chore(deps): consolidate three dependabot lockfile bumps and resync the lockfile

[rubenvdlinde]

Consolidates #81, #110 and #116 into one lockfile regeneration, and repairs the package.json/package-lock.json desync that made npm ci fail under CI's toolchain. Those three are superseded and will be closed with their content recorded here.

What moves

package	from	to	from PR
@playwright/test	1.61.1	1.62.1	#116
@vitejs/plugin-vue	6.0.1	6.0.8	#110
vite	7.3.3	7.3.6	#81
dompurify	3.4.2	3.4.13	#81
qs / form-data / babel		6.15.3 / 4.0.6 / 7.29.7	#81

Refused: jsdom 30 (#117)

#117 is breaking on this repo and is not included. jsdom@30.0.1 declares:

engines: { node: '^22.22.2 || ^24.15.0 || >=26.0.0' }

and this repo's .nvmrc pins node 20. Under CI every vitest worker dies with:

TypeError: webidl.util.markAsUncloneable is not a function
  at node_modules/jsdom/lib/api.js:12:33

markAsUncloneable is an undici API that does not exist on node 20. This was measured both ways: green on a node 22 dev box, red on CI's node 20 — same commit, opposite verdict. jsdom@29.1.1 supports ^20.19.0 and is retained.

Worth noting the underlying inconsistency: package.json engines claims node ^24.0.0 while .nvmrc says 20. Reconciling those is a deliberate decision, not a dependabot merge.

The desync this fixes

development was missing a nested picomatch entry, so npm ci failed under node 20 / npm 10 (CI, per .nvmrc):

npm error code EUSAGE
npm error Missing: picomatch@4.0.5 from lock file

…while npm 11 installed the same commit cleanly. That asymmetry is why it survived on dev boxes. It also explains the 9 red jobs on development — Frontend Build, Frontend Tests, License (npm), Security (npm), eslint and stylelint all fail simply because the install fails.

Evidence (cold cache, exit codes read directly)

check	base (development)	this branch
npm ci node20/npm10 (CI)	exit 1 — Missing picomatch	exit 0, 992 pkgs
vitest run under node 20	(cannot install)	exit 0, 11 files / 58 tests
npm run build under node 20	(cannot install)	exit 0, 410.07 kB
npm ci node22/npm11	exit 0, 961 pkgs	exit 0, 994 pkgs
npm run build node22	exit 0, 401.96 kB	exit 0, 410.07 kB
vitest run node22	exit 0, 11 files / 58 tests	exit 0, 11 files / 58 tests

Both arms cold — cache emptied before each install.

The build check was positive-controlled: a deliberately bogus import makes it exit 1 with Could not resolve, so the exit-0 above is a real pass and not a check incapable of firing.

Hazard screen: no vue3-apexcharts and no @conduction/nextcloud-vue anywhere in this tree, so neither pin can move here.

[github-actions]

Quality Report — ConductionNL/app-versions @ 51d617e

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		❌
build		✅
composer			✅	✅ 17/17
npm			✅	✅ 306/306
PHPUnit					❌
Newman					⏭️
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-05 20:58 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/app-versions @ f7ad0e4

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		❌
build		✅
composer			✅	✅ 17/17
npm			✅	✅ 306/306
PHPUnit					❌
Newman					⏭️
Playwright					❌
Hydra gates					✅

---

Quality workflow — 2026-08-05 21:09 UTC

Download the full PDF report from the workflow artifacts.