# M1 dependency record

Research and install date: 2026-08-01

These exact versions are pinned in `package.json`/`apps/web/package.json` and `pnpm-lock.yaml`. Go is installed in the developer's user-local toolchain cache at Go 1.26.6 and is declared in `go.mod`/`go.work`; it is not vendored into the repository.

| Dependency | Version | Purpose | License | Alternative/decision |
|---|---|---|---|---|
| Go toolchain | 1.26.6 | API, worker, agent | BSD-style | Official current supported patch; required by the M13 release image gate to remove fixed Go standard-library High findings. |
| React | 19.2.8 | Web UI | MIT | React is required by the architecture; framework/server rendering is unnecessary for the static dashboard shell. |
| React DOM | 19.2.8 | Browser renderer | MIT | Pinned with React. |
| Vite | 8.2.0 | TypeScript web build/dev server | MIT | Chosen over a heavier framework because the architecture calls for a static React app and Vite supports the available Node runtime. |
| `@vitejs/plugin-react` | 6.0.5 | Vite React transform | MIT | Official Vite ecosystem plugin; pinned with Vite 8. |
| TypeScript | 7.0.2 | Strict web type checking | Apache-2.0 | Required for the React + TypeScript architecture. |
| React type declarations | 19.2.18 / 19.2.4 | Compile-time types | MIT | Pinned to the installed React major. |
| `github.com/jackc/pgx/v5` | 5.10.0 | PostgreSQL connection pool and parameterized access | MIT | Selected for native context-aware pooling and PostgreSQL support; pinned after module/license review. |
| `github.com/coreos/go-oidc/v3` | 3.20.0 | OIDC discovery, issuer/audience/JWK-backed ID-token verification | Apache-2.0 | Uses maintained standards-oriented verifier; server-side only, pinned after module/license review. |
| `golang.org/x/oauth2` | 0.36.0 | Authorization-code exchange and PKCE request parameters | BSD-style | Official Go OAuth2 client primitives; pinned and kept behind the auth adapter. |

No charting, grid, or HTTP-router dependency is added yet. Those material choices require the relevant task's primary-source/security/license review and measurement. `pnpm-lock.yaml` records registry integrity data; Go module checksums are recorded in `go.sum`.

## Verification record

- `go version`: `go1.26.6 windows/amd64`.
- `pnpm install --frozen-lockfile`: pass with pnpm 10.33.0.
- Vite's official compatibility floor is Node 20.19+ or 22.12+; the local Node 24.18.1 satisfies it.
- `go test ./...`, `go vet ./...`, TypeScript typecheck, Vite build, and repository bootstrap/test/lint scripts pass.
- `go mod verify`: pass; pgx v5.10.0 and transitive modules are checksum-verified.
- pgx v5.10.0 module metadata points to the upstream `github.com/jackc/pgx` repository; the cached module includes an MIT license.
- go-oidc v3.20.0 and oauth2 v0.36.0 are checksum-verified; the cached go-oidc module includes an Apache-2.0 license and oauth2 is maintained under the Go project license.
- Releasegate 2026-08-21 pins transitieve builddependency `nanoid` op 3.3.18 via een beperkte pnpm-override. Dit sluit GHSA-2v37-7h3g-55p8 in Vite -> PostCSS; `pnpm audit --audit-level high` en Trivy met developmentdependencies rapporteren daarna nul High/Critical-bevindingen. Nanoid blijft uitsluitend onderdeel van de MIT-gelicentieerde buildketen en wordt niet aan de browserruntime toegevoegd.

## Upgrade/removal path

Update package manifests and lockfile together, rerun the foundation scripts plus the affected milestone gate, review changelogs/security advisories, and record any compatibility or bundle/runtime impact. Removing Vite/React is an architectural change requiring an ADR; removing a foundation tool requires replacement commands and clean-room evidence.