fix(deps): sync package-lock.json — npm ci failed, taking all six frontend jobs with it

[rubenvdlinde]

Six jobs have been red on development: Vue Quality (eslint), Vue Quality (stylelint), License (npm), Security (npm), SBOM, Quality Report. They share one cause — and it is not any of the tools they are named after.

What was actually failing

Every one of those jobs runs npm ci first, and npm ci refused to install:

npm error `npm ci` can only install packages when your package.json and
npm error package-lock.json are in sync.
npm error Missing: pinia@4.0.2 from lock file
npm error Missing: vite@8.2.0 from lock file
npm error Missing: esbuild@0.28.1 from lock file

No linter ever ran. The jobs weren't reporting lint failures — they were reporting that install died before reaching a linter, which reads identically on the dashboard.

Where they came from

The missing entries are transitive. Nothing declares pinia@4 or vite@8; the declared ranges are ^2.1.7 and ^5.4.0. They arrived with the @conduction/nextcloud-vue 2.1.0-vue3.15 bump (#87), whose lockfile regeneration didn't capture the new transitive graph.

Why nobody noticed locally

An existing node_modules already contains the packages, so npm run lint passes on a dev machine and npm ls reports the tree resolves fine. Only npm ci — which installs from the lockfile rather than the tree — can see it. I only reproduced it by running under CI's node 20 instead of my local node 22.

The diff is purely additive

declared dependency versions changed	0
packages added	63
packages removed	0

Verified under node:20 after the fix

npm ci                                       OK  (was EUSAGE)
npm run lint                                 clean
npm run stylelint                            clean
npm audit --audit-level=critical --omit=dev  exit 0

Audit reports 10 vulnerabilities (5 low, 4 moderate, 1 high) — all below the critical gate the job enforces.

One licence fell outside my first hand-written allowlist replica — domain-browser@5.7.0 (Artistic-2.0, via node-polyfill-webpack-plugin). It is on the shared workflow's real allowlist; my replica was incomplete, not the licence.

[github-actions]

Quality Report — ConductionNL/openbuild @ 4284f25

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 659/659
PHPUnit					✅
Newman					⏭️
Playwright					⏭️

Coverage: 89.4% (17/19 statements)

---

Quality workflow — 2026-08-02 15:22 UTC

Download the full PDF report from the workflow artifacts.