Excalidraw Dependency Review

Approved runtime dependency:

• @excalidraw/excalidraw (MIT)

Peer dependencies (already present in Falcon Flowmira):

• react >= 18
• react-dom >= 18

Bundle impact

• Editor chunk: lazy-loaded on route /board/$id only.
• Excluded from the marketing landing bundle (/, /pricing, /features, /vs, /docs, /blog).
• Whiteboard route is ssr: false — the module never enters the SSR bundle.

What is NOT installed

• firebase, firebase-admin — not needed; Falcon uses Supabase.
• socket.io-client — not needed; realtime uses Supabase channels.
• Any Excalidraw+ hosted-app-only dependency.

Supply chain

• Enable Dependabot / Renovate for @excalidraw/excalidraw.
• CI: run bun audit and Trivy against node_modules.
• Pin the version in package.json; do not float on ^.
• Verify SHA before major upgrades; review upstream CHANGELOG for security fixes.