📦 Dependencies & Licensing

📋 Summary

The application depends on a small set of 15 direct runtime libraries, which is a healthy, low-sprawl position. However, the dependency audit reports 24 known vulnerabilities (3 critical, 13 high), 11 of which reach production code. The single most important item is the web framework itself: Next.js is pinned to exactly 16.2.0, a release affected by roughly 26 published advisories, including critical remote-code-execution issues in a feature the product actually uses (generated tab icons). A second production concern is the spreadsheet library xlsx, which has not been updated on npm since 2022, has unfixed vulnerabilities, and is used to parse uploaded files on the server. Two declared libraries are not used at all. On licensing the picture is clean for a commercial acquirer: everything shipped is permissive, with only weak-copyleft (LGPL, MPL) or dual-licensed components that are used unmodified, and the product's own code is proprietary to a single named individual — which makes clear IP assignment a contractual must.

🎯 Rating

🔴 ●●○○○ 2 / 5 — Red. A small, sensible dependency set is undermined by a critically vulnerable, exact-pinned framework and an abandoned parser handling untrusted uploads, with no automated dependency scanning to catch either.

🔍 Findings

Part A — Dependencies

A1. Direct runtime dependencies

[Observed] package.json, npm outdated, grep -rlE "from '<pkg>'" src.

Unmaintained (no release in 2+ years): xlsx only (npm release 0.18.5 dated 2022-03-24; the vendor now distributes newer builds from its own CDN rather than npm). [Observed] No deprecated direct dependency is reported by npm; node-domexception (transitive) is deprecated. [Observed] npm ci warnings.

A2. Vulnerability audit (npm audit, 2026-10-07)

Key items:

[Observed] npm audit, npm audit --json, npm audit --omit=dev. Whether the production deployments are actually running 16.2.0 depends on the deployed lockfile. [Unavailable — requires Vercel deployment access to confirm the deployed build.]

A3. Vendored, forked or patched code

• No patches/ directory, no patch-package, no forked git dependencies. [Observed]
• src/types/mammoth.d.ts is a hand-written type declaration (not a fork). [Observed]
• Studio code was moved to a separate private repository (FS002-dev/campaign-studio) on 2026-09-19; src/lib/artwork/ (fit arithmetic, renderer) stayed here. This is in-house code, not a vendored library, but its counterpart lives in another repository the buyer should also obtain. [Observed] CLAUDE.md "Parked decisions"; [Unavailable] the other repository.
• Two Python audit utilities (audits/*.py) and Node scripts (scripts/) are development tooling with no declared dependency manifest (no requirements.txt). [Observed]

A4. Major dependency relationships

Part B — Licensing

B1. Direct dependency licences

All 15 direct runtime dependencies are permissive: MIT (11), Apache-2.0 (xlsx, google-auth-library), ISC (lucide-react), BSD-2-Clause (mammoth). [Observed] each package's package.json.

B2. Whole installed tree (license-checker --summary)

MIT 417 · Apache-2.0 41 · ISC 26 · BSD-2 11 · BSD-3 8 · BlueOak-1.0.0 6 · MPL-2.0 5 · LGPL-3.0-or-later 2 · MIT AND Zlib 2 · and singletons: Python-2.0, CC-BY-4.0, BSD*, Unlicense, (MIT OR GPL-3.0-or-later), CC0-1.0, MIT-0, 0BSD, UNLICENSED (the product itself).

B3. Product licence, notices and provenance

• LICENSE: "Copyright (c) 2026 Matthew Prins, trading as Midshift. All rights reserved." — proprietary, owned by a named individual trading as Midshift, not a company. [Observed] LICENSE line 1. Any acquisition needs a written IP assignment from that individual (and from any other contributors whose work the squashed history hides). [Inferred]
• package.json declares "license": "UNLICENSED" and "private": true, consistent with proprietary code. [Observed]
• No NOTICE / third-party attribution file is produced for the shipped bundle. [Observed]
• No licence policy or allow-list is enforced in CI. [Observed] .github/workflows/ci.yml
• Code of uncertain provenance: the git history has been squashed to one commit by "Matthew Prins", so authorship of individual lines cannot be established from the repository. CLAUDE.md and code comments refer to work carried out across multiple "sessions", consistent with heavy AI-assisted development. [Inferred] Provenance of AI-generated code is not itself a licence breach, but the buyer should obtain warranties covering originality and third-party code. [Unavailable — requires original history and a contributor list.]
• scripts/scrub.js enforces that no client-identifying material is tracked — a positive confidentiality control (passes: "nothing client-identifiable in 715 tracked files"). [Observed]

🧾 Evidence

• npm ci (490 packages) → npm audit, npm audit --json, npm audit --omit=dev → "11 vulnerabilities (5 moderate, 5 high, 1 critical)".
• node -e over audit.json listing every Next.js advisory title and affected range.
• npm outdated; npm view xlsx 'time[0.18.5]' → 2022-03-24.
• license-checker --summary, license-checker --production --json.
• npm ls jszip sharp → mammoth@1.12.0 → jszip@3.10.1, next@16.2.0 → sharp@0.34.5.
• grep -n "ImageResponse" src/app/icon.tsx src/app/apple-icon.tsx; src/app/api/campaigns/[id]/products/route.ts:54–60 (server-side sheetRows on an uploaded file).
• Mermaid diagram validated (valid: true).

⚠️ Risks

✅ Recommendations