chore(deps): repin @conduction/nextcloud-vue to 2.2.0-vue3.3 (3.0.0-vue3.6 was unpublished)

[rubenvdlinde]

Why

@conduction/nextcloud-vue 3.0.0-vue3.1 … 3.0.0-vue3.6 were unpublished from npm, and npm never permits reuse of an unpublished version number — the old pin is permanently dead:

$ npm view @conduction/nextcloud-vue@3.0.0-vue3.6 version
npm error code E404 — No match found for version 3.0.0-vue3.6

npm ci therefore cannot succeed on development. Fleet-blocking.

What

Old pin	3.0.0-vue3.6 — dead (E404)
New pin	2.2.0-vue3.3 — live, current vue3 dist-tag
Dead refs in package-lock.json	3 → 0

Pinned exactly (no caret), per fleet convention.

Verification

• Lockfile regenerated with npm 10.8.2, not local npm 11. CI runs node 20 / npm 10; an npm-11-written lockfile prunes platform-inapplicable optional entries and makes CI's npm ci fail Missing: … from lock file while a local npm ci still passes. Using npm 10 avoids that false green.
• Cold npm ci (fresh isolated cache, npm 10.8.2): exit 0, zero Missing: lines.
• Build USE_LOCAL_LIB=false npm run build: exit 0, 0 Module not found, 0 export … was not found. (USE_LOCAL_LIB=false matters — webpack.config.js aliases the package to a sibling ../nextcloud-vue/src checkout when present, so a plain build can compile the sibling and prove nothing about the pin.)
• Unit tests npm run test:js-unit (node --test): 5/5 passing. This repo has no vitest/jest test script.
  A "before" run is impossible — npm ci cannot install the dead pin, so no baseline number exists.
• UI-surface check: all 19 identifiers src/ imports from @conduction/nextcloud-vue resolve against the installed 2.2.0-vue3.3 (574 exports).

One thing worth recording

src/components/admin/ActionAuthMatrix.vue imports NcButton and NcCheckboxRadioSwitch from @conduction/nextcloud-vue rather than from @nextcloud/vue. That is fine: nc-vue's ESM entry does export * from '@nextcloud/vue', so both names are genuinely re-exported (confirmed in @nextcloud/vue@9.9.0's dist/index.mjs), and the build emits no export … was not found. Noting it because the indirection is load-bearing — if nc-vue ever drops that blanket re-export, this file breaks silently with no build error.

Scope

Only package.json + package-lock.json. The bundle is gitignored here (no tracked js//dist/). E2E (playwright) not run — needs a live Nextcloud instance.

[github-actions]

Quality Report — ConductionNL/scholiq @ a12cacd

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
composer			✅	✅ 100/100
npm			✅	✅ 750/750
PHPUnit					✅
Newman					⏭️
Playwright					⏭️
Hydra gates					❌

---

Quality workflow — 2026-08-05 15:12 UTC

Download the full PDF report from the workflow artifacts.