fix(deps): add missing oxc-parser subtree so npm ci works on Node 22.22

[escooterclinic]

Summary

npm ci fails on main, and the Docker image build has been red since 63a2968.

The committed lockfile omits the oxc-parser@0.144.0 subtree. Six nested copies of
unctx (under nuxt, @nuxt/vite-builder, @nuxt/nitro-server, @nuxt/devtools,
@nuxt/devtools-kit, @dxup/nuxt) declare oxc-parser >=0.140.0 as a peer; the only
oxc-parser the lockfile records is 0.128.0, which is there to satisfy
@nuxtjs/i18n's ^0.128.0.

npm 11 resolves that without complaint. npm 10.9.8 refuses it — and npm 10.9.8 is the
npm bundled with the Node this repo pins in four places: node:22.22-alpine in both
Dockerfile stages, and node-version: 22.22 in pr-validation.yml and e2e-tests.yml.

npm error code EUSAGE
npm error `npm ci` can only install packages when your package.json and
npm error package-lock.json or npm-shrinkwrap.json are in sync.
npm error Missing: oxc-parser@0.144.0 from lock file
npm error Missing: @oxc-parser/binding-android-arm-eabi@0.144.0 from lock file
... (21 more)

That is the exact failure in Publish Docker Image
(run 31464238203) and
Docker Setup Integration Test
(run 31464238289) on
main. Both were green at 0122023e (2026-08-09) and have failed since.

Why it wasn't caught

pr-validation.yml and e2e-tests.yml trigger on pull_request only, so nothing runs
npm ci on a push to main. The lockfile arrived via #269, a Dependabot PR whose own
Build, typecheck, and test, Playwright E2E and Simulate new-user setup checks
were all failing (11s, 23s, 21s) when dependabot-automerge.yml merged it.

That gap is not addressed here — this PR only repairs the lockfile.

The change

Regenerated with npm 10.9.8: npm install --package-lock-only. Purely additive.

packages added	126 (the oxc-parser / oxc-transform peer subtrees)
package versions changed	0
packages removed	0
package.json	untouched
npm audit	0 vulnerabilities, before and after

Type of change

• Bug fix
• Feature
• Refactor
• Docs
• Chore

Validation

• I tested locally

Same tree, same machine, only the npm changing:

	before	after
npm@10.9.8 ci	exit 1, EUSAGE	exit 0, 1481 packages
npm@11.11.1 ci	exit 0, 1186 packages	exit 0, 1186 packages
npm audit	0 vulnerabilities	0 vulnerabilities

The npm 11 path is unchanged, so this cannot regress anyone already building on npm 11.

• I added/updated relevant documentation — no behaviour or docs change
• I verified multi-tenant scoping and auth behavior for affected API paths — n/a, lockfile only

DCO

• All commits in this PR are signed off (Signed-off-by) via git commit -s

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9d7b848b-1a7d-4790-8a3e-99c55af088ec

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[escooterclinic]

Verified in the actual image the Dockerfile pins, rather than only against a local npm — same checkout, same host, only the commit changing:

# upstream main (63a2968)
$ docker run --rm -v $PWD:/app -w /app node:22.22-alpine npm ci --ignore-scripts
npm error code EUSAGE
npm error `npm ci` can only install packages when your package.json and package-lock.json
npm error or npm-shrinkwrap.json are in sync.
npm error Missing: oxc-parser@0.144.0 from lock file
-> exit 1

# this branch (18fe113)
$ docker run --rm -v $PWD:/app -w /app node:22.22-alpine sh -c 'npm --version; npm ci --ignore-scripts'
10.9.8
-> exit 0

So the failure is the image's bundled npm 10.9.8 rejecting the committed lockfile, and this branch is enough to get npm ci through the builder stage again.

I have no way to run your Actions workflows from a fork without approval, so the two Docker jobs on this PR are unrun — the above is the closest equivalent I could get to them.