chore(deps): upgrade @conduction/nextcloud-vue to 3.0.0-vue3.4

[rubenvdlinde]

Summary

Upgrades @conduction/nextcloud-vue from 2.1.0-vue3.17 to 3.0.0-vue3.4 (exact pin, no caret/tilde).

Only package.json and package-lock.json change — no source changes were required.

Lockfile verification

Verified from package-lock.json (not package.json, not npm ls):

Package	Locked version	Notes
@conduction/nextcloud-vue	3.0.0-vue3.4	resolved tarball nextcloud-vue-3.0.0-vue3.4.tgz
vue3-apexcharts	1.8.0	below the proprietary 1.9.0 line, license: MIT, no override needed
apexcharts	4.7.0	unchanged

Lockfile sanity: 1133 package entries / 563 KB, versus 1133 entries on the base SHA — no silent under-resolution (e.g. a // key inside overrides making npm resolve zero deps while reporting "up to date").

Regeneration sequence: rm -rf package-lock.json node_modules → npm 11.13.0 npm install → npm 10.9.8 npm install --package-lock-only → npm 10.9.8 npm ci.

Note: this repo's .npmrc sets min-release-age=1, and 3.0.0-vue3.4 was published 2026-08-03T19:53Z (under 24 h). The npm 11 resolution step therefore used --min-release-age=0, the escape hatch documented in .npmrc itself for fresh @conduction/* releases. .npmrc is not modified by this PR. npm ci installs from the lockfile without re-resolving, so CI is unaffected (verified locally under npm 11).

Breaking surface — 3.0.0 removed 3 components

CnFlowCanvas, CnEditFlowsModal, CnFlowCanvasModal — zero occurrences in src/ and in built js/.

Control 1 — greps demonstrably match (not false zeros):

Query	src/	built js/
CnFlowCanvas	0	0
CnEditFlowsModal	0	0
CnFlowCanvasModal	0	0
CnDetailPage (retained)	10	4 files
CnDashboardPage (retained)	—	4 files
CnFlowEditModal (retained)	—	4 files
Cn (any)	44	24 files
ZZQQXX (nonexistent)	0	0

Control 2 — removed-vs-retained confirmed against the installed library (node_modules/@conduction/nextcloud-vue/dist/esm/index.js):

• CnFlowEditModal → present (retained)
• CnDetailPage → present (retained)
• CnFlowCanvas / CnEditFlowsModal / CnFlowCanvasModal → absent (removed in 3.0.0)

So the distinction is real in the shipped library, and the bundle greps can distinguish a present symbol from an absent one.

Local gates

Gate	Result
USE_LOCAL_LIB=false npm run build	pass (exit 0; 2 pre-existing asset/entrypoint size warnings only)
npm run lint (eslint)	pass (exit 0; 2 pre-existing jsdoc/require-param warnings, 0 errors)
npm run stylelint	pass (exit 0; 2 deprecation notices from the shared config)
JS unit tests	none exist — repo has no vitest/jest config or script
npm run test:e2e (Playwright)	not run locally — needs a live Nextcloud instance; left to CI
PHP tests (tests/)	not run locally — unaffected by a JS dependency bump; left to CI

webpack.config.js contains no USE_LOCAL_LIB reference, so deskdesk does not alias a sibling nextcloud-vue checkout; the env var was set anyway and is a no-op here. js/ is gitignored and not committed.