Fleet-wide: `npm install --legacy-peer-deps` workaround needs root-cause fix

[rubenvdlinde]

Updated diagnosis (2026-05-23)

Reproduction on docudesk with npm install (no flags) shows two distinct peer-dep conflicts, not one:

Conflict 1: babel-loader@10 vs @nextcloud/webpack-vue-config@6 peer ^9.1.3

3 apps explicitly pin babel-loader@^10.1.1 in package.json (docudesk, pipelinq, larpingapp) to work around an upstream issue. But the installed @nextcloud/webpack-vue-config@6.0.1 declares babel-loader: ^9.1.3 as a peer → npm rejects.

Fix: bump @nextcloud/webpack-vue-config from ^6.0.1 to ^7.0.2. The 7.x line declares babel-loader: ^10.0.0 as peer, matching what we're pulling.

Cascade (peer-dep changes in v7 vs v6):

Dep	v6 peer	v7 peer
babel-loader	^9.1.3	^10.0.0 ✓
css-loader	^6.8.1	^7.1.1
node-polyfill-webpack-plugin	3.0.0	4.0.0
sass-loader	^13.3.2	^16.0.2
style-loader	^3.3.3	^4.0.0
webpack-cli	^5.1.4	^6.0.1
webpack-dev-server	^4.15.1	^5.0.2
vue-loader	^15.10.1	^15.11.1 || ^17.4.2
vue	^2.7.16	^2.7.16 || ^3.5.13

Each cascade dep needs to bump too. Manageable per-app but not 1-line per repo.

Conflict 2: TypeScript ESLint resolver chain

@nextcloud/eslint-config@8.4.1 → eslint-import-resolver-typescript@^3.6.1
  → eslint-plugin-import-x@4.16.2 (peerOptional)
    → @typescript-eslint/utils@8.59.4

CLASHES with @vue/eslint-config-typescript@^13.0.0 which wants a different version.

Independent of Conflict 1. Likely affects npm run lint in CI too (we've seen "eslint-plugin-import not found" fleet-wide).

Fix path (less obvious):

• Either bump @vue/eslint-config-typescript to a version that aligns on the resolver chain
• Or pin @typescript-eslint/utils resolution at root
• Or move the eslint config into a shared upstream package (@conduction/nextcloud-vue ships ESLint preset?) so the version pinning happens once

Recommended action

Two separate tracked PRs per app, both small but careful:

1. chore(deps): bump @nextcloud/webpack-vue-config 6 → 7 + cascade — per affected app (docudesk, pipelinq, larpingapp first; verify build still passes; then proceed across the rest of the fleet that ships v6)
2. chore(lint): resolve typescript-eslint utils version clash — likely upstream in @conduction/nextcloud-vue if there's a shared eslint config there; otherwise per-app

After both ship across the fleet, npm install should work flag-free and npm run lint should pass without the eslint-plugin-import not found symptom.

Previous incorrect diagnosis

The original issue body said webpack-vue-config@6.0.1 (no @nextcloud/ namespace). That package doesn't exist; the correct package is @nextcloud/webpack-vue-config. Also the diagnosis omitted Conflict 2.

[rubenvdlinde]

Pilot bump attempt on docudesk — partial reproduction confirms cascade depth

Tried bumping `@nextcloud/webpack-vue-config` 6.0.1 → 7.0.2 on docudesk + the cascade deps (`node-polyfill-webpack-plugin` 3→4, `css-loader` 6→7, `style-loader` 3→4). `sass-loader` 16.0.8 already in v7 range.

Hit another blocker: `webpack-cli` is direct-pinned at `^7.0.2` on docudesk, but `@nextcloud/webpack-vue-config@7.0.2` peers for `webpack-cli: ^6.0.1` (does NOT accept v7).

```
peer webpack-cli@"^6.0.1" from @nextcloud/webpack-vue-config@7.0.2
Found: webpack-cli@7.0.2 (root project devDep)
```

Either:

• (a) Downgrade `webpack-cli` 7 → 6 fleet-wide (preserves v7 of webpack-vue-config, but webpack-cli is going backwards)
• (b) Wait for `@nextcloud/webpack-vue-config@8.x` that accepts `webpack-cli@^7` (no v8 yet)
• (c) Accept the peer warning and keep `--legacy-peer-deps` for this specific clash; only solve the babel-loader one

The cascade is real but won't resolve cleanly until either:

• nextcloud-libraries ships a webpack-vue-config that aligns all peers with the current generation of plugins (likely a v8 line), OR
• the fleet downgrades webpack-cli (regression in tooling generation)

Recommendation: track this as fleet-coordination work, not a per-app one-PR drop-in. Maybe open an upstream issue at https://github.com/nextcloud-libraries/webpack-vue-config asking for a webpack-cli@7 compatible release.

Aborted the docudesk pilot — left package.json untouched.