# Dependency review

## Isolation

The GoLand adapter is an independently versioned IntelliJ Platform plugin.
None of its Java, Gradle, test, or IDE dependencies enters Spice's Go compiler,
runtime, generated applications, vendor tree, or deployed services.

## Direct tooling and test dependencies

| Dependency | Pin | Scope | License and maintenance |
| --- | --- | --- | --- |
| IntelliJ Platform Gradle Plugin | 2.18.1 | Build/package | JetBrains-maintained, Apache-2.0 |
| GoLand platform | 2026.2.0.1 / `262.8665.336` | Compile/test/verifier | JetBrains product SDK; not redistributed by the plugin archive |
| Go plugin | bundled `262.8665.336` | Compile/runtime contract | JetBrains-bundled GoLand/IDEA dependency |
| Gradle wrapper | 9.6.1 | Build orchestration | Apache-2.0; distribution and wrapper JAR SHA-256 pinned |
| IntelliJ Plugin Verifier | 1.409 | Binary/API verification | JetBrains-maintained, Apache-2.0 |
| JUnit | 4.13.2 | Test only | Eclipse Public License 1.0 |

`gradle.lockfile` fixes the transitive graph for the downloadable GoLand
distribution used by CI. `gradle-installed-goland.lockfile` independently fixes
the installed-IDE graph because the IntelliJ Platform plugin exposes that same
build through a different `localIde` coordinate. Both lock states are strict.
The plugin archive contains Spice classes, resources, and the Apache-2.0
license; it does not bundle GoLand, the Go plugin, Gradle, Plugin Verifier,
JUnit, a Java runtime, or a second Spice compiler.

## Security, cancellation, and data

The runtime adapter performs no network requests, credential reads, telemetry,
package scanning, or dependency downloads. It starts only the explicitly
configured or inherited `spice` executable with the `lsp` argument and UTF-8
stdio. Shell interpretation is not used. GoLand owns process shutdown and LSP
request cancellation; Spice owns protocol bounds and compiler cancellation.

The bundled annotation reference is read through a fixed classpath resource
with a 2 MiB bound. Virtual declarations are read-only and project-scoped.
Syntax coloring and folding inspect existing comments and maintain no global
mutable application model. Annotation values, source, and secrets are never
sent to an independent telemetry or logging channel.

## Acceptance

Java compilation enables all lint categories and treats warnings as errors.
Repository verification covers real GoLand fixtures, light and dark visual
rendering, archive/configuration validation, and Plugin Verifier against
`GO-262.8665.336`. Installed-plugin acceptance on Windows and Linux exercises
physical-source preservation, Run, Debug, and a real package breakpoint.
Platform updates require an explicit compatibility/lock change and fresh visual
plus binary evidence before release.