# 11 — DEPENDENCIES / SBOM
Generated 2026-07-05 · prod arm64-5ee0ae12002f · regenerated after wipe
> snapshot 2026-07-05 · regenerated live from `package.json` (`note-clone@0.1.0`). **119 runtime deps · 22 dev deps.** pnpm workspace. Grouped by role; versions as declared.

## Framework / runtime
| Package | Version |
|---|---|
| `next` | 16.2.6 (App Router, `output: 'standalone'`, `--webpack`) |
| `react` / `react-dom` | 19.2.0 |
| `typescript` | ^5 |
| `next-intl` | ^4.5.8 · `zustand` ^5.0.8 · `zod` ^4.1.12 |
| `@sentry/nextjs` | ^10.27.0 |

## DB / Prisma
| Package | Version |
|---|---|
| `@prisma/client` / `prisma` | 5.22.0 (Postgres + pgvector via `Unsupported("vector(1536)")`) |

## Auth / crypto
| Package | Version |
|---|---|
| `next-auth` | ^5.0.0-beta.30 |
| `@auth/core` | 0.41.1 · `@auth/prisma-adapter` ^2.11.1 |
| `bcryptjs` ^3.0.3 · `otplib` ^12.0.1 | passwords / TOTP-2FA |

## AI / LLM
| Package | Version |
|---|---|
| `ai` (Vercel AI SDK) | ^5.0.101 |
| `@ai-sdk/openai` ^2.0.71 · `@ai-sdk/anthropic` ^2.0.48 · `@ai-sdk/google` ^2.0.43 | provider adapters |
| `openai` ^6.9.1 · `anthropic` ^0.0.0 (stub) | raw SDKs |
| `@xenova/transformers` ^2.17.2 | local embeddings |

## Media / voice / ingest
| Package | Version |
|---|---|
| `sharp` 0.34.5 (pinned override) · `jimp` ^1.6.1 · `@vercel/og` ^0.8.5 | image |
| `tesseract.js` ^6.0.1 | OCR |
| `youtube-dl-exec` ^3.0.27 · `youtube-transcript` ^1.2.1 | video/yt |
| `pdf-parse` ^1.1.1 · `pdf2json` ^4.0.0 · `pdf-lib` ^1.17.1 · `mammoth` ^1.11.0 · `officeparser` ^6.1.0 · `xlsx` ^0.18.5 · `epub2` ^3.0.2 · `rtf-parser` ^1.3.3 | doc parsers |
| `jszip` · `node-unrar-js` · `7zip-min` · `tar-stream` · `seek-bzip` | archives |
| `jsdom` ^27 · `@mozilla/readability` ^0.6 · `turndown` ^7.2 · `iconv-lite` · `chardet` · `franc-min` | html/text |

## Messaging / telephony / mail
| Package | Version |
|---|---|
| `twilio` ^5.10.6 | PSTN (+ Telnyx/Asterisk via custom clients) |
| `@slack/bolt` ^4.6 · `node-telegram-bot-api` ^0.66 · `telegram` ^2.26 · `twitter-api-v2` ^1.28 · `facebook-nodejs-business-sdk` ^24 | channels |
| `nodemailer` ^8.0.6 · `resend` ^6.5.2 · `mailparser` ^3.9.8 | mail |
| `googleapis` ^166 · `google-auth-library` ^10.5 · `@notionhq/client` ^5.4 · `notion-to-md` ^3.1.9 | connectors |
| `socket.io` ^4.8.1 (+ client) · `web-push` ^3.6.7 · `ws` (dev ^8.18) | realtime/push |

## Billing / payments
| Package | Version |
|---|---|
| `stripe` ^20.0.0 · `@stripe/stripe-js` ^8.5 · `@stripe/react-stripe-js` ^5.4 | |

## Graph / viz / UI
| Package | Version |
|---|---|
| `d3` ^7.9 (+ force/scale/selection/zoom) · `graphology` ^0.25 (+louvain/forceatlas2) · `sigma` ^2.4 · `@deck.gl/*` 8.9.36 · `umap-js` ^1.3 · `density-clustering` | graph/embedding |
| `recharts` ^2.12 · `framer-motion` ^12.23 · `lucide-react` ^0.554 · `@radix-ui/*` · `@dnd-kit/*` · `sonner` · `canvas-confetti` · `lottie-react` · `@react-spring/web` | UI |
| `tailwind-merge` · `tailwindcss-animate` · `clsx` · `class-variance-authority` | styling |

## Misc / utils
`axios` ^1.13 · `nanoid` 3.3.11 · `uuid` ^13 · `lru-cache` ^11.3 · `p-limit` 3.1 · `date-fns` ^4.1 · `@date-fns/tz` ^1.5 · `qrcode` ^1.5 · `fast-xml-parser` ^5.3 · `json5` 2.2.3 · `idb` ^8 · `file-saver` · `html-to-image` · `html2canvas` · `react-dropzone` · `input`.

## Dev / build / test
`prisma` 5.22.0 · `tsx` ^4.20 · `eslint` ^9 (+ `eslint-config-next` 16.2.6) · `tailwindcss` ^4 (`@tailwindcss/postcss`) · `@playwright/test` ^1.57 · `@next/bundle-analyzer` ^16 · `baseline-browser-mapping` ^2.9 · `ws` ^8.18 · `@types/*` (node ^20, react ^19, jsdom, uuid, ws, …).

## Overrides / build notes
- `overrides` / `pnpm.overrides`: `parse5` 7.1.2, `sharp` 0.34.5.
- `pnpm.onlyBuiltDependencies`: `@prisma/client`, `@prisma/engines`, `@sentry/cli`, `@swc/core`, `bufferutil`, `esbuild`, `prisma`, `protobufjs`, `sharp`, `utf-8-validate`.
- Build: `build:mac` → `next build --webpack` + `scripts/prepare-standalone.cjs`. Tests: Playwright + `tsx --test`.

## CVE / audit
Dependency advisory sweep tracked as **SEC-0304-DEP-CVE-AUDIT** (Owner Accepted) — run `pnpm audit` for critical/high prod advisories on refresh. `anthropic@0.0.0` is a stub placeholder (real Anthropic access is via `@ai-sdk/anthropic`).