# Dependency review

Commerce is an application, not a library. Its selected dependencies therefore
model a realistic deployment while remaining explicit and independently
auditable.

## Spice Framework

- Module: `github.com/spice-framework/spice`
- Selection: the immutable pseudo-version recorded in `go.mod`
- License: Apache-2.0
- Purpose: public runtime contracts, annotation descriptors, and generated-code
  testing support.
- Runtime: generated ordinary Go directly calls selected providers. The
  compiler does not participate in the running application.
- Security: no module download occurs during normal generation or verification;
  the committed vendor tree is checked against a fresh deterministic render.

## Spice toolchain

- Module: `github.com/spice-framework/toolchain`
- Selection: the independently pinned immutable pseudo-version in `go.mod`
- License: Apache-2.0
- Purpose: the Spice CLI, compiler, generator, verifier, development loop, and
  official annotation tool.
- Runtime: toolchain packages are selected only through Go `tool` directives
  and do not participate in the generated application's runtime graph.
- Security: tools run from the exact Go module graph with offline generation
  and verification; compatibility checks validate the tool module independently
  from the core module.

## pgx

- Module: `github.com/jackc/pgx/v5`
- Selection: `v5.10.0`, through Spice's opt-in PostgreSQL starter
- License: MIT
- Purpose: PostgreSQL `database/sql` driver and connection behavior.
- Cancellation and cleanup: callers own contexts; the application owns the
  pool and closes it through generated lifecycle cleanup.
- Security: TLS is verified by default. A local `sslmode=disable` URL is
  rejected unless `SPICE_COMMERCE_DATABASE_ALLOW_INSECURE=true` is explicitly
  set. Hosted acceptance proves real PostgreSQL persistence and cleanup.

The remaining selected modules are pgx transitive support dependencies or Go
`x` modules selected by Spice. `govulncheck` and `gosec` are mandatory in the
repository gate. Dependency updates must preserve the zero-network default,
caller cancellation, deterministic configuration, secret redaction, and the
real PostgreSQL acceptance result.