build(deps-dev): move the whole stylelint family to 17 as one upgrade

[rubenvdlinde]

stylelint 15.11.0 → 17.14.1 with every package that peers on it:

package	from	to
@nextcloud/stylelint-config	^2.4.0	^3.2.2
stylelint-config-recommended-scss	^13.1.0	^17.0.1
stylelint-config-recommended-vue	^1.6.1	^2.0.0
postcss-html	^1.8.1	^2.0.0
stylelint-config-html	(absent)	^2.0.0

None can move alone: vue-config@2 peers postcss-html ^2.0.0 and stylelint-config-html >= 2.0.0; postcss-html@2 breaks vue-config@1.6.1's own ^1.0.0 peer; scss-config@17 peers stylelint ^17.

@nextcloud/stylelint-config is the member that decides the outcome — v2.4.0 still declares indentation, string-quotes, number-leading-zero and selector-list-comma-newline-after, all removed in stylelint 16. The rules are not in this repo; stylelint.config.js only extends that package.

The 10 real errors, in 4 files

count	from	to
8	word-break: break-word	overflow-wrap: break-word
1	word-wrap: break-word	overflow-wrap: break-word
1	clip: rect(0,0,0,0)	clip-path: inset(50%)

Why these were fixed by hand and not with --fix

--fix clears the 10 errors, but it also rewrites the 86 advisory csstools/use-logical warnings — text-align: left → start, padding-left → padding-inline-start, and so on — across 28 files.

Those change how the UI lays out under RTL. That may well be desirable, but it is a deliberate design change, not a side effect a dependency bump should smuggle in, and openbuild (42), scholiq (53) and hermiq (13) all carry the same warnings unfixed. So the diff here is only the 4 files with genuine deprecations.

Result

before:  stylelint 15, 'indentation' deprecated notice        exit 0
naive:   stylelint 17 alone       ✖ errors (unknown rules)    exit 2
this PR: ⚠ 86 problems (0 errors, 86 warnings)                exit 0

[github-actions]

Quality Report — ConductionNL/softwarecatalog @ 601f165

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
format		✅
composer			✅	✅ 130/130
npm			✅	✅ 703/703
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-21 00:06 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Accuracy note, after investigating why the equivalent change failed on openbuild.

This landed green and npm ci accepts it — the lockfile encodes the resolution, the same as decidesk, pipelinq and hermiq. But the set I chose is not the only one that would have worked, and it is not strictly peer-clean:

@nextcloud/stylelint-config@3.2.2  peers  stylelint-config-recommended-vue: ^1.6.1

so vue-config@2.0.0 violates that pin. It resolves only because the committed lock pins it; a future contributor running a bare npm install after changing this family may hit ERESOLVE and be confused about why CI is green. That is exactly what happened to me on openbuild, where I proposed the same change and every frontend job failed at "Install dependencies" — that PR is now closed.

The alternative was vue-config ^1.6.1 + postcss-html ^1.x, which satisfies every peer exactly and is what openbuild and scholiq already run.

I chose this set for consistency with the three apps already on it rather than splitting the fleet further, and it is verified green here. Recording the trade-off so the next person does not rediscover it from an ERESOLVE. It resolves properly once @nextcloud/stylelint-config relaxes its pin to allow vue-config 2.

Also worth stating plainly: npm install succeeding locally is not evidence that npm ci will. Only npm ci reproduces what CI does.