chore(dependabot): hold back the four majors that cannot be adopted

[rubenvdlinde]

Why

Dependabot re-proposes these on every run, and each takes npm ci or npm run build from green to red with no code change in this repository that can fix it. Closing the pull requests does nothing: without an ignore rule they come straight back. That is the loop this ends.

Each blocker, checked against the registry rather than assumed

Major	Blocked by
typescript 7	typescript-eslint hard-throws on TS >= 7 (a versionMajor >= 7 guard in its dist/index.js), and every published version still peers typescript: ">=4.8.4 <6.1.0"
webpack-cli 7	@nextcloud/webpack-vue-config 7.0.4, the latest, peers webpack-cli: ^6.0.1
@babel/core 8	the same package peers @babel/core: ^7.22.9
@babel/preset-env 8	requires core 8, so the pair moves together or not at all. Splitting them is exactly what broke filinq

Not a security trade

These are compatibility limits. npm audit reports no advisory against any version pinned here, so holding them costs no exposure. Lift each the moment its blocker ships support.

Deliberately not held

stylelint 17, vitest 4 and pinia 4. All three were blocked this morning and all three are now adoptable, so dependabot should keep proposing them.

[github-actions]

Quality Report — ConductionNL/stackiq @ 979b295

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 130/130
npm			✅	✅ 713/713
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					🚨 NO VERDICT — enabled but never ran
Hydra gates					✅

---

Quality workflow — 2026-08-30 21:08 UTC

Download the full PDF report from the workflow artifacts.