fix(deps): make the npm overrides follow their direct dependency

[rubenvdlinde]

Dependabot cannot update these packages. Its npm updater fails with:

npm error code EOVERRIDE
npm error Override for <pkg> conflicts with direct dependency

The package is listed both as a direct dependency and as a literal overrides entry pinned to the same range. Dependabot bumps the direct dependency, does not move the override, npm rejects the mismatched pair, and the update is abandoned — so these packages can never be updated, security advisories included.

This is invisible unless you open the Dependabot check: every other check stays green, and npm ci is unaffected because it replays the committed lockfile rather than re-resolving.

The fix

npm's self-reference is the idiom for exactly this. $<name> tells the override to follow whatever the direct dependency resolves to, instead of a range that has to be kept in lockstep by hand:

 "overrides": {
-    "@nextcloud/axios": "~2.5.2"
+    "@nextcloud/axios": "$@nextcloud/axios"
 }

This repo already uses the idiom — see the vue entry under @vue/test-utils.

Transitive consumers still get pinned to a single version — the direct dependency's — which is what the override was there to do. What changes is that the pin tracks the dependency instead of duplicating it.

Verification

Measured in a clean node:22-alpine container, on this app's own package.json:

	result
bump the direct dep, keep the literal override	npm error code EOVERRIDE — Override for @nextcloud/axios@^2.6.0 conflicts with direct dependency
bump the direct dep, use $@nextcloud/axios	resolves, lockfile written

The control reproduces Dependabot's error verbatim, so the check would still fail if the fix were wrong.

Part of a fleet sweep: 14 apps carried 22 such override/direct pairs.

[github-actions]

Quality Report — ConductionNL/keepiq @ c32eae6

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 111/111
npm			✅	✅ 536/536
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					✅

---

Quality workflow — 2026-08-31 16:11 UTC

Download the full PDF report from the workflow artifacts.