Software Bill of Materials (SBOM)
This document lists every direct software dependency used by Mitch‑Risk v1.2.0, organised by functional purpose. It is intended for security reviewers, compliance assessors, and procurement teams evaluating the platform for organisational use.
Runtime Requirements
| Component | Minimum Version | Notes |
|---|---|---|
| Node.js | 22 | JavaScript runtime (LTS) |
| PostgreSQL | 17 | Relational database server |
| Docker (optional) | 24+ | Container runtime for self-hosted deployment |
Runtime Dependencies
Framework & Runtime
| Package | Version | License | Purpose |
|---|---|---|---|
| next | 16.2.10 | MIT | Full-stack React framework (App Router, Server Components, Server Actions) |
| react | 19.2.7 | MIT | UI library |
| react-dom | 19.2.7 | MIT | React DOM renderer |
Database & ORM
| Package | Version | License | Purpose |
|---|---|---|---|
| prisma | 7.8.0 | Apache-2.0 | Type-safe ORM — schema management, migrations, query engine |
| @prisma/client | 7.8.0 | Apache-2.0 | Generated Prisma client for type-safe database access |
| @prisma/adapter-pg | 7.8.0 | Apache-2.0 | Driver adapter connecting Prisma to PostgreSQL via node-postgres |
| pg | 8.22.0 | MIT | PostgreSQL client library used by the Prisma driver adapter |
Authentication & Security
| Package | Version | License | Purpose |
|---|---|---|---|
| next-auth | 5.0.0-beta.31 | ISC | Authentication framework — session management, SSO (OIDC), credentials |
| bcryptjs | 3.0.3 | BSD-3-Clause | Password hashing (12 rounds) and API key verification |
| zod | 4.4.3 | MIT | Schema validation for all external input (forms, API bodies, imports) |
UI Components & Styling
| Package | Version | License | Purpose |
|---|---|---|---|
| radix-ui | 1.6.2 | MIT | Unstyled accessible UI primitives (dialogs, selects, tabs, tooltips) |
| @radix-ui/react-alert-dialog | 1.1.19 | MIT | Confirmation dialog primitive |
| @radix-ui/react-slot | 1.3.0 | MIT | Component composition utility (asChild pattern) |
| tailwindcss | 4.x | MIT | Utility-first CSS framework (dev dependency, compiled at build time) |
| tailwind-merge | 3.6.0 | MIT | Resolves Tailwind class conflicts |
| class-variance-authority | 0.7.1 | Apache-2.0 | Component variant management (cva pattern) |
| clsx | 2.1.1 | MIT | Conditional class name builder |
| tw-animate-css | 1.4.0 | MIT | Animation utilities for Tailwind |
| lucide-react | 1.24.0 | ISC | Icon library |
| sonner | 2.0.7 | MIT | Toast notification system |
| cmdk | 1.1.1 | MIT | Command palette / combobox primitive |
| next-themes | 0.4.6 | MIT | Light/dark theme switching |
Data Display & Charts
| Package | Version | License | Purpose |
|---|---|---|---|
| recharts | 3.9.2 | MIT | Radar charts and bar charts on the dashboard |
| @tanstack/react-table | 8.21.3 | MIT | Sortable, filterable table primitives |
Rich Text & Markdown
| Package | Version | License | Purpose |
|---|---|---|---|
| react-markdown | 10.1.0 | MIT | Renders Markdown help text in the vendor portal |
| @uiw/react-md-editor | 4.1.1 | MIT | WYSIWYG Markdown editor for question help text (template builder) |
| marked | 18.0.6 | MIT | Markdown parser used server-side |
| @tailwindcss/typography | 0.5.20 | MIT | Typography presets for rendered Markdown |
Email
| Package | Version | License | Purpose |
|---|---|---|---|
| nodemailer | 9.0.3 | MIT-0 | SMTP email delivery (invites, reminders, escalations) |
| @react-email/components | 1.0.12 | MIT | React components for email template rendering |
File Storage
| Package | Version | License | Purpose |
|---|---|---|---|
| @aws-sdk/client-s3 | 3.1086.0 | Apache-2.0 | S3-compatible file storage (evidence, attachments) |
| @azure/storage-blob | 12.33.0 | MIT | Azure Blob Storage alternative for file storage |
Document Generation
| Package | Version | License | Purpose |
|---|---|---|---|
| @react-pdf/renderer | 4.5.1 | MIT | Server-side PDF generation (assessment and framework compliance reports) |
Utilities
| Package | Version | License | Purpose |
|---|---|---|---|
| dotenv | 17.4.2 | BSD-2-Clause | Environment variable loading |
| tsx | 4.23.1 | MIT | TypeScript execution for seed scripts |
Build & Development Dependencies
These packages are used during development and CI only — they are not included in the production Docker image.
| Package | Version | License | Purpose |
|---|---|---|---|
| typescript | 6.x | Apache-2.0 | Static type checking |
| eslint | 9.x | MIT | Code quality linting |
| eslint-config-next | 16.2.10 | MIT | Next.js-specific lint rules |
| prettier | 3.x | MIT | Code formatting |
| prettier-plugin-tailwindcss | 0.8.0 | MIT | Tailwind class sorting |
| tailwindcss | 4.x | MIT | CSS framework (compiled at build) |
| @tailwindcss/postcss | 4.x | MIT | PostCSS integration for Tailwind |
| vitest | 4.x | MIT | Unit and integration test framework |
| @playwright/test | 1.x | Apache-2.0 | End-to-end browser testing |
| vitepress | 1.x | MIT | Documentation site generator |
| vite-tsconfig-paths | 6.x | MIT | Path alias resolution for tests |
| @types/node | 22.x | MIT | Node.js type definitions |
| @types/react | 19.x | MIT | React type definitions |
| @types/react-dom | 19.x | MIT | React DOM type definitions |
| @types/nodemailer | 8.x | MIT | Nodemailer type definitions |
License Summary
| License | Count | Dependencies |
|---|---|---|
| MIT | 38 | Next.js, React, Radix UI, Tailwind, Recharts, Nodemailer, pg, Zod, and most others |
| Apache-2.0 | 6 | Prisma (3 packages), AWS S3 SDK, TypeScript, class-variance-authority |
| BSD-3-Clause | 1 | bcryptjs |
| BSD-2-Clause | 1 | dotenv |
| ISC | 2 | NextAuth, Lucide React |
| MIT-0 | 1 | Nodemailer |
All dependencies use permissive open-source licenses (MIT, Apache-2.0, BSD, ISC, MIT-0). No copyleft-licensed dependencies (GPL, AGPL, LGPL) are present in the dependency tree. Mitch‑Risk itself is licensed under AGPL-3.0.
Regenerating
To produce a current dependency listing:
bash
npm ls --production --depth=0
npm ls --all --depth=0For a machine-readable SPDX or CycloneDX SBOM, use a tool such as @cyclonedx/cyclonedx-npm:
bash
npx @cyclonedx/cyclonedx-npm --output-file sbom.json