Dependencies
Each package in Litestore's package.json has a reason to be there, and a new one has to pass a few checks first.
Read this page when you need to find out why a package is in package.json, or before you add a new one. package.json declares 79 runtime dependencies and 25 dev dependencies, and Bun 1.2.2 installs them (packageManager).
Framework and runtime
| Package | Declared version | What it does |
|---|---|---|
next | ^16.1.1 | It provides the App Router, route handlers and next build. |
react / react-dom | ^19.2.3 | They provide React 19. |
typescript | ^5.9.3 | It is dev only, and tsc --noEmit is the typecheck. |
@t3-oss/env-nextjs | ^0.13.10 | It parses typed environment variables in env.ts. |
server-only | ^0.0.1 | It makes the build fail when client code imports a server-only module. |
@sentry/nextjs | ^10.40.0 | It reports errors. |
Database
Prisma is pinned to one exact version across three packages, which together handle the schema, the migrations and the driver adapter for pg.
@prisma/client 7.4.2
@prisma/adapter-pg 7.4.2
prisma 7.4.2None of them uses a caret range, so a minor release can't leave the client and the engine on different versions.
decimal.js-light (^2.5.1) does the decimal arithmetic behind ~/platform/utils/money.
Commerce and payments
| Package | Version | What it does |
|---|---|---|
stripe | ^20.3.1 | It handles checkout sessions, payment intents and webhook signature checks. |
svix | ^1.96.1 | It verifies the signatures on Resend's delivery webhooks. Outbound webhooks are signed with HMAC-SHA256 in modules/integrations/webhooks/delivery.ts. |
jose | ^6.1.3 | It signs the service-account JWT for the Google Merchant API. |
better-auth | ^1.4.19 | It manages sessions, sign-in and account records. |
@upstash/redis | ^1.36.0 | It provides the cache. |
@upstash/ratelimit | ^2.0.7 | It provides the rate limiter. |
checkRateLimit fails open when Redis is unreachable, so a Redis outage does not block sign-in. The AI limiter is the exception: it fails closed.
AI
The AI layer uses the AI SDK 4 line. Litestore connects Google Gemini, Anthropic Claude and OpenAI, and you choose one with AI_PROVIDER.
ai ^4.3.19
@ai-sdk/react ^1.2.12
@ai-sdk/openai ^1.3.24
@ai-sdk/anthropic ^1.2.12
@ai-sdk/google ^1.2.22
streamdown ^2.3.0
use-stick-to-bottom ^1.1.3streamdown renders markdown as it streams in. use-stick-to-bottom keeps the chat scrolled to the newest message.
UI
The UI primitives come from radix-ui (^1.4.3). Two Radix packages have their own versions, @radix-ui/react-collapsible (^1.1.12) and @radix-ui/react-tabs (^1.1.13).
Styling uses tailwindcss (^4.1.18, dev) together with @tailwindcss/postcss, @tailwindcss/typography and tailwindcss-animate. The cx helper in ~/platform/utils/cva is built on cva and tailwind-merge (^3.4.0).
Icons come from lucide-react (^0.575.0, dev), and scripts/build-icons.ts compiles them into a sprite. Application code imports <Icon /> from ui/icon.tsx and never imports lucide-react directly; code review enforces this, not a script.
| What you build | Packages |
|---|---|
| Tables and forms | @tanstack/react-table (^8.21.3), react-hook-form (^7.70.0), @hookform/resolvers (5.2.2), zod (^4.3.5) |
| Rich text | TipTap 3, in six packages: @tiptap/react, @tiptap/starter-kit, @tiptap/pm, @tiptap/extension-image, @tiptap/extension-link, @tiptap/markdown |
| Other inputs | react-day-picker (^9.13.0), react-colorful, react-phone-number-input, react-dropzone, cmdk |
| Motion and charts | motion (^12.38.0), recharts (^3.6.0), @number-flow/react, canvas-confetti, embla-carousel-react |
| Drag and drop | @atlaskit/pragmatic-drag-and-drop (^1.7.7) and its hitbox package |
These packages handle state and URLs.
| Package | Version | What it does |
|---|---|---|
nuqs | ^2.8.6 | It keeps state in search params. |
swr | ^2.3.8 | It fetches data on the client. |
zsa and zsa-react | ^0.6.0 | They run server actions. |
sonner | ^2.0.7 | It shows toasts. |
next-themes | ^0.4.6 | It reads the colour theme in the storefront search dialog. |
@mantine/hooks | ^8.3.11 | It provides small client hooks. |
One entry has no version range at all. cva is declared as "beta", which is a dist-tag, so each install picks up whatever the current beta is.
Content, email and media
@content-collections/core, /mdx and /next compile MDX content at build time, and rehype-slug and rehype-autolink-headings run as part of that pipeline.
@react-email/components (^1.0.3) builds the email templates in modules/email/templates/, and resend (^6.9.2) delivers them. react-email (dev) runs the preview server behind bun run email.
@aws-sdk/client-s3 and @aws-sdk/lib-storage (^3.962.0) talk to S3-compatible object storage.
satori (^0.13.2) renders OG images and works with loadGoogleFont in platform/config/fonts.ts. sanitize-html (^2.17.5) cleans HTML, and rss (^1.2.2) generates the feeds.
Background work and analytics
| Package | Version | What it does |
|---|---|---|
inngest | ^3.54.0 | It runs the crons and domain-event handlers in jobs/. |
@orpc/server / @orpc/shared | ^1.13.9 | They serve the narrow /api/rpc API. |
posthog-js | ^1.314.0 | It collects client analytics. |
wretch | ^3.0.6 | It is the HTTP client for outbound integration calls. |
Utilities and tooling
The general-purpose helpers are date-fns (^4.1.0), change-case, nanoid (^3.3.11), plur and @primoui/utils. Don't use @primoui/utils for formatting, because Litestore's own formatters do that job.
| Package | Version | What it does |
|---|---|---|
@biomejs/biome | ^1.9.4 | It formats and lints the code. |
vitest | ^4.0.18 | It runs the tests, together with jsdom (^29.1.1) and vite (^7.3.1). |
@playwright/test | 1.58.0 | It runs the end-to-end tests. |
The remaining dev dependencies support the scripts and the build. They are glob, fs-extra, dotenv, schema-dts, postcss and the @types/* packages. node-html-parser is a runtime dependency.
zsa patch
The repository patches one dependency, and that file is the only one in patches/.
"patchedDependencies": {
"zsa@0.6.0": "patches/zsa@0.6.0.patch"
}The patch is needed because zsa 0.6.0 ships types written for zod 3, while the repository runs zod 4.
The patch rewrites dist/index.d.ts. It declares local AnyZodObject and objectUtil.extendShape shims, and it removes the zod-3-only generic parameters from TZodMerge and the instanceofZodType* helpers. It changes types only, and no runtime behaviour changes. Bun applies it when you install.
Adding dependencies
Source imports
Add a runtime dependency only when source code imports it. Nothing in verify checks for unused packages, so a dependency that nobody imports stays in package.json until someone spots it and removes it.
Patches
If you patch a dependency, as with zsa, its file in patches/ needs another look every time you upgrade that package.
Related
Stack
Litestore runs on a specific set of packages and versions, and each choice has a reason behind it.
Continuous integration
CI runs a set of checks on every push and pull request.
Linting
Biome formats and lints the code, bun run lint and bun run verify wrap it, and one of them is the command to run before you push.