ITWorx-Pulse-Public/docs/engineering/DEPENDENCIES.md

M1 dependency record

Research and install date: 2026-08-01

These exact versions are pinned in package.json/apps/web/package.json and pnpm-lock.yaml. Go is installed in the developer's user-local toolchain cache at Go 1.26.6 and is declared in go.mod/go.work; it is not vendored into the repository.

Dependency	Version	Purpose	License	Alternative/decision
Go toolchain	1.26.6	API, worker, agent	BSD-style	Official current supported patch; required by the M13 release image gate to remove fixed Go standard-library High findings.
React	19.2.8	Web UI	MIT	React is required by the architecture; framework/server rendering is unnecessary for the static dashboard shell.
React DOM	19.2.8	Browser renderer	MIT	Pinned with React.
Vite	8.2.0	TypeScript web build/dev server	MIT	Chosen over a heavier framework because the architecture calls for a static React app and Vite supports the available Node runtime.
@vitejs/plugin-react	6.0.5	Vite React transform	MIT	Official Vite ecosystem plugin; pinned with Vite 8.
TypeScript	7.0.2	Strict web type checking	Apache-2.0	Required for the React + TypeScript architecture.
React type declarations	19.2.18 / 19.2.4	Compile-time types	MIT	Pinned to the installed React major.
github.com/jackc/pgx/v5	5.10.0	PostgreSQL connection pool and parameterized access	MIT	Selected for native context-aware pooling and PostgreSQL support; pinned after module/license review.
github.com/coreos/go-oidc/v3	3.20.0	OIDC discovery, issuer/audience/JWK-backed ID-token verification	Apache-2.0	Uses maintained standards-oriented verifier; server-side only, pinned after module/license review.
golang.org/x/oauth2	0.36.0	Authorization-code exchange and PKCE request parameters	BSD-style	Official Go OAuth2 client primitives; pinned and kept behind the auth adapter.

No charting, grid, or HTTP-router dependency is added yet. Those material choices require the relevant task's primary-source/security/license review and measurement. pnpm-lock.yaml records registry integrity data; Go module checksums are recorded in go.sum.

Verification record

• go version: go1.26.6 windows/amd64.
• pnpm install --frozen-lockfile: pass with pnpm 10.33.0.
• Vite's official compatibility floor is Node 20.19+ or 22.12+; the local Node 24.18.1 satisfies it.
• go test ./..., go vet ./..., TypeScript typecheck, Vite build, and repository bootstrap/test/lint scripts pass.
• go mod verify: pass; pgx v5.10.0 and transitive modules are checksum-verified.
• pgx v5.10.0 module metadata points to the upstream github.com/jackc/pgx repository; the cached module includes an MIT license.
• go-oidc v3.20.0 and oauth2 v0.36.0 are checksum-verified; the cached go-oidc module includes an Apache-2.0 license and oauth2 is maintained under the Go project license.
• Releasegate 2026-08-21 pins transitieve builddependency nanoid op 3.3.18 via een beperkte pnpm-override. Dit sluit GHSA-2v37-7h3g-55p8 in Vite -> PostCSS; pnpm audit --audit-level high en Trivy met developmentdependencies rapporteren daarna nul High/Critical-bevindingen. Nanoid blijft uitsluitend onderdeel van de MIT-gelicentieerde buildketen en wordt niet aan de browserruntime toegevoegd.

Upgrade/removal path

Update package manifests and lockfile together, rerun the foundation scripts plus the affected milestone gate, review changelogs/security advisories, and record any compatibility or bundle/runtime impact. Removing Vite/React is an architectural change requiring an ADR; removing a foundation tool requires replacement commands and clean-room evidence.