docs/DEPENDENCY_AUDIT.md

# Dependency Audit Report

**Last Updated**: 2025-01-27
**Purpose**: Analysis of dependencies across all projects

---

## Overview

This document provides an analysis of dependencies across all projects in the workspace, identifying common dependencies, version inconsistencies, and opportunities for consolidation.

---

## Analysis Methodology

1. Scan all `package.json` files in the workspace
2. Extract production and development dependencies
3. Count usage frequency
4. Identify version inconsistencies
5. Recommend consolidation opportunities

**Note**: Run `scripts/deps-analyze.sh` to generate an updated analysis report.

---

## Common Dependencies

### Most Frequently Used (Production)

Based on initial analysis, these dependencies appear frequently:

#### TypeScript/JavaScript Core
- **typescript**: Used across TypeScript projects
- **zod**: Schema validation (used in 10+ projects)
- **dotenv**: Environment configuration (used in 15+ projects)
- **date-fns**: Date handling (used in 5+ projects)

#### Framework & Runtime
- **react**: Frontend projects
- **nextjs**: Next.js applications
- **express**: Backend services
- **fastify**: Backend services

#### Blockchain/Solidity
- **ethers** / **viem**: Ethereum libraries
- **@openzeppelin/contracts**: Smart contract libraries
- **foundry**: Solidity development (dev dependency)

#### Database
- **@prisma/client**: Database ORM
- **postgresql**: Database client

#### Utilities
- **winston**: Logging
- **jsonwebtoken**: Authentication
- **bcryptjs**: Password hashing
- **uuid**: UUID generation

### Most Frequently Used (Development)

#### Build & Tooling
- **typescript**: TypeScript compiler
- **eslint**: Linting
- **prettier**: Code formatting
- **@typescript-eslint/***: TypeScript ESLint plugins

#### Testing
- **vitest**: Testing framework (newer projects)
- **jest**: Testing framework (older projects)
- **@testing-library/react**: React testing utilities

#### Build Tools
- **vite**: Build tool
- **tsx**: TypeScript execution
- **tsc**: TypeScript compiler

---

## Version Consolidation Opportunities

### TypeScript
- **Current Versions**: Multiple versions (5.3.3, 5.5.4, etc.)
- **Recommendation**: Standardize on latest stable (5.5.4+)
- **Impact**: High - affects all TypeScript projects

### Zod
- **Current Versions**: Multiple versions (3.22.4, 3.23.8, etc.)
- **Recommendation**: Standardize on latest (3.23.8+)
- **Impact**: Medium - shared validation library

### ESLint
- **Current Versions**: Multiple versions (8.56.0, 8.57.0, 9.17.0)
- **Recommendation**: Migrate to ESLint 9.x across all projects
- **Impact**: High - affects code quality tooling

### Prettier
- **Current Versions**: Multiple versions (3.1.1, 3.2.0, 3.3.3)
- **Recommendation**: Standardize on latest (3.3.3+)
- **Impact**: Medium - code formatting

---

## Shared Package Candidates

### High Priority (Used in 5+ Projects)

1. **@workspace/shared-types**
   - Common TypeScript types
   - Used in: dbis_core, the_order, Sankofa, etc.

2. **@workspace/shared-utils**
   - Common utilities (date formatting, validation, etc.)
   - Used in: Multiple projects

3. **@workspace/shared-config**
   - Shared configuration schemas
   - Used in: All projects with configuration

4. **@workspace/shared-constants**
   - Shared constants and enums
   - Used in: DBIS projects, DeFi projects

### Medium Priority (Used in 3-4 Projects)

1. **@workspace/api-client**
   - Common API client utilities
   - Used in: Frontend projects, API consumers

2. **@workspace/validation**
   - Zod schemas and validators
   - Used in: Multiple backend services

---

## Dependency Security

### Security Scanning
- Run `pnpm audit` or `npm audit` in each project
- Use Dependabot for automated updates
- Review and update vulnerable dependencies regularly

### High-Risk Dependencies
- Review dependencies with known vulnerabilities
- Prioritize updates for security-critical packages
- Document security update process

---

## Recommendations

### Immediate Actions

1. **Hoist Common DevDependencies**
   - typescript
   - eslint
   - prettier
   - @typescript-eslint/*
   - vitest/jest

2. **Create Shared Packages**
   - Start with @workspace/shared-types
   - Create @workspace/shared-utils
   - Extract common validation schemas

3. **Version Consolidation**
   - Standardize TypeScript version
   - Standardize Zod version
   - Standardize ESLint/Prettier versions

### Long-Term Actions

1. **Dependency Audit Process**
   - Quarterly dependency reviews
   - Automated security scanning
   - Version update workflow

2. **Shared Package Strategy**
   - Extract shared code gradually
   - Document shared package APIs
   - Version shared packages independently

---

## Tools for Analysis

### Automated Tools
- **npm-check-updates**: Check for outdated packages
- **depcheck**: Find unused dependencies
- **npm-audit**: Security vulnerability scanning
- **pnpm-why**: Understand why dependencies are installed

### Manual Review
- Review package.json files regularly
- Track dependency updates
- Document breaking changes

---

**Next Steps**: Run `scripts/deps-analyze.sh` to generate detailed analysis report.