Nothing instrumented today. No log shipper, no APM, no error tracker (Sentry/Highlight/etc.), no metrics, no alerting. The architecture page calls out the intent (deployment.md § Observability) — implementation is deferred to whatever the #19 hosting decision pulls along.
Caret-floating is the default across the repo. Three packages are pinned to an exact version:
next: 16.2.4
react: 19.2.4, react-dom: 19.2.4
eslint-config-next: 16.2.4
The Next pin is intentional — Next 16 + React 19 are recent, and a minor bump can introduce regressions in App Router edge cases. The React exact pin pairs with the Next pin (Next 16 ships compiled against React 19.2.4). eslint-config-next exact pin matches the Next version. Everything else floats on caret. The lockfile (package-lock.json) is committed, so day-to-day builds are reproducible regardless of caret ranges.
Probably intentional (server-action / API validation expected)
Keep until M2 server actions land; if still unused at end of M2, drop
@radix-ui/react-checkbox
Filter sidebar (M2 polish item 5 in REBUILD-V1.md)
Intentional pre-install
Keep
@radix-ui/react-dialog
Choose-component sheet
Intentional pre-install
Keep
@radix-ui/react-dropdown-menu
Reserved
Intentional
Keep or drop with the next radix audit
@radix-ui/react-select
Reserved
Intentional
Keep or drop
@radix-ui/react-slider
Price-range filter (M2 polish item 5)
Intentional
Keep
@radix-ui/react-tabs
Reserved
Intentional
Keep or drop
@radix-ui/react-tooltip
Reserved
Intentional
Keep or drop
ts-node
devDep, not referenced by any script
Likely a Prisma 6 carry-over (Prisma 7 uses tsx)
Drop in a tidy-deps PR
The dead deps (zustand, ts-node) are minor — drop them when convenient. The "intentional pre-installs" should not be dropped without coordinating with the upcoming tickets that bring them in.
Tailwind 4 + no Prettier — Tailwind 4 has known opinions on class formatting. Without Prettier or a class-sorter, formatting is by manual convention. Worth a one-line decision on whether to add Prettier + prettier-plugin-tailwindcss or stay manual.
No engines field, no .nvmrc — the dev box is on Node 22, but a contributor on Node 18 or 20 would silently get a different runtime. Add "engines": { "node": ">=22" } in package.json and a .nvmrc (one line: 22).
No app CI gate — .github/workflows/docs.yml is the only workflow. vitest, tsc --noEmit, eslint are run locally only. A red test on master would not surface until someone runs the suite. Worth adding a ci.yml workflow that runs the three.
Observability: nothing — see the layer note above.
react: 19.2.4 and react-dom: 19.2.4 are exact-pinned without a caret. This is intentional given the Next 16 pin, but the relationship is implicit. Worth a one-line comment in package.json (or, more durably, an ADR after #19 lands).
eslint-config-next: 16.2.4 exact pin is correct (must match Next major.minor) but is easy to forget when the Next pin moves. Consider a comment-style note in eslint.config.mjs.
Five major dependencies in the stack shipped within the last ~6 months:
Next.js 16 (released late 2025)
React 19 (early 2025 stable; Next 16 bundles React 19.2)
Prisma 7 (late 2025; the prisma.config.ts + @prisma/adapter-pg shape is the Prisma 7 model)
Tailwind 4 (late 2025)
Vitest 4 (early 2026)
Each of these alone is fine. The cluster is the risk: a single supply-chain incident or a regression in one major patch would cascade — and ESLint's eslint-config-next is exact-pinned to the Next version, so you can't easily jump only one of them. Lockfile + careful upgrade discipline mitigates day-to-day; a quarterly "bump the bleeding-edge stack" ADR would formalise the cadence.
Mitigation already in place: package-lock.json committed; CI does not auto-bump.
motion is the rebrand of Framer Motion as an independent library; ownership is stable but the rename is recent.
cheerio 1.2 is mature.
undici 7 is the Node-team-maintained HTTP client used internally by Node's fetch.
All other deps are mainstream.
No deps flagged as unmaintained, deprecated, or with known security advisories at the time of this audit. npm audit is not run in CI — adding it (or pnpm audit --prod) to a future ci.yml is a low-cost win.
LTS active until April 2027 (maintenance until Apr 2028)
Postgres 17
Major-version support until November 2029
Redis 7
Maintenance until at least 2027
Tailwind 4
Active major
React 19
Active major
Next.js 16
Active major; Next typically supports the previous one major back
Prisma 7
Active major
No piece of the stack is approaching EOL. The first one to retire will be Node 22 — by then the queue/search/hosting decisions will have been made and most of the framework majors will have moved.
No secrets in the repo; .env is gitignored, .env.example is the committed template.
IP_HASH_SECRET defaults to a literal string dev-secret-rotate-in-prod in src/app/api/go/... (env-vars.md § IP_HASH_SECRET) — must be rotated to a real ≥32-byte random value before any prod deploy.
No CSP, no rate limiting, no auth — all M2 concerns (#11, #12).
next.config.tsimages.remotePatterns is the only outbound-image allow-list — fine for now; revisit once images move to a CDN.