fix(deps): restore installable @babel/core and stylelint-config-html constraints

[rubenvdlinde]

Why

PRs #506 (@babel/core 7.29.7 -> 8.0.1) and #504 (stylelint-config-html 1.1.0 -> 2.0.0) were merged into development while their CI was red. Neither major is installable against this app's current upstream pins, so npm ci on development now fails with ERESOLVE and every frontend job is broken.

Reproduced on development @ 46db69e with npm 11 (the version engines requires):

npm error code ERESOLVE
npm error Could not resolve dependency:
npm error peer @babel/core@"^7.22.9" from @nextcloud/webpack-vue-config@7.0.4
npm error Conflicting peer dependency: @babel/core@7.29.7

The two upstream ceilings

@babel/core 8 — @nextcloud/webpack-vue-config@7.0.4 is the latest published version and declares peer @babel/core "^7.22.9". Every published 7.x (7.0.0 - 7.0.4) carries the same range. No release accepts Babel 8.

stylelint-config-html 2 — it requires peer postcss-html "^2.0.0", but @nextcloud/stylelint-config@3.2.2 (latest) pins stylelint-config-recommended-vue "^1.6.1", which pins postcss-html "^1.0.0". Bumping the whole cluster to stylelint-config-recommended-vue@2.0.0 does not help — it just relocates the conflict onto @nextcloud/stylelint-config itself.

Both unblock only when Nextcloud publishes updated configs.

What this does

Restores the two constraints to their last installable values (@babel/core: ^7.26.9, stylelint-config-html: ^1.1.0) and regenerates package-lock.json. No source changes.

Verified locally (npm 11)

Check	Result
npm ci	clean
npm run stylelint	0 errors (42 warnings, unchanged)
npm run lint (eslint)	0 errors (142 warnings, unchanged)
npm run build (webpack production)	compiled, 0 errors
npm test (vitest)	141 files, 1378 tests passed

Follow-up

stylelint-config-html and postcss-html are redundant direct devDependencies — stylelint.config.js extends only @nextcloud/stylelint-config, and both packages arrive transitively via stylelint-config-recommended-vue. Dropping both direct pins was verified to keep npm ci clean with byte-identical stylelint output, and would stop this conflict recurring.

[github-actions]

Quality Report — ConductionNL/buildiq @ 292f432

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
check-gitignore		✅
check-nc-floor		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 106/106
npm			✅	✅ 640/640
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					🚨 NO VERDICT — enabled but never ran
Hydra gates					✅

---

Quality workflow — 2026-08-30 09:15 UTC

Download the full PDF report from the workflow artifacts.