fix(deps): restore the dependency graph I broke on development

[rubenvdlinde]

npm ci on development currently exits 1, so every frontend job would fail.
Both causes are mine, from admin-merging a dependabot batch without resolving the
graph first.

1. nc-vue 2.41.1 cannot see marked 18

Found: marked@18.0.12
Could not resolve: peerOptional marked@^12.0.0 from @conduction/nextcloud-vue@2.41.1

nc-vue widened that range to >=12 <19 in 2.43.0, so the fix is to take
2.44.1 rather than pin marked back. dossiq already runs 2.44.1 with marked 18.

2. @vitest/ui moved to 5 alone

It peer-requires exactly vitest@5.0.0, while vitest and
@vitest/coverage-v8 stay ^4.1.11. That is a held major and I merged it by
mistake, in a loop that skipped only conflicting PRs. Restored to ^4.1.11 so
the family is one version again. #593 and #596 stay open and held.

Verified locally, by exit code, on a clean tree

rm -rf node_modules && npm ci   -> 0
npm run build                   -> 0
npm run test                    -> 0   (64 files, 708 tests)

resolved: nc-vue 2.44.1   marked 18.0.12   vitest 4.1.11   @vitest/ui 4.1.11

One note for the next person

The lock is updated in place, not regenerated. Deleting package-lock.json makes
npm install fail with Unable to resolve reference $pinia — the overrides
block uses "pinia": "$pinia", and that reference needs the existing lock.

[github-actions]

Quality Report — ConductionNL/launchpad @ 2c26df6

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
format		✅
check-schema-l10n		✅
composer			✅	✅ 104/104
npm			✅	✅ 534/534
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-09-10 14:46 UTC

Download the full PDF report from the workflow artifacts.