fix(deps): node-polyfill-webpack-plugin is pinned to 4.0.0 by webpack-vue-config

npm ci cannot resolve, so every check dies before it runs:

  npm error ERESOLVE could not resolve
  While resolving: @nextcloud/webpack-vue-config@7.0.4
  Found: node-polyfill-webpack-plugin@4.1.0

@nextcloud/webpack-vue-config declares node-polyfill-webpack-plugin as
EXACTLY "4.0.0" -- an exact version, not a caret range. 4.1.0 therefore
cannot satisfy it under any resolution, and the bump was uninstallable
the moment it landed.

I merged that bump unverified, on the reasoning that a MINOR version is
low risk. It is not, when the consumer pins an exact version: semver
tells you what the publisher intended, not what your dependency tree
will accept. This is the check the merge skipped.

Dependabot is told to hold it back, because it will keep proposing it --
it sees a newer version, not the exact pin holding it down.

Five apps carried the same combination; this is one of four fixed
together, decidiq being exempt because it is on webpack-vue-config v6,
which does not depend on the plugin at all.

Author: rubenvdlinde

.github/dependabot.yml

@@ -33,6 +33,12 @@ updates:
     target-branch: "development"
     schedule:
       interval: "weekly"
+    ignore:
+      # @nextcloud/webpack-vue-config pins this to EXACTLY "4.0.0" (not a
+      # range), so 4.1.0 can never resolve: npm ci dies with ERESOLVE before
+      # a single check runs. Dependabot proposes it anyway because it only
+      # sees a newer version, not the exact pin holding it down.
+      - dependency-name: "node-polyfill-webpack-plugin"
     open-pull-requests-limit: 10
     # HELD BACK DELIBERATELY, not out of caution. Each of these is blocked by a
     # package we do not control, and dependabot cannot see that, so it proposes

package.json

@@ -62,7 +62,7 @@
     "gridstack": "^12.6.0",
     "lodash": "^4.17.21",
     "marked": "^12.0.0",
-    "node-polyfill-webpack-plugin": "4.1.0",
+    "node-polyfill-webpack-plugin": "4.0.0",
     "path-browserify": "^1.0.1",
     "pinia": "^3.0.3",
     "sass": "^1.99.0",