# Dependencies

QA Scribe uses a Rust workspace for core and desktop backend code, plus a Bun-managed React frontend.

## Rust dependency groups

| Dependency | Used for |
| --- | --- |
| `tauri`, `tauri-build`, `tauri-specta` | Desktop shell, build integration, command bindings. |
| `rusqlite` | Local SQLite storage with bundled SQLite. |
| `serde`, `serde_json` | DTO serialization. |
| `specta`, `specta-typescript` | Type export to TypeScript. |
| `chrono` | Timestamps. |
| `uuid` | IDs. |
| `sha2`, `base64` | Attachment hashing and data URLs. |
| `thiserror` | Core error type. |

Versions are declared in `Cargo.toml` and locked in `Cargo.lock`.

## Frontend dependency groups

Frontend dependencies are declared in `frontend/package.json` and locked in `frontend/bun.lock`. The renderer uses React, TypeScript, Vite, Vitest/jsdom, TipTap editor packages, and styling through CSS files under `frontend/src/styles`.

## Audit and freshness

`package.json` defines `bun run frontend:audit` for high-severity frontend dependency audit. Cargo dependencies are checked by normal compile, clippy, and test commands in `bun run verify`.

See [Tooling](how-to-contribute--tooling.md) for command details.