chore(deps): pin @conduction/nextcloud-vue to 2.1.0-vue3.16

[rubenvdlinde]

Part of the fleet sweep bringing the already-migrated Vue 3 apps onto the current
nc-vue release. This is a version alignment, not a migration — the app was
already on Vue 3.

What changed

@conduction/nextcloud-vue → 2.1.0-vue3.16, pinned exactly, no caret.

Verified from the lockfile, not package.json

check	result
@conduction/nextcloud-vue	2.1.0-vue3.16, single instance, no nested duplicate
vue3-apexcharts	1.8.0 — below the 1.9.0 proprietary boundary

vue3-apexcharts became proprietary at 1.9.0 and forbids sublicensing, which our
EUPL-1.2 apps require. nc-vue pins it as a direct ~1.8.0 dependency, so the
tilde cannot reach 1.9.0. No licence override was added — core apexcharts
is MIT and reports an identical Custom: <url> symptom, so an override would
mask the real signal rather than encode it.

Install sequence used: rm -rf package-lock.json node_modules → npm install
(npm 11) → npm install --package-lock-only (npm 10) → npm ci (npm 10). Both
removals matter: with a stale node_modules, npm ERESOLVEs while blaming
vue@3.5.40, which points the reader at entirely the wrong dependency.

Opt-ins

Applied only where the app actually has the pattern.

• @nextcloud/initial-state overrides entry — not present in this app, so
  nothing to drop. vue3.16 relaxes that peer from ^2.2.0 to
  ^2.2.0 || ^3.0.0; this app already declared ^2.2.0, which satisfied the
  old peer too, so it never needed the override that vue3.16 makes unnecessary.
• local vue/no-multiple-template-root: 'off' — not present in this app.
• e2e base-URL resolver — left alone. This app's resolver already refuses to
  default to localhost:8080 (the shared dev container), so adopting nc-vue's
  shared resolver would be churn with no behaviour change.

Gates, each with a positive control

A green run means nothing without a control that can go red.

• lint — green. Positive control: a temporary .vue probe using
  $listeners and a destroyed() hook was linted and correctly produced
  vue/no-deprecated-dollar-listeners-api and
  vue/no-deprecated-destroyed-lifecycle errors, proving the Vue-3 deprecation
  rules are actually live. A .js probe would not have proven this — it never
  engages vue-eslint-parser. Probe removed; lint returns clean.
• build — green.
• unit — compared against a full baseline run of this branch's merge base
  by failing test name, never by count. Equal counts routinely hide a swap.

CI ref audit

Checked for the embedded-ref trap (a uses:-org-ref fix does not cover refs
embedded in workflow inputs). This app's additional-apps entries and every
reusable-workflow uses: were resolved against the API with ?ref=, alongside a
deliberate 404 as a negative control. All resolve. No wrong-org refs.

unit detail — one PRE-EXISTING failure, unchanged by this PR

Baseline (merge base, nc-vue 2.1.0-vue3.15): 140 files / 1364 tests,
1 failed.
After the bump (nc-vue 2.1.0-vue3.16): 140 files / 1364 tests, 1 failed.

Compared by failing test name, not by count — the sets are identical:

tests/vitest/SaveAsTemplateAction.spec.js > ApplicationDetailActions —
  Save as template action (REQ-SAT-001) >
  openSaveAsTemplate gathers schemas + templates and opens the dialog

It is a real assertion failure, not a flake: expected [] to deeply equal [{ slug: 'permit-pack', isSeeded: false }] — existingTemplates is empty
where the test expects one entry. It reproduces deterministically when run in
isolation under low machine load, so it is not load-induced.

It is not caused by this PR — it fails identically on the unmodified merge
base. It is deliberately not fixed here: a version-alignment PR is the wrong
place for a behavioural fix, and neither .skip, a weakened assertion, nor a
raised timeout was used to make the number move.

Worth flagging separately: this failure is invisible to CI. The shared
ConductionNL/.github quality.yml runs PHPUnit but contains no vitest /
npm test / test:unit invocation, and openbuild's own workflows do not add
one — so the JS unit suite is currently an unenforced gate fleet-wide.

[github-actions]

Quality Report — ConductionNL/openbuild @ cc7b465

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 662/662
PHPUnit					✅
Newman					⏭️
Playwright					⏭️

Coverage: 89.4% (17/19 statements)

---

Quality workflow — 2026-08-02 18:57 UTC

Download the full PDF report from the workflow artifacts.