From 3f3ccbdcc3ac9f76efa5ddcf02ee12ec4b6adf77 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
<41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 30 Aug 2026 19:59:31 +0200
Subject: [PATCH 1/2] chore(release): 0.2.6-unstable.20260830154417 (#1371)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
appinfo/info.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/appinfo/info.xml b/appinfo/info.xml
index b5c72471c..d5512480f 100644
--- a/appinfo/info.xml
+++ b/appinfo/info.xml
@@ -26,7 +26,7 @@ Vrij en open source onder de EUPL-1.2-licentie.
**Ondersteuning:** Voor ondersteuning, neem contact op via support@conduction.nl.
]]>
- 0.2.3-unstable.20260829195247
+ 0.2.6-unstable.20260830154417
EUPL-1.2
Conduction
Shillinq
From 520eaa3ed49a4fcaf47a6393ee7345ad7f6d8541 Mon Sep 17 00:00:00 2001
From: Ruben van der Linde
Date: Sun, 30 Aug 2026 20:41:33 +0200
Subject: [PATCH 2/2] chore(dependabot): hold back the four majors that cannot
be adopted (#1385)
Dependabot re-proposes these on every run, and each one takes `npm ci` or
`npm run build` from green to red with no code change in this repository that
can fix it. Closing the pull requests does nothing: without an ignore rule they
come straight back.
Each is blocked by a package we do not control, verified against the registry
rather than assumed:
- typescript 7 typescript-eslint hard-throws on TS >= 7 (a `versionMajor
>= 7` guard in its dist/index.js) and every published
version still peers `typescript: ">=4.8.4 <6.1.0"`.
- webpack-cli 7 @nextcloud/webpack-vue-config 7.0.4, the LATEST, peers
`webpack-cli: ^6.0.1`.
- @babel/core 8 the same package peers `@babel/core: ^7.22.9`.
- @babel/preset-env preset-env 8 requires core 8, so the pair moves together
or not at all. Splitting them is what broke filinq.
These are COMPATIBILITY limits, not security ones. `npm audit` reports no
advisory against any version pinned here, so holding them costs no exposure.
Lift each the moment its blocker ships support.
Deliberately NOT held: stylelint 17, vitest 4 and pinia 4. All three were
blocked earlier today and all three are now adoptable, so dependabot should
keep proposing them.
---
.github/dependabot.yml | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 374ceb72d..89285bc63 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,6 +6,32 @@ updates:
schedule:
interval: "weekly"
open-pull-requests-limit: 10
+ # HELD BACK DELIBERATELY, not out of caution. Each of these is blocked by a
+ # package we do not control, and dependabot cannot see that, so it proposes
+ # them on every run and each one takes `npm ci` or `npm run build` from
+ # green to red with no code change that can fix it.
+ #
+ # typescript 7: typescript-eslint hard-throws on TS >= 7 (a `versionMajor
+ # >= 7` guard in its dist/index.js) and every published
+ # version still peers `typescript: ">=4.8.4 <6.1.0"`.
+ # webpack-cli 7: @nextcloud/webpack-vue-config 7.0.4, the latest, peers
+ # `webpack-cli: ^6.0.1`.
+ # @babel/core 8: the same package peers `@babel/core: ^7.22.9`, and
+ # preset-env 8 requires core 8, so the pair moves together
+ # or not at all.
+ #
+ # Lift each the moment its blocker ships support. These are compatibility
+ # limits, not security ones: `npm audit` reports no advisory against any of
+ # the versions pinned here.
+ ignore:
+ - dependency-name: "typescript"
+ update-types: ["version-update:semver-major"]
+ - dependency-name: "webpack-cli"
+ update-types: ["version-update:semver-major"]
+ - dependency-name: "@babel/core"
+ update-types: ["version-update:semver-major"]
+ - dependency-name: "@babel/preset-env"
+ update-types: ["version-update:semver-major"]
cooldown:
default-days: 1
include: