# PCH-02-004 — Exact-pin crypto-adjacent dependencies

**Severity:** Informational
**Target files:** `package.json:40-46`, `bun.lock` (regenerated), new
`WASM-PROVENANCE.md` (see deviation note)
**Report:** peach-code-review.md, Finding PCH-02-004

## Pinned versions — read from bun.lock, pin-in-place, NO upgrades

Every version below is the exact version already resolved and installed
(verified against `bun.lock` on 2026-06-12). Pinning changes the range string
only; the installed tree is unchanged.

| Dependency | Current range | Pin to (from bun.lock) |
|---|---|---|
| `otpauth` | `^9.5.0` | `9.5.0` |
| `pako` | `^2.1.0` | `2.1.0` |
| `@zxing/library` | `^0.23.0` | `0.23.0` |
| `bwip-js` | `^4.10.1` | `4.11.1` |
| `pdf-lib` | `^1.17.1` | `1.17.1` |
| `papaparse` | `^5.5.3` | `5.5.3` *(optional hunk — see note)* |

Note `bwip-js`: the lockfile already resolved `4.11.1` (caret drift from the
declared `^4.10.1`) — pinning to what is installed, per the brief.

**papaparse (optional hunk):** the brief's pin list names five packages; the
report's finding text additionally cites `papaparse ^5.5.3` (CSV import path —
the formula-injection surface). The hunk below includes it for a uniform
supply-chain posture; drop that one line if the integrator prefers to track
the brief's list exactly.

## package.json edit

```json
// BEFORE (package.json:40-46, interleaved with already-pinned deps)
    "@zxing/library": "^0.23.0",
    "bwip-js": "^4.10.1",
    "hash-wasm": "4.12.0",
    "otpauth": "^9.5.0",
    "pako": "^2.1.0",
    "papaparse": "^5.5.3",
    "pdf-lib": "^1.17.1",

// AFTER
    "@zxing/library": "0.23.0",
    "bwip-js": "4.11.1",
    "hash-wasm": "4.12.0",
    "otpauth": "9.5.0",
    "pako": "2.1.0",
    "papaparse": "5.5.3",
    "pdf-lib": "1.17.1",
```

## Integration steps (cannot run from a draft — no build tools in this pass)

1. Apply the `package.json` edit.
2. `bun install` — regenerates `bun.lock` so the recorded ranges match the
   pinned declarations. Because every pin equals the resolved version, the
   dependency tree (and every integrity hash) is unchanged; only range
   metadata moves.
3. Verify: `git`-free check via `koh status --json` should show exactly
   `package.json` + `bun.lock` modified; `bun pm ls | grep -E "otpauth|pako|zxing|bwip|pdf-lib"`
   shows the same versions as before.
4. `npx tsc --noEmit` && `npx vitest run` — no code paths change; both must
   stay green trivially.

Transitive note (no action): `pdf-lib` internally depends on `pako ^1.0.11`
(its own compiled copy, resolved at `1.0.11` in the lockfile). That copy is
internal to pdf-lib's API and is not the `pako@2.1.0` Peach imports in
`generate.ts`; the lockfile pins both today.

## WASM-PROVENANCE.md — deviation note

The brief says "add a comment to `WASM-PROVENANCE.md`", but **no such file
exists anywhere in the repository** (searched repo-wide). The LV-9 audit-fix
draft session referenced creating one; it evidently never landed. This draft
therefore ships the file itself — see `WASM-PROVENANCE.md` in this folder,
destination: repo root. If the integrator knows of an existing provenance doc
under a different name, fold the "Exact-pin discipline" section into it
instead.

## Save message (integration)

`fix: PCH-02-004 exact-pin crypto-adjacent deps (otpauth, pako, @zxing/library, bwip-js, pdf-lib, papaparse) + add WASM-PROVENANCE.md`