chore(deps): move @conduction/nextcloud-vue to ^2.3.0

[rubenvdlinde]

Why now

@conduction/nextcloud-vue@2.3.0 is released, and the vue3 and latest dist-tags have converged on it — the separate 2.2.0-vue3.N line is over.

The exact 2.2.0-vue3.16 pin left this app five releases behind and made a caret range impossible to express, because the -vue3.N prereleases don't order the way callers expect.

A caret also unblocks local library development: the sibling-checkout guard validates ../nextcloud-vue against this app's declared range, so an exact pin refused every sibling that wasn't byte-identical — including newer ones.

Verified, not assumed

• npm install resolves 2.3.0
• npm ci reproduces it — run explicitly, because npm install does not re-run postinstall hooks for an already-present version, which is exactly how vue-demi ends up on the wrong shim
• production build: exit 0, 0 errors
• the app renders in the browser with cache disabled — a clean webpack build is precisely what the recent vue-router breakage produced, so the build alone isn't evidence

All 17 apps in this sweep render. Lockfile diff is +5/-5 — the version lines and nothing else.

Note for reviewers

2.3.0 declares the same peerDependencies as 2.2.0-vue3.16 — dexie, marked, dompurify, gridstack, @vueuse/core, @nextcloud/capabilities and friends. Those app-level declarations are required by the library, not redundant, and must not be pruned as "unused dependencies". (I initially mis-flagged 70 such declarations as dead before checking the peer list.)

Not included

nldesign is excluded. It's the only app where nc-vue is a build-time icon source (devDependencies) rather than a runtime dep, and npm install there pruned its @gouvfr/dsfr optional dependency, gutting the lockfile by 2,312 lines. Reverted and left for separate handling, since a bump there changes the generated icon set.

[github-actions]

Quality Report — ConductionNL/launchpad @ 8290dfb

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
format		✅
composer			✅	✅ 104/104
npm			✅	✅ 536/536
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-15 19:01 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/launchpad @ fbbb6b9

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
format		✅
composer			✅	✅ 104/104
npm			✅	✅ 536/536
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-15 23:20 UTC

Download the full PDF report from the workflow artifacts.