Surfaced during openconnector's SBOM job triage (ConductionNL/openconnector#890).
State after beta.71
@conduction/nextcloud-vue@1.0.0-beta.71's package.json only declares @nextcloud/vue@^8.0.0, but a clean npm install still places @nextcloud/vue@9.8.0 at node_modules/@conduction/nextcloud-vue/node_modules/@nextcloud/vue. Some transitive dep is bringing v9 in.
Concrete symptoms
npm ls --json --long --all --package-lock-only --omit=dev exits non-zero with:
npm error code ELSPROBLEMS
npm error invalid: vue@3.5.34 .../node_modules/@conduction/nextcloud-vue/node_modules/vue
npm error missing: @types/react@>=17, required by rehype-react@7.2.0
npm error missing: jquery@1.9.1 - 3, required by bootstrap@4.6.2
npm error invalid: vue@2.7.16 .../node_modules/vue
npm error invalid: pinia@2.3.1 .../node_modules/pinia
npm error invalid: picomatch@2.3.2 .../node_modules/picomatch
Root causes
-
Transitive @nextcloud/vue@9 inclusion — some lower-level dep declares it as a dep (not just a peer). With @nextcloud/vue@9 come Vue-3-peer-requiring packages: @ckpack/vue-color, @vue/server-renderer@3.5.34, @vuepic/vue-datepicker, vue-router@4 (which then peer-requires pinia@^3)
-
rehype-react@7.2.0 requires @types/react@>=17 — Vue 3 / React mismatch in the tree; rehype-react is for React projects, not Vue ones. Likely should be swapped for a Vue-native rehype renderer
-
bootstrap@4.6.2 requires jquery — bootstrap-vue@2 brings in classic Bootstrap 4 which needs jQuery; if bootstrap-vue is actually used, the peer should be declared; if not, the dep should be dropped
Asks
- Find + drop the transitive
@nextcloud/vue@9 pull-in
- Replace
rehype-react with a Vue-compatible renderer (e.g. vue-rehype or render markdown via marked + a Vue wrapper)
- Decide if
bootstrap-vue/bootstrap@4 is still wanted; if yes, declare jquery properly; if no, drop
Impact
Blocks SBOM job on ConductionNL/openconnector (and likely all consumers of nc-vue). Doesn't currently block functionality — build passes, runtime works — but it's noise and prevents proper supply-chain inventory generation.
Surfaced during openconnector's SBOM job triage (
ConductionNL/openconnector#890).State after beta.71
@conduction/nextcloud-vue@1.0.0-beta.71'spackage.jsononly declares@nextcloud/vue@^8.0.0, but a cleannpm installstill places@nextcloud/vue@9.8.0atnode_modules/@conduction/nextcloud-vue/node_modules/@nextcloud/vue. Some transitive dep is bringing v9 in.Concrete symptoms
npm ls --json --long --all --package-lock-only --omit=devexits non-zero with:Root causes
Transitive
@nextcloud/vue@9inclusion — some lower-level dep declares it as a dep (not just a peer). With@nextcloud/vue@9come Vue-3-peer-requiring packages:@ckpack/vue-color,@vue/server-renderer@3.5.34,@vuepic/vue-datepicker,vue-router@4(which then peer-requirespinia@^3)rehype-react@7.2.0requires@types/react@>=17— Vue 3 / React mismatch in the tree;rehype-reactis for React projects, not Vue ones. Likely should be swapped for a Vue-native rehype rendererbootstrap@4.6.2requiresjquery—bootstrap-vue@2brings in classic Bootstrap 4 which needs jQuery; if bootstrap-vue is actually used, the peer should be declared; if not, the dep should be droppedAsks
@nextcloud/vue@9pull-inrehype-reactwith a Vue-compatible renderer (e.g.vue-rehypeor render markdown viamarked+ a Vue wrapper)bootstrap-vue/bootstrap@4is still wanted; if yes, declarejqueryproperly; if no, dropImpact
Blocks
SBOMjob onConductionNL/openconnector(and likely all consumers of nc-vue). Doesn't currently block functionality — build passes, runtime works — but it's noise and prevents proper supply-chain inventory generation.