fix(deps): nextcloud-vue 2.21.0, which restores the flow create button

[rubenvdlinde]

Fixes the Playwright E2E failure on development.

The failure

flow-controls.spec.ts:173 › flow controls render, and a flow can be built, saved and run
  Error: expect(locator).toBeVisible() failed
  Locator: getByRole('button', { name: 'New flow' })
  Error: element(s) not found

Failed on both attempts, so not a flake. 63 other specs passed.

Cause

#2937 moved the flow list to an ordinary type: "index" over the named source flows.

nextcloud-vue 2.20.0 shipped named sources (nc-vue #800) but read only their columns — addLabel and the routes were defined and never read. From nc-vue #818's own message:

That PR wired the source's columns and left addLabel and the routes defined-and-never-read, so migrating a flow list off its custom page lost the create button and the row click.

and in the code it replaces:

A named source names its own create action. Without this the button falls back to a schema-derived noun, and a named source has no schema — so the control the migration was supposed to preserve simply is not there.

nc-vue #818 first ships in 2.21.0. This repo is pinned at 2.20.0, so the button genuinely does not render.

Verification

• Against the published artifacts, not the source — 2.21.0/dist carries the namedSource.addLabel branch; 2.20.0/dist does not. A caret and a green source tree prove nothing about what installs.
• Lock regenerated with npm 11, because engines.npm is ^11.0.0 and npm 10 does not implement min-release-age — regenerating under npm 10 would have rewritten an npm 11 lock with npm 10 semantics.
• With the repo's .npmrc in place. Its min-release-age=2 plus min-release-age-exclude[]=@conduction/* is what allows a first-party release-day version. Without the exclusion the cooldown does not fail loudly, it silently resolves backwards — the .npmrc says so in as many words, and regenerating the lock in a bare scratch dir would have hit exactly that.
• Lock diff is one line. No transitive package added, removed, or version-changed:

node_modules/@conduction/nextcloud-vue   2.20.0 -> 2.21.0

Note

2.21.0 was published shortly before this PR. It is first-party and exempt from the cooldown by the .npmrc rule above, and CI here — including the E2E that currently fails — is the check that it behaves. I could not run openregister's E2E locally.

Surfaced by ConductionNL/.github#597: development had not produced a completed CI verdict in months because every run was cancelled.

[github-actions]

Quality Report — ConductionNL/openregister @ ba8c0ef

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	❌
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 175/175
npm			✅	✅ 545/545
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-28 06:21 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ 707fefe

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 175/175
npm			✅	✅ 545/545
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-28 07:42 UTC

Download the full PDF report from the workflow artifacts.