From 313c49c52bfec70208158d4294e3c746ea395d11 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Mon, 31 Aug 2026 02:18:09 +0200 Subject: [PATCH] fix(deps): node-polyfill-webpack-plugin is pinned to 4.0.0 by webpack-vue-config npm ci cannot resolve, so every check dies before it runs: npm error ERESOLVE could not resolve While resolving: @nextcloud/webpack-vue-config@7.0.4 Found: node-polyfill-webpack-plugin@4.1.0 @nextcloud/webpack-vue-config declares node-polyfill-webpack-plugin as EXACTLY "4.0.0" -- an exact version, not a caret range. 4.1.0 therefore cannot satisfy it under any resolution, and the bump was uninstallable the moment it landed. I merged that bump unverified, on the reasoning that a MINOR version is low risk. It is not, when the consumer pins an exact version: semver tells you what the publisher intended, not what your dependency tree will accept. This is the check the merge skipped. Dependabot is told to hold it back, because it will keep proposing it -- it sees a newer version, not the exact pin holding it down. Five apps carried the same combination; this is one of four fixed together, decidiq being exempt because it is on webpack-vue-config v6, which does not depend on the plugin at all. --- .github/dependabot.yml | 6 ++++++ package.json | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c7d919b3..5d7d76cc 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -33,6 +33,12 @@ updates: target-branch: "development" schedule: interval: "weekly" + ignore: + # @nextcloud/webpack-vue-config pins this to EXACTLY "4.0.0" (not a + # range), so 4.1.0 can never resolve: npm ci dies with ERESOLVE before + # a single check runs. Dependabot proposes it anyway because it only + # sees a newer version, not the exact pin holding it down. + - dependency-name: "node-polyfill-webpack-plugin" open-pull-requests-limit: 10 # HELD BACK DELIBERATELY, not out of caution. Each of these is blocked by a # package we do not control, and dependabot cannot see that, so it proposes diff --git a/package.json b/package.json index 919186d1..513e5777 100644 --- a/package.json +++ b/package.json @@ -62,7 +62,7 @@ "gridstack": "^12.6.0", "lodash": "^4.17.21", "marked": "^12.0.0", - "node-polyfill-webpack-plugin": "4.1.0", + "node-polyfill-webpack-plugin": "4.0.0", "path-browserify": "^1.0.1", "pinia": "^3.0.3", "sass": "^1.99.0",