fix(deps): resolve the peer chain so npm ci works

[rubenvdlinde]

npm ci failed with ERESOLVE, so every frontend job failed before running a single check.

Majors had landed without the peers that must move with them. These packages are a set: bumping one alone leaves another declaring a range the new version cannot satisfy, and npm rejects the whole tree rather than the single package.

Fixing them one at a time simply walks the list — each correction exposes the next conflict underneath. That happened three times here before the whole set was taken together:

1st   node-polyfill 4.1.0   vs  webpack-vue-config pins 4.0.0
2nd   postcss-html 2.0.0    vs  stylelint-config-recommended-vue peers ^1
3rd   stylelint-config-html 2.0.0  itself requires postcss-html ^2

That third one is why reverting postcss-html alone did not work: the v2 line was being pulled in by a package I had left alone.

Two things worth recording

@nextcloud/webpack-vue-config pins an entire build toolchain, not a couple of packages — babel-loader, css-loader, sass, sass-loader, style-loader, ts-loader, webpack, webpack-cli, webpack-dev-server and node-polyfill — several at exact versions rather than ranges.

The pinned version differs by minor, not just major. 6.0.1 pins node-polyfill 3.0.0; 6.3.2 pins 4.0.0. A rule of thumb based on the major is wrong.

Every range here is the one npm itself demanded in the ERESOLVE it reported, not a version chosen by hand.

Verified: the lockfile resolves from a clean tree, where it previously exited on ERESOLVE.

[github-actions]

Quality Report — ConductionNL/stackiq @ a83b74e

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 130/130
npm			✅	✅ 711/711
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					🚨 NO VERDICT — enabled but never ran
Hydra gates					✅

---

Quality workflow — 2026-08-31 00:48 UTC

Download the full PDF report from the workflow artifacts.