chore(deps): pin @conduction/nextcloud-vue to 2.2.0-vue3.9

[rubenvdlinde]

What

Hard-pins @conduction/nextcloud-vue to exactly 2.2.0-vue3.9 (from 2.2.0-vue3.7), the current vue3 dist-tag head.

Follow-up to #257. The tag moved twice more while the fleet wave was running — vue3.7 → vue3.8 → vue3.9 — because every merge to nc-vue's feat/vue-3 cuts a publish. The fleet converges on 2.2.0-vue3.9.

No caret, no range: ^2.2.0 does not match a prerelease, and latest/beta are the retired Vue 2 lineage.

Lockfile control (npm 10.8.2)

	result
control (pin unchanged)	0 lines
after bump	8 lock lines + 2 package.json lines

Generated with npm 10.8.2, the version CI runs. Under npm 10 the control is a clean no-op — the @gouvfr/dsfr-* stubs that npm 11 injected during the 3.7 pin are already in the lockfile and stay put.

Verification

• npm ci under npm 10.8.2: exit 0.
• Off disk: exactly one copy, 2.2.0-vue3.9, peer vue ^3.5.0.
• Registry controls: 2.2.0-vue3.9 resolves; 3.0.0 / 3.0.0-vue3.0 return E404.

2.2.0-vue3.9 is not pre-verified against our apps the way 2.2.0-vue3.7 was, so this run is the verification:

	before (vue3.7)	after (vue3.9)
npm ci (npm 10.8.2)	exit 0	exit 0
npm run build	exit 0	exit 0
npm run test:unit (vitest)	8 files / 81 passed	8 files / 81 passed
css/ output	2,684,041 B	2,684,041 B

Bundle delta: 0 bytes — expected, since @conduction/nextcloud-vue is a devDependency here and nldesign's build is CSS/fonts/icons only. No regression.

[github-actions]

Quality Report — ConductionNL/nldesign @ 208f479

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 2/2
PHPUnit					✅
Newman					✅
Playwright					❌
Hydra gates					✅

---

Quality workflow — 2026-08-10 10:56 UTC

Download the full PDF report from the workflow artifacts.