PiT 25.2: npm EOVERRIDE conflict when upgrading vaadin.version in projects with direct Vaadin component dependencies

[manolo]

Description of the bug

When a project has a direct npm dependency on a Vaadin component (e.g. @vaadin/charts) and vaadin.version is upgraded, the vaadin-maven-plugin updates the dependencies section in package.json to the new version but leaves the overrides section pointing to the old version. This causes an npm EOVERRIDE conflict.

npm error code EOVERRIDE
npm error Override for @vaadin/charts@25.2.0-alpha8 conflicts with direct dependency

The root cause is in TaskUpdatePackages.lockVersionForNpm() (line ~160): platform overrides are skipped for existing dependencies ("Skip platform overrides for existing dependencies"). When the dependency version is bumped, the override created in a previous run still pins the old version, but the skip logic prevents it from being updated.

Expected behavior

When vaadin.version is changed, all overrides for Vaadin platform components should be updated to match the new version, or the stale overrides should be removed.

Minimal reproducible example

git clone git@github.com:vaadin/npm-addon-template.git
cd npm-addon-template
git checkout v25
# Upgrade vaadin.version
perl -pi -e 's|(<vaadin.version>)[^<]+(</vaadin.version>)|${1}25.2.0-alpha3${2}|g' pom.xml
# Add prereleases repo
perl -pi -e 's|(\s*)(</project>)|$1$1<repositories><repository><id>v</id><url>https://maven.vaadin.com/vaadin-prereleases</url></repository></repositories>\n$1$2|' pom.xml
perl -pi -e 's|(\s*)(</project>)|$1$1<pluginRepositories><pluginRepository><id>v</id><url>https://maven.vaadin.com/vaadin-prereleases</url></pluginRepository></pluginRepositories>\n$1$2|' pom.xml
# Run dev mode (fails with EOVERRIDE)
mvn -ntp -B -Dserver.port=8080

Workaround: delete package.json before running, the plugin regenerates it cleanly.

Versions

• Vaadin / Flow version: 25.1.3 upgrading to 25.2.0-alpha3
• npm: 11.x
• Node: 24.x / 25.x

Code reference

TaskUpdatePackages.java line ~160:

if (dependencies.has(dependency) || devDependencies.has(dependency)) {
    // Skip platform overrides for existing dependencies
    continue;
}

[mcollovati]

In addition to the mentioned cause, it is worth noting that vaadin-chart is added to the package.json because it is a transitive dependency of vaadin-ai-components-flow, imported by vaadin-core.
When running in dev mode, Vaadin uses the full dependency scanner, to if promotes also charts as an used package.