Software Bill of Materials
30 dependencies across 7 categories — every framework, database, model API, hosted service, and build tool the platform runs on, with license and residual-risk classification for inspector review.
Pinned via package.json. Update via PR. Last reviewed: 2026-06-05.
Total
30
Low risk
16
Medium risk
9
High risk
5
Requires license
8
Languages & Runtimes
2 dependencies| Name | Version | License | Vendor | Purpose | Risk | License req. |
|---|---|---|---|---|---|---|
TypeScript typescript | 5.6.0 | Apache-2.0 | Microsoft | Typed superset of JavaScript — the canonical language for every package in the repo. | low | |
Node.js nodejs | 22.0.0 | MIT | OpenJS Foundation | JavaScript runtime used for every service, API route, agent, and CLI tool. | low |
Frameworks
5 dependencies| Name | Version | License | Vendor | Purpose | Risk | License req. |
|---|---|---|---|---|---|---|
Next.js nextjs | 15.0.0 | MIT | Vercel | App Router web framework for the L5 consoles, sponsor portal, and inspection view. | low | |
React react | 19.0.0 | MIT | Meta | UI library underlying every page and component in apps/web. | low | |
React DOM react-dom | 19.0.0 | MIT | Meta | DOM renderer for React on the client and server-side rendering pipeline. | low | |
Tailwind CSS tailwindcss | 4.0.0 | MIT | Tailwind Labs | Utility-first styling for every UI surface in apps/web. | low | |
shadcn/ui shadcn-ui | 0.9.0 | MIT | shadcn | Copy-in component primitives used as the UI foundation for consoles and forms. | low |
Databases
3 dependencies| Name | Version | License | Vendor | Purpose | Risk | License req. |
|---|---|---|---|---|---|---|
Drizzle ORM drizzle-orm | 0.36.0 | Apache-2.0 | Drizzle Team | Typed query builder and migration toolkit for the cro.* Postgres schema. | low | |
Supabase Postgres supabase-postgres | 15.6.0 | PostgreSQL | Supabase | Primary system of record — hosts the cro.* schema, RLS policies, and pg_cron jobs. | medium | |
pgvector pgvector | 0.8.0 | PostgreSQL | pgvector | Postgres extension powering the vector spine for citation-grounded RAG. | low |
Auth
1 dependency| Name | Version | License | Vendor | Purpose | Risk | License req. |
|---|---|---|---|---|---|---|
Supabase Auth supabase-auth | 2.158.0 | Apache-2.0 | Supabase | User authentication with TOTP MFA; underpins the Part 11 re-auth flow before signature. | high |
Model APIs
2 dependencies| Name | Version | License | Vendor | Purpose | Risk | License req. |
|---|---|---|---|---|---|---|
Anthropic Claude Sonnet 4.7 anthropic-claude-sonnet-4-7 | claude-sonnet-4-7 | commercial | Anthropic | Default model for most agents — drafting, classification, summarization, and review. | high | |
Anthropic Claude Opus 4.7 anthropic-claude-opus-4-7 | claude-opus-4-7 | commercial | Anthropic | High-stakes model for protocol amendments, narrative authoring, and evaluator calls. | high |
Hosted Services
8 dependencies| Name | Version | License | Vendor | Purpose | Risk | License req. |
|---|---|---|---|---|---|---|
Supabase Storage supabase-storage | 1.11.0 | Apache-2.0 | Supabase | Object storage for inspection ZIPs, evidence binders, and TMF essential documents. | medium | |
Vercel Cron vercel-cron | 1.0.0 | commercial | Vercel | Scheduled HTTPS triggers for agent kicks, daily audits, and digest generation. | medium | |
Vercel Hosting vercel-hosting | 1.0.0 | commercial | Vercel | Edge + serverless hosting for apps/web; auto-deploys every push to main and PR. | medium | |
MedDRA meddra | 27.0 | commercial | ICH MSSO | Regulated medical dictionary for adverse event coding; required for safety/PV narratives. | high | |
WHODrug Global whodrug | B3 2026 Mar 1 | commercial | Uppsala Monitoring Centre | Regulated drug dictionary for concomitant medication coding in safety and PV workflows. | high | |
CDISC Controlled Terminology cdisc-ct | 2026-03-28 | CC-BY-NC-ND-4.0 | CDISC | Standardized terminology for SDTM/ADaM datasets and protocol metadata; submission-required. | medium | |
Inngest (deferred) inngest | n/a | Apache-2.0 | Inngest | Durable workflow engine. Deferred per ADR 0006 — re-evaluate when multi-step fan-out emerges. | medium | |
Supabase Realtime supabase-realtime | 2.30.0 | Apache-2.0 | Supabase | WebSocket broadcast of provenance_event inserts to live dashboards (event bus). | medium |
Build & Test Tooling
9 dependencies| Name | Version | License | Vendor | Purpose | Risk | License req. |
|---|---|---|---|---|---|---|
pnpm pnpm | 9.0.0 | MIT | pnpm | Workspace-aware package manager used across the Turborepo monorepo. | low | |
Turborepo turborepo | 2.0.0 | MPL-2.0 | Vercel | Monorepo task runner with remote caching used for build/lint/test pipelines. | low | |
Vitest vitest | 2.0.0 | MIT | VoidZero | Unit test runner powering every test in services/, packages/, and apps/web. | low | |
Biome biome | 1.9.0 | MIT | Biome | Linter and formatter for TypeScript, JSON, and React JSX across the monorepo. | low | |
GitHub Actions github-actions | 1.0.0 | commercial | GitHub | CI/CD pipeline runner — lint, typecheck, test, build, and auto-merge gates. | medium | |
JSZip jszip | 3.10.1 | MIT | Stuart Knightley | Pure-JS ZIP builder used to package the inspection evidence binder for download. | low | |
neverthrow neverthrow | 8.0.0 | MIT | Giorgio Polvara | Typed Result<T, E> for service boundaries — non-throwing error handling. | low | |
promptfoo promptfoo | 0.95.0 | MIT | promptfoo | Golden-case evaluation harness for every agent prompt; gates prompt registry bumps. | medium | |
Playwright (planned) playwright | 1.48.0 | Apache-2.0 | Microsoft | End-to-end browser testing for signature-capturing UI routes. Planned, not yet wired into CI. | low |