# Third-party dependency register

Last reviewed: **2026-09-13**

| Package | Version | License | Repository | Why it is used | Browser bundle impact | Security check |
| --- | ---: | --- | --- | --- | --- | --- |
| `astro` | 7.3.2 | MIT | https://github.com/withastro/astro | Static site build, routing, and minimal client scripts | Build framework; only authored client scripts ship | `pnpm audit` on 2026-09-10 |
| `jsbarcode` | 3.12.3 | MIT | https://github.com/lindell/JsBarcode | Browser-side generation for all 19 active V1 linear barcode formats | One client-only barcode engine; package has zero runtime dependencies | `pnpm audit` on 2026-09-10 |
| `qrcode-generator` | 2.0.4 | MIT | https://github.com/kazuhikoarase/qrcode-generator | Browser-side UTF-8 QR generation with L/M/Q/H error correction and SVG matrix output | QR route only: 23,906-byte client chunk; package has zero runtime dependencies | `pnpm audit` on 2026-09-11 |
| `exceljs-hardened` | 5.0.0 (exact) | MIT | https://github.com/mateocallec/exceljs-hardened | Browser-side existing XLSX read/write and embedded PNG images with hardened decompression/resource guards | Lazy Excel-only workbook chunk: 1,020,540-byte raw / 281,921-byte gzip; not loaded until file selection | `pnpm audit --prod --audit-level=low` clean on 2026-09-12; see prebuilt bundle caveat below |
| `@astrojs/check` | 0.9.10 | MIT | https://github.com/withastro/language-tools | Astro and TypeScript diagnostics | Development only | `pnpm audit` on 2026-09-10 |
| `playwright` | 1.55.1 (exact) | Apache-2.0 | https://github.com/microsoft/playwright | Repeatable Chromium, Firefox and WebKit release smoke tests | Development only; browser binaries are not shipped | Full `pnpm audit --audit-level=low` clean on 2026-09-13 |
| `typescript` | 6.0.3 | Apache-2.0 | https://github.com/microsoft/TypeScript | Strict static type checking; latest release supported by `@astrojs/check` | Development only | `pnpm audit` on 2026-09-10 |
| `vitest` | 5.0.0 | MIT | https://github.com/vitest-dev/vitest | Validation and download-helper unit tests | Development only | `pnpm audit` on 2026-09-10 |

## Selection notes

- No UI framework was added; Astro HTML, CSS, and a small TypeScript client script cover the current task.
- `jsbarcode` supplies Code 128 Auto/A/B/C, EAN-13/8/5/2, UPC-A, Code 39, ITF/ITF-14, MSI variants, Codabar and Pharmacode in the browser without runtime dependencies.
- `qrcode-generator` is route-scoped and its documented byte encoder hook is set to the platform `TextEncoder` so non-ASCII input is encoded as UTF-8.
- `exceljs-hardened` is an unofficial security-focused ExcelJS fork. It is exact-pinned, route-scoped, loaded only after local file selection, and uses 32 MiB per-entry / 128 MiB total decompression limits. Complex chart/pivot/macro/drawing preservation is not guaranteed.
- The transitive Node/package resolution of `uuid` is locked to `11.1.1` through the root pnpm override; automatic Excel engine major/minor upgrades are disabled.
- `exceljs-hardened` exposes a prebuilt browserify bundle through its `browser` field. The root override does not rebuild that file; the shipped bundle still contains older UUID v3/v5 code. BarcodeBatch's reachable Excel path calls only buffersız UUID v4 for conditional-format IDs, so GHSA-w5hq-g745-h8pq's v3/v5/v6 external-buffer path is not used. This remains a build-provenance/audit P2; `pnpm audit` alone does not prove the vendored browser code was refreshed.