# Dependency Audit
Dependency audit status for version 0.3.1.
The dependency versions are unchanged from 0.1.1, whose dependencies were
reviewed. The 0.3.0 intelligence-callback and user-attribution update and this
0.3.1 documentation follow-up introduced no dependency changes and performed
no new dependency audit.
- No provider SDK is a dependency. Model work is delegated through typed
caller-supplied callbacks so one application intelligence component can own
routing and accounting.
- `hound`: in-memory WAV parsing and interval decoding.
- `ruopus`: in-memory Ogg Opus encoding.
- `futures`: bounded concurrent piece transcription.
- `rusqlite`: durable recording, progress, retry, and completed-transcript
state, including attempt-scoped structured piece transcripts. The bundled
SQLite feature makes the published library self-contained.
- `tokio`: asynchronous retained-original writes, the automatic background
worker, transcription tasks, bounded concurrency, and retry timing.
- `chrono`: caller-supplied recording times and durable timestamps.
- `sha2`: content identity for exact retained audio bytes.
- `serde` and `serde_json`: typed public status serialization and durable
dependency progress snapshots.
- `uuid`: stable recording and temporary-upload identifiers.
- `tracing`: bounded operational diagnostics without exposing audio or
transcript contents.
- `anyhow`: private persistence and worker error context.
The crate has no HTTP-server, multipart, application-framework, Kmap, Chatend,
credential-vault, or downstream memory-ingress dependency. Provider
credentials remain encapsulated in caller-created clients.