fix(deps): bump stylelint stack together to resolve peer conflict

[chrip]

Fixes #116

@nextcloud/stylelint-config changed its stylelint peer range mid-3.x, so ^3.0.1 now spans a breaking peer change and the lockfile can no longer be resolved from package.json. This bumps the three stylelint packages together and groups them in renovate.json.

Only the stylelint subtree was re-resolved — 30 version changes, 24 added, 8 removed, 0 downgrades, nothing outside stylelint's tree (vue, vite, @nextcloud/vue, @nextcloud/axios untouched).

Verified: npm ci succeeds from the new lockfile, and npx stylelint css/*.css (the CI command) exits 0. Note it surfaces 16 new csstools/use-logical warnings on settings.css, share.css, template.css — non-blocking, baseline was clean.

Once merged, #61 and #62 are redundant and can be closed; #63 should regenerate.

Assisted-by: ClaudeCode:claude-opus-5

[moodyjmz]

TL;DR

The diagnosis in #116 is right and the fix is minimal and correct. Every quantitative claim in the description checks out exactly. Approve.

Two things before merge:

1. Rebase on main. ci: run workflows on main instead of dormant master/develop #118 landed after this branch was pushed, so the workflow filters now target main — CI will actually run npm ci and the stylelint command instead of leaving them on your word. That's the one claim I could not verify independently. No conflict: ci: run workflows on main instead of dormant master/develop #118 touched only workflows and src/*.js.
2. stylelint-config-standard is unused — deleting it beats bumping it. Details below.

Everything else is a note, not a request.

What I verified independently

Claim	Result
"30 version changes, 24 added, 8 removed, 0 downgrades"	Exact. Recomputed from both lockfiles.
Lockfile resolves	Consistent. All 957 entries: every dependency and every non-optional peer resolves under node resolution rules and satisfies its declared range. The single remaining UNSAT (rollup-plugin-license/node_modules/fdir peer picomatch@^3 || ^4 → 2.3.1) is present on main too — pre-existing, unrelated, and the same optional-peer quirk #118 hit.
No integrity hashes dropped	Confirmed. 0 entries missing integrity in both old (940) and new (956).
csstools/use-logical findings are warnings, not errors	Confirmed from source. @nextcloud/stylelint-config@3.2.2/index.js hard-codes severity: 'warning'.
Node engines	No new mismatches. stylelint 17.14.1 raises the floor to node >= 20.19.0; #118 moved lint CI to node 24, so comfortably satisfied.
Was bumping stylelint-config-standard actually necessary?	Yes, given it stays declared. 36.0.1 peers stylelint ^16.1.0 and would have blocked 17 on its own.

Not verified: that npx stylelint css/*.css exits 0. The stylelint 17 tree isn't in my local npm cache, and structural validity says nothing about whether the linter is green — four majors of stylelint-config-recommended (14 → 18) and three of -scss (14 → 17) landed here, and new rules in those arrive at error severity by default. Post-#118 a rebase settles it for free.

1. stylelint-config-standard is dead weight

.stylelintrc.json extends only @nextcloud/stylelint-config. Grep across the repo finds exactly one reference to stylelint-config-standard — its own line in package.json. It isn't a transitive requirement either: in the new lockfile its only consumer is root devDependencies.

So the four-major 36 → 40 jump is needed only because the package is declared at all. Dropping it instead would be a smaller change with less to justify, and one fewer package in the new renovate group.

Not blocking — bumping it is correct if you'd rather keep it — but worth a moment's thought while the file is open.

2. The warning inventory is short by two files

The description reports 16 csstools/use-logical warnings on settings.css, share.css, template.css. A scan of the linted glob against the rule's actual property maps (stylelint-use-logical@2.1.3, index.cjs) finds physical inline-axis declarations in five tracked files — including two not listed:

• css/editor.css:36 — left: 0px
• css/main.css:61 — margin-left: 0
• css/main.css:126 — margin-right: 10px

The rule's except list exempts top/bottom and all sizing properties, but not left/right, so these are live. The count of 16 may well be correct — share.css:61-62 are a padding-left/padding-right pair in one rule and the rule has a pair map that may collapse them — but the file list isn't.

One likely explanation for a local/CI divergence: .gitignore ignores /css/*.chunk.css, but stylelint reads only .stylelintignore (stylelint/lib/constants.mjs) and this repo has none. After a local npm run build, npx stylelint css/*.css also lints the generated Vite chunks — 9 further hits in code nobody maintains. CI never sees this because the lint job doesn't build.

Filed as #122 with the full site list; nothing to change here.

3. Notes, no action needed

"nothing outside stylelint's tree" is a shade stronger than the diff supports. postcss 8.5.15 → 8.5.23 and nanoid 3.3.12 → 3.3.16 are shared nodes with a single hoisted copy: node_modules/vite requires postcss@^8.5.6 and @vue/compiler-sfc requires ^8.5.15. So the production build's PostCSS moved too. Patch-level inside 8.5.x, so the risk is near zero — and once rebased, artifact.yml builds it in CI anyway.

renovate.json glob. stylelint-config-** works — minimatch treats a non-segment ** as * — but stylelint-config-* is the idiomatic form. Nothing validates renovate.json in CI either, so a typo degrades quietly into a Renovate config-error issue.

Pre-existing, adjacent: .stylelintrc.json and stylelint.config.js both extend the same config, and cosmiconfig's default search order puts .stylelintrc.json at position 3 against stylelint.config.js at 18 — so stylelint.config.js is never loaded. It's dead code that a future stylelint major could break silently. Worth deleting one, separately.

Sequencing. Right that #61 and #62 become redundant. Also: #115, #82, #83 and #56 all touch npm-shrinkwrap.json and will need Renovate to rebase after this lands. Merge this first.