# Dependencies

## staticcheck and deadcode are not wired into a make target [#694] {#analyzers}

Costs: two of the three analyzers the 2026-08-10 audit asked for are missing.
Neither is installed on this box and no target runs them. `make audit` is a git-grep
inventory over loc, todo, stubs, docs, tests and gaps. **Do not read it as a
static-analysis gate.** `make vuln` is the third one and it is wired (V-682):
govulncheck is pinned in the Makefile, installed into `deps/bin` and run over
`./...`. It reads the published database over the network, so it stays out of
`make test`.
Revisit when: the next dead-code claim needs checking. `deadcode` has a finding
waiting for it in [layering.md](layering.md#deadcode).
Workaround: none. Read a reachability claim as unverified until one of them runs.