landing_page/refer_landing_page/.kanban-stack-profile.md

# Stack Profile — `iot-standards-lab-landing`

> Reference prototype landing page for the KNU CS IoT Standards Lab.
> Workspace: `/home/godopu16/PuKi/lab/landing_page/refer_landing_page`
> Produced as the deliverable for kanban task `t_239791d2`.

## 1. Languages, Frameworks, Package Manager

| Layer | Pin / Range | Installed | Latest | Note |
|---|---|---|---|---|
| Language | TypeScript `^5.5.3` | 5.9.3 | 6.0.3 | Pin is fine; major jump to TS 6 is non-breaking for most code |
| Framework | Next.js `14.2.5` (exact) | 14.2.5 | 16.2.9 | 2 majors behind; line-locked by app's React 18 dep |
| UI runtime | `react` `^18.3.1`, `react-dom` `^18.3.1` | 18.3.1 | 19.2.7 | React 19 is available but is a major — see §5 |
| Package manager | npm (single `package-lock.json`, lockfile v3) | npm 10.9.7 | — | No `pnpm-lock.yaml` / `yarn.lock` / `bun.lockb` present |
| Runtime | Node v22.22.2 (host) | — | — | No `engines` field declared |

**Type system config** (`tsconfig.json`):
- `strict: true`, `noEmit: true`, `incremental: true`
- `moduleResolution: "bundler"`, `jsx: "preserve"`, `isolatedModules: true`
- `plugins: [{ "name": "next" }]`, path alias `@/*` → `./*`

**Next.js config** (`next.config.js`):
- `reactStrictMode: true`; no image domains, no redirects, no rewrites, no headers, no experimental flags. Minimal by design.

**Styling**:
- Tailwind CSS `^3.4.6` (installed 3.4.19) — latest line is 4.x; the `tailwind.config.ts` is rich enough (114 lines, custom theme) that the v3→v4 jump is a planned migration, not a `npm update`.
- `postcss.config.js` wires Tailwind + `autoprefixer` (^10.4.19).
- Font stack is loaded via `next/font` and exposed as CSS variables — no external font loader (Google Fonts, Fontsource) is in the dep tree.

**Not present**:
- No `Dockerfile` / `docker-compose*` / `dockerignore` — there is no container image for this app.
- No `.env`, `.env.example`, `.envrc` — the app reads no env vars.
- No `.eslintrc*` file and no `eslintConfig` block in `package.json`. ESLint runs through `next lint`, which uses `eslint-config-next`'s defaults (`core-web-vitals` + `next/typescript`).
- No `.prettierrc*` — formatting is not enforced in CI.
- No `.github/`, no `.gitlab-ci.yml`, no `.circleci/` — no CI pipeline.

## 2. Dependencies

### Direct (runtime) — 3 packages

| Package | Pin | Purpose |
|---|---|---|
| `next` | `14.2.5` (exact) | Framework |
| `react` | `^18.3.1` | UI library |
| `react-dom` | `^18.3.1` | DOM renderer |

### Dev — 10 packages

| Package | Pin | Purpose |
|---|---|---|
| `@types/node` | `^20.14.0` | Node typings (dev only) |
| `@types/react` | `^18.3.3` | React typings |
| `@types/react-dom` | `^18.3.0` | React DOM typings |
| `autoprefixer` | `^10.4.19` | PostCSS plugin |
| `postcss` | `^8.4.39` | CSS pipeline |
| `tailwindcss` | `^3.4.6` | Utility CSS |
| `typescript` | `^5.5.3` | Compiler |
| `eslint` | `^8.57.0` | Linter |
| `eslint-config-next` | `14.2.5` (exact, matches Next) | Next-flavored ESLint config |

**Observations**:
- Footprint is intentionally minimal — no `framer-motion`, no UI lib (shadcn/Radix/MUI), no icon set, no analytics, no CMS client, no image CDN.
- `next` and `eslint-config-next` are pinned **exact** (no `^`); `react` and `react-dom` use `^`. This is the right call: Next and its ESLint config must move together.
- Dev types are pinned to React 18, consistent with the runtime.
- `package-lock.json` is 215 KB → transitive tree is fairly clean; the project has no obvious bloat.

## 3. Scripts

Four npm scripts, all thin wrappers around `next`:

| Script | Command | Use |
|---|---|---|
| `npm run dev` | `next dev` | Local dev server (default port 3000) |
| `npm run build` | `next build` | Production build → `.next/` |
| `npm start` | `next start` | Run the production build |
| `npm run lint` | `next lint` | ESLint via Next's wrapper |

No `test`, `format`, `typecheck`, `prepare`, `pre-commit`, or any other lifecycle hooks. The 4-script surface is honest: linting is the only quality gate declared.

## 4. Configuration / Manifest Inventory

| File | Lines | Notes |
|---|---|---|
| `package.json` | 28 | Single manifest, no `engines`, no `workspaces` |
| `package-lock.json` | (215 KB) | npm v3 lockfile |
| `tsconfig.json` | 22 | strict, bundler resolution, `@/*` alias |
| `next.config.js` | 6 | `reactStrictMode: true` only |
| `tailwind.config.ts` | 114 | Editorial design tokens, custom colors, custom animations |
| `postcss.config.js` | 6 | tailwindcss + autoprefixer |
| `next-env.d.ts` | 5 | Next-managed, gitignored |
| `tsconfig.tsbuildinfo` | (80 KB) | Incremental build cache, gitignored |
| `.gitignore` | 27 | Standard Next.js ignore set |
| `.kanban-inventory.json` | 137 | Upstream inventory artifact (not a config) |
| `.antigravity-session.md` | 46 | Upstream runtime artifact (not a config) |

## 5. Outdated / Vulnerable Pins (Trivially Obvious)

### Vulnerabilities (from `npm audit`) — 8 advisories, 1 critical

`next@14.2.5` is affected by **21 published advisories** that are fixed in `14.2.35` (same line, not a major jump):
- **Critical** (1): Cache poisoning (GHSA-gp8f-8m3g-qvj9)
- **High** (6): DoS via Server Components, image optimizer, middleware cache poisoning, SSRF via middleware redirect, etc.
- **Moderate** (1): PostCSS XSS via unescaped `</style>` (transitive through `next/node_modules/postcss`)

Plus **transitive**:
- `glob` 10.2.0–10.4.5 — command injection in CLI (only triggered if `glob`'s CLI is invoked; **not a runtime risk for this Next app**)
- `minimatch` 9.0.0–9.6 — ReDoS (transitive via ESLint's glob walker; **dev-time only**)

**Recommended fix (lowest-risk):** `npm install next@14.2.35` — same major, same line, fixes 21 Next advisories + the transitive `postcss` advisory. Does **not** require React changes. `npm audit fix --force` would jump to Next 16 + React 19 — that's a planned migration, not a security patch.

### Outdated-by-major pins (information only — not security)

| Pin | Major delta | Risk profile |
|---|---|---|
| `next` 14 → 16 | App Router stabilized; some breaking changes (params async, etc.) | Planned migration |
| `react`/`react-dom` 18 → 19 | New compiler, ref as prop, async transitions | Requires Next 15+ |
| `eslint` 8 → 10 | Flat config becoming default | Could be deferred |
| `typescript` 5 → 6 | Mostly compat, some strictness tightening | Trivial in this codebase |
| `tailwindcss` 3 → 4 | New engine, config format change | Significant migration (would touch `tailwind.config.ts`) |
| `@types/*` React 18 → 19, Node 20 → 25 | Mismatched with installed Node 22 host | Cosmetic |
| `@types/node` 20 → 25 | Host is Node 22 — current pin still works but `25` would track current Node | Cosmetic |

The biggest near-term "looks dated" item is the **React 18 + Next 14 stack** (released mid-2024), but everything is internally consistent — no mixed majors, no version skew between `next` and `eslint-config-next`. The stack is intentionally conservative.

### Compatibility sketch (host vs declared)

- Host Node 22, npm 10.9.7 — fits Next 14 / React 18 cleanly. No `engines` field; any contributor on Node ≥18 works.
- `eslint@8` is the last v8; the `next lint` shim still works in Next 14.2.

## 6. Build / Toolchain Footprint Summary

- **Source files**: 25 (14 .tsx, 2 .ts, 2 .js, 1 .css, 2 .json, 4 .md), ~2,605 LOC excluding deps and lockfile (per upstream `.kanban-inventory.json`).
- **Routes**: 5 under `app/` (`/`, `/lectures`, `/members`, `/publications`, `/standardization`).
- **Shared components**: 7 in `components/`.
- **Build artifacts present**: `node_modules/` (342 dirs) and `.next/` exist; lockfile and `tsconfig.tsbuildinfo` present.
- **No test runner, no formatter, no CI, no Docker, no env vars, no analytics, no CMS, no icon lib, no motion lib.** The dependency tree is the smallest viable Next 14 + React 18 + Tailwind v3 surface.

## 7. Stack-Profile Verdict

A **deliberately minimal Next 14 App Router reference implementation**: a small landing page with a hand-rolled design system encoded in `tailwind.config.ts` and `app/globals.css`. Dependencies are minimal and internally consistent; the only real-world remediation on the table is bumping `next` to `14.2.35` (one-line patch) to clear 21 advisories. Major-version upgrades (Next 16, React 19, Tailwind 4) are a separate planned migration, not security work.