as exactly "4.0.0" — not a caret range:

node-polyfill-webpack-plugin: '4.0.0'

So 4.1.0 cannot satisfy it under any resolution. The bump was uninstallable the moment it landed.

This one is mine

I merged that bump unverified, on the reasoning that a MINOR version is low risk. That reasoning is wrong when the consumer pins an exact version: semver tells you what the publisher intended, not what your dependency tree will accept. Merging without letting npm ci run is precisely the check that would have caught it.

Scope

Five apps carried the same combination. Four are fixed together; decidiq is exempt because it is on @nextcloud/webpack-vue-config v6, which does not depend on the plugin at all — checked rather than assumed.

App	before	webpack-vue-config
filinq	4.1.0	^7.0.2
stackiq	4.1.0	^7.0.2
pipelinq	4.1.0	^7.0.4
planninq	4.1.0	^7.0.2

Dependabot is also told to hold this package back, because it will keep proposing it — it sees a newer version, not the exact pin holding it down.

[github-actions]

Quality Report — ConductionNL/stackiq @ fb39e4a

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		❌
stylelint		❌
build		❌
check-manifest		❌
check-vue-demi		❌
test-l10n		❌
format		❌
check-schema-l10n		❌
check-l10n-js		❌
composer			✅	✅ 130/130
npm			❌	❌
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					🚨 NO VERDICT — enabled but never ran
Hydra gates					❌

---

Quality workflow — 2026-08-31 00:39 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Closing as redundant: development already carries node-polyfill-webpack-plugin@4.0.0, so this change is a no-op against the current base.

Another session reached the same conclusion while this was open — @nextcloud/webpack-vue-config pins the plugin to exactly "4.0.0", so 4.1.0 can never resolve and npm ci dies with ERESOLVE before any check runs.

The holdback in .github/dependabot.yml from this branch is worth keeping if it is not already present elsewhere: Dependabot will keep proposing 4.1.0, because it sees a newer version rather than the exact pin holding it down.