# Runtime dependencies

Node 22 is the container runtime. Express 5 handles bounded HTTP transport and static web delivery. `pg` is the only production database driver. Zod owns explicit shared input/output schemas. Argon2 hashes passwords; Node crypto generates random credentials and hashes high-entropy tokens. Sharp decodes, bounds, strips metadata from and converts approved images to WebP. AWS SDK v3 accesses operator-provided private S3-compatible storage, including Wasabi. The official MCP SDK implements Streamable HTTP and stdio protocol handling. No model provider or GitHub dependency is needed.

Development only: TypeScript compiles/checks the service, tsx runs TypeScript verification and development entry points, Node/Express/pg typings support static checking, and PGlite executes the real migration SQL and domain queries in an isolated PostgreSQL-compatible engine. PGlite is excluded from production installs and is never selected by production configuration. The lockfile fixes exact dependency versions. Run `npm audit` against the current lockfile before release.

Playwright is a development-only dependency for the operator-run [local screenshot regression command](scheduled-qa.md#local-browser-screenshot-regression). Its Chromium binary is installed separately by the operator. Neither Playwright nor Chromium is required by the application server or scheduled QA worker.

React and React DOM implement the approved interactive web client. Vite bundles its static files into dist/web, which the existing Express application serves with same-origin cookies and API calls. React typings and Vite are development-only build dependencies. No routing, component library, analytics or external font dependency is needed. The client uses native browser navigation, fetch and Web Locks. `npm run build` builds the server, client, public website and extension; `npm run typecheck` checks both. The production image needs build dependencies in its build stage, and only runtime dependencies in its final stage.

React Markdown parses a small CommonMark subset for feedback and discussion. Raw HTML and image elements are omitted, and visible links accept only HTTP(S) URLs. It runs in the bundled web client, not the browser extension.

VitePress builds the public Markdown guide under `site-docs/` into `dist/site/docs/`, with first-party local search and no hosted search account. The build also exports plain Markdown and `llms.txt` for agents. It runs only in the public site's build stage; it is not part of the application server. The AWS S3 request presigner extends the existing AWS SDK client so private GitHub Issues can include seven-day direct Wasabi links while retaining authenticated Feedbacks links.

`tldts` derives public-suffix-aware registrable domains and subdomains from feedback URLs. This keeps website categorization correct for domains such as `example.co.uk`; localhost and IP hosts retain their literal host identity.

`@rrweb/record` and `@rrweb/replay` are pinned to 2.1.6. The recorder and pre-send replay engine are bundled into the extension at build time; the web client loads the replay engine only when opening a recording. Neither requires an external OpenReplay service. See [session replay](session-replay.md) for capture, coverage and agent export boundaries.

`@fix-webm-duration/fix` and its parser are pinned to 1.0.1 and bundled locally in the extension. They add finite duration metadata to native and edited WebM recordings without re-encoding video frames. No media processing service is used.

The application container installs Debian FFmpeg/ffprobe as separate executables for bounded WebM previews, plus DejaVu fonts for timestamp labels. This concrete runtime dependency lets authenticated MCP clients receive native pixels without credential handling or a client decoder. Non-container operators install these executables on the server PATH. Missing executables return `decoder_unavailable`; ordinary text/image reads remain available. See [FFmpeg options](https://ffmpeg.org/ffmpeg.html) and [protocol allowlists](https://ffmpeg.org/ffmpeg-protocols.html), checked 2026-09-30. The preview accepts only local WebM bytes, limits bytes/pixels/process time and two concurrent jobs, uses one decoder thread, and removes temporary files. No media is sent to an external service. These bounds are not a throughput or hostile-codec sandbox certification.

## 2026-10-21 release refresh

The 0.2.3 lockfile uses MCP server/client 2.3.1 and Vite 8.3.4, with updated compatible transport dependencies. This clears the current npm audit findings without adding a platform or dependency. The [MCP advisory](https://github.com/advisories/GHSA-jm63-cq47-j5jp) describes cross-client transport reuse; Feedbacks already passes a factory to `createMcpHandler`, and the transport tests continue to exercise isolated requests. The [Vite advisory](https://github.com/advisories/GHSA-587h-7wmj-h5pm) concerns the development editor launcher. These advisories do not establish that a Feedbacks installation was exploited. Recheck the lockfile audit before each release.

## 2026-11-02 security refresh

The 0.3.3 lockfile updates the production HTTP parser to `body-parser` 2.4.0 and `qs` 6.17.1. The [body-parser advisory](https://github.com/advisories/GHSA-27r3-jxmh-p828) concerns trailing bytes after compressed bodies. Express retains Feedbacks' route-specific decoded-body limits and strict JSON parsing. Zod 4.6.7 addresses [oversized constrained collections](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5); the IP-address dependency is also updated for its [IPv6 zone parsing advisory](https://github.com/advisories/GHSA-rxp7-6hxx-x8q5). MCP Node adapter 2.1.2 requires server/core 2.4.0 and accepts the patched Hono adapter 2.1.5, removing the older adapter covered by the [static-path decoding advisory](https://github.com/advisories/GHSA-rmxm-3fg6-px4f).

The development SDK's separate `fast-uri` resolution is 3.1.9, including its [scheme](https://github.com/advisories/GHSA-w74x-v6f9-j3xg), [host](https://github.com/advisories/GHSA-wjr9-j795-jxcr) and relative-reference fixes. This lockfile resolution does not replace URI code embedded inside upstream SDK bundles; Feedbacks supplies code-defined schemas to those validators. These dependency advisories do not establish exploitation of a Feedbacks installation. Recheck the current lockfile and distinguish development-only packages from the production dependency tree.