Dependency reviews

This folder records reviewed third-party dependencies and the boundary each one is allowed to cross. Each dependency must remain behind a project-owned module or tooling boundary so upstream APIs do not leak across the homeserver.

Reviewed dependencies

Dependency	Scope	Review
LibSodium	Runtime cryptography	libsodium.md
OpenSSL	Runtime TLS listener boundary	openssl.md
libcurl	Federation outbound HTTP client	libcurl.md
PostgreSQL libpq	Runtime PostgreSQL client	postgresql-libpq.md
SQLite	Runtime/development embedded database	sqlite.md
yyjson	Canonical JSON parser adapter	yyjson.md
Catch2	Test framework	catch2.md
MkDocs and Material for MkDocs	Documentation site tooling	mkdocs.md

Review rules

• Runtime dependencies must be wrapped behind a Merovingian namespace boundary.
• Third-party handles must be RAII-managed before they leave the implementation file that owns them.
• Third-party headers should be treated as system includes where supported so warning-as-error applies to project code.
• Direct third-party dependencies resolve from operating-system packages so production deployments receive distro security updates: OpenSSL, LibSodium, PostgreSQL libpq, and libcurl are system-provided on every platform (allow_fallback: false), as are the libpng and libjpeg-turbo image codecs used by the sandboxed thumbnail worker. Only SQLite, yyjson, and the Catch2 test framework build from source-pinned wraps when no system copy is present (the build wrappers always use the wraps). The OS-supplied dependencies have no wrap file (ADR-0218), except libcurl, whose wrap only the static musl build uses. See platform-support.md for per-platform package names.
• Direct dependencies must be pinned immutably. Source-pinned dependencies use Meson [wrap-file] entries with SHA-256 hashes. See the per-dependency review notes and licenses.md for the license compatibility matrix.
• Test-only dependencies must not be linked into production targets.