# Dependency audit notes (points 22)

## Runtime vs devDependencies

| Package | Placement | Why |
|---------|-----------|-----|
| `next`, `react`, `react-dom` | dependencies | App runtime |
| `@prisma/client` | dependencies | DB runtime |
| `prisma` | **dependencies** | Required for cPanel `postinstall` → `prisma generate` when production omits devDeps |
| `stripe`, `@stripe/*` | dependencies | Checkout |
| `bcryptjs`, `jose` | dependencies | Auth |
| `nodemailer` | dependencies | Admin email test |
| `framer-motion`, `lucide-react`, `clsx`, `tailwind-merge` | dependencies | UI runtime |
| `typescript`, `eslint*`, `tailwindcss`, `tsx`, `@types/*` | devDependencies | Local build/lint only |

## Node

- `engines.node`: `>=20` (match cPanel Node selector)

## Conservative stance

- No major Next/React upgrades performed for this audit
- Prefer security patches within current major lines when needed
- `postinstall`: `prisma generate` (runs via cPanel Run NPM Install)

## Not introduced

- Redis, PM2, Docker — incompatible with stated cPanel constraints