1# PCH-02-004 — Exact-pin crypto-adjacent dependencies23**Severity:** Informational4**Target files:** `package.json:40-46`, `bun.lock` (regenerated), new5`WASM-PROVENANCE.md` (see deviation note)6**Report:** peach-code-review.md, Finding PCH-02-00478## Pinned versions — read from bun.lock, pin-in-place, NO upgrades910Every version below is the exact version already resolved and installed11(verified against `bun.lock` on 2026-06-12). Pinning changes the range string12only; the installed tree is unchanged.1314| Dependency | Current range | Pin to (from bun.lock) |15|---|---|---|16| `otpauth` | `^9.5.0` | `9.5.0` |17| `pako` | `^2.1.0` | `2.1.0` |18| `@zxing/library` | `^0.23.0` | `0.23.0` |19| `bwip-js` | `^4.10.1` | `4.11.1` |20| `pdf-lib` | `^1.17.1` | `1.17.1` |21| `papaparse` | `^5.5.3` | `5.5.3` *(optional hunk — see note)* |2223Note `bwip-js`: the lockfile already resolved `4.11.1` (caret drift from the24declared `^4.10.1`) — pinning to what is installed, per the brief.2526**papaparse (optional hunk):** the brief's pin list names five packages; the27report's finding text additionally cites `papaparse ^5.5.3` (CSV import path —28the formula-injection surface). The hunk below includes it for a uniform29supply-chain posture; drop that one line if the integrator prefers to track30the brief's list exactly.3132## package.json edit3334```json3536 "@zxing/library": "^0.23.0",37 "bwip-js": "^4.10.1",38 "hash-wasm": "4.12.0",39 "otpauth": "^9.5.0",40 "pako": "^2.1.0",41 "papaparse": "^5.5.3",42 "pdf-lib": "^1.17.1",434445 "@zxing/library": "0.23.0",46 "bwip-js": "4.11.1",47 "hash-wasm": "4.12.0",48 "otpauth": "9.5.0",49 "pako": "2.1.0",50 "papaparse": "5.5.3",51 "pdf-lib": "1.17.1",52```5354## Integration steps (cannot run from a draft — no build tools in this pass)55561. Apply the `package.json` edit.572. `bun install` — regenerates `bun.lock` so the recorded ranges match the58 pinned declarations. Because every pin equals the resolved version, the59 dependency tree (and every integrity hash) is unchanged; only range60 metadata moves.613. Verify: `git`-free check via `koh status --json` should show exactly62 `package.json` + `bun.lock` modified; `bun pm ls | grep -E "otpauth|pako|zxing|bwip|pdf-lib"`63 shows the same versions as before.644. `npx tsc --noEmit` && `npx vitest run` — no code paths change; both must65 stay green trivially.6667Transitive note (no action): `pdf-lib` internally depends on `pako ^1.0.11`68(its own compiled copy, resolved at `1.0.11` in the lockfile). That copy is69internal to pdf-lib's API and is not the `[email protected]` Peach imports in70`generate.ts`; the lockfile pins both today.7172## WASM-PROVENANCE.md — deviation note7374The brief says "add a comment to `WASM-PROVENANCE.md`", but **no such file75exists anywhere in the repository** (searched repo-wide). The LV-9 audit-fix76draft session referenced creating one; it evidently never landed. This draft77therefore ships the file itself — see `WASM-PROVENANCE.md` in this folder,78destination: repo root. If the integrator knows of an existing provenance doc79under a different name, fold the "Exact-pin discipline" section into it80instead.8182## Save message (integration)8384`fix: PCH-02-004 exact-pin crypto-adjacent deps (otpauth, pako, @zxing/library, bwip-js, pdf-lib, papaparse) + add WASM-PROVENANCE.md`