# Dependency Supply-Chain Pre-Scan

Target: `/workspace/research/arena/stake-flow`
Scanned: `Cargo.toml`, `package.json`

**Scope:** deterministic pre-scan — NOT an audit, no CVE feed, no graph resolution. A FLAG means "deserves human review"; a clean report is not proof of safety.

**Findings:** MEDIUM=2, INFO=9

- **MEDIUM** `Cargo.toml` — missing-lockfile
  - Cargo.toml manifest present but none of ['Cargo.lock'] — installs are non-deterministic
- **MEDIUM** `package.json` — missing-lockfile
  - package.json manifest present but none of ['package-lock.json', 'yarn.lock', 'pnpm-lock.yaml', 'npm-shrinkwrap.json'] — installs are non-deterministic
- **INFO** `@coral-xyz/anchor (dependencies)` — semver-range
  - semver range '^0.32.1' — lockfile required for integrity
- **INFO** `@types/bn.js (devDependencies)` — semver-range
  - semver range '^5.1.0' — lockfile required for integrity
- **INFO** `@types/chai (devDependencies)` — semver-range
  - semver range '^4.3.0' — lockfile required for integrity
- **INFO** `@types/mocha (devDependencies)` — semver-range
  - semver range '^9.0.0' — lockfile required for integrity
- **INFO** `chai (devDependencies)` — semver-range
  - semver range '^4.3.4' — lockfile required for integrity
- **INFO** `mocha (devDependencies)` — semver-range
  - semver range '^9.0.3' — lockfile required for integrity
- **INFO** `prettier (devDependencies)` — semver-range
  - semver range '^2.6.2' — lockfile required for integrity
- **INFO** `ts-mocha (devDependencies)` — semver-range
  - semver range '^10.0.0' — lockfile required for integrity
- **INFO** `typescript (devDependencies)` — semver-range
  - semver range '^5.7.3' — lockfile required for integrity