PCH-02-004 — Exact-pin crypto-adjacent dependencies

Severity: Informational Target files: package.json:40-46, bun.lock (regenerated), new WASM-PROVENANCE.md (see deviation note) Report: peach-code-review.md, Finding PCH-02-004

Pinned versions — read from bun.lock, pin-in-place, NO upgrades

Every version below is the exact version already resolved and installed (verified against bun.lock on 2026-06-12). Pinning changes the range string only; the installed tree is unchanged.

Dependency	Current range	Pin to (from bun.lock)
otpauth	^9.5.0	9.5.0
pako	^2.1.0	2.1.0
@zxing/library	^0.23.0	0.23.0
bwip-js	^4.10.1	4.11.1
pdf-lib	^1.17.1	1.17.1
papaparse	^5.5.3	5.5.3 (optional hunk — see note)

Note bwip-js: the lockfile already resolved 4.11.1 (caret drift from the declared ^4.10.1) — pinning to what is installed, per the brief.

papaparse (optional hunk): the brief's pin list names five packages; the report's finding text additionally cites papaparse ^5.5.3 (CSV import path — the formula-injection surface). The hunk below includes it for a uniform supply-chain posture; drop that one line if the integrator prefers to track the brief's list exactly.

package.json edit

// BEFORE (package.json:40-46, interleaved with already-pinned deps)
    "@zxing/library": "^0.23.0",
    "bwip-js": "^4.10.1",
    "hash-wasm": "4.12.0",
    "otpauth": "^9.5.0",
    "pako": "^2.1.0",
    "papaparse": "^5.5.3",
    "pdf-lib": "^1.17.1",

// AFTER
    "@zxing/library": "0.23.0",
    "bwip-js": "4.11.1",
    "hash-wasm": "4.12.0",
    "otpauth": "9.5.0",
    "pako": "2.1.0",
    "papaparse": "5.5.3",
    "pdf-lib": "1.17.1",

Integration steps (cannot run from a draft — no build tools in this pass)

1. Apply the package.json edit.
2. bun install — regenerates bun.lock so the recorded ranges match the pinned declarations. Because every pin equals the resolved version, the dependency tree (and every integrity hash) is unchanged; only range metadata moves.
3. Verify: git-free check via koh status --json should show exactly package.json + bun.lock modified; bun pm ls | grep -E "otpauth|pako|zxing|bwip|pdf-lib" shows the same versions as before.
4. npx tsc --noEmit && npx vitest run — no code paths change; both must stay green trivially.

Transitive note (no action): pdf-lib internally depends on pako ^1.0.11 (its own compiled copy, resolved at 1.0.11 in the lockfile). That copy is internal to pdf-lib's API and is not the [email protected] Peach imports in generate.ts; the lockfile pins both today.

WASM-PROVENANCE.md — deviation note

The brief says "add a comment to WASM-PROVENANCE.md", but no such file exists anywhere in the repository (searched repo-wide). The LV-9 audit-fix draft session referenced creating one; it evidently never landed. This draft therefore ships the file itself — see WASM-PROVENANCE.md in this folder, destination: repo root. If the integrator knows of an existing provenance doc under a different name, fold the "Exact-pin discipline" section into it instead.

Save message (integration)

fix: PCH-02-004 exact-pin crypto-adjacent deps (otpauth, pako, @zxing/library, bwip-js, pdf-lib, papaparse) + add WASM-PROVENANCE.md