# Dependency audit
The crate uses the smallest existing Kcode provider libraries needed for
Codex, Gemini, OpenAI, document extraction, and web fetching. It contains no
HTTP server framework. Provider credentials are held by the upstream clients
and are never written to usage receipts.
Credential-bearing provider clients remain exact-pinned. For the
`kcode-gemini-api` 0.4.3 upgrade, the complete managed source was compared with
0.4.2 on 2026-08-01 UTC. The only implementation change corrects Gemini model
metadata URL construction by removing the base path's empty trailing segment
before appending the validated model identifier; its regression test asserts
the exact fixed Google endpoint. The request client, credential handling, fixed
destinations, redirect/retry/proxy policy, and third-party dependencies are
unchanged, so 0.4.3 is accepted for this boundary.