diff --git a/docs/manual-qa-checklist.md b/docs/manual-qa-checklist.md
index b787df5..6f0c116 100644
--- a/docs/manual-qa-checklist.md
+++ b/docs/manual-qa-checklist.md
@@ -160,5 +160,6 @@ Run these checks against your local server:
 ## 13) Known warnings
 
 - `npm audit` currently reports vulnerabilities and should be triaged.
-- `music-metadata-browser` is deprecated; monitor and replace in a later maintenance cycle.
+- `music-metadata-browser` is deprecated and currently used only for browser-side metadata analysis; plan a replacement/redesign in a future PR.
+- Treat suspicious or corrupt media samples as high-risk during manual QA and verify metadata analysis paths carefully.
 - Docker build/runtime validation still requires a real Docker-capable environment.
diff --git a/package-lock.json b/package-lock.json
index d1cb62d..0d20509 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -34,9 +34,8 @@
         "stripe": "^16.2.0",
         "tailwindcss": "^3.4.4",
         "typescript": "^5.5.2",
-        "vite": "^4.5.3"
+        "vite": "^4.5.14"
       },
-      "devDependencies": {},
       "engines": {
         "node": ">=18"
       }
@@ -3947,9 +3946,10 @@
       }
     },
     "node_modules/vite": {
-      "version": "4.5.3",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-4.5.3.tgz",
-      "integrity": "sha512-kQL23kMeX92v3ph7IauVkXkikdDRsYMGTVl5KY2E9OY4ONLvkHf04MDTbnfo6NKxZiDLWzVpP5oTa8hQD8U3dg==",
+      "version": "4.5.14",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-4.5.14.tgz",
+      "integrity": "sha512-+v57oAaoYNnO3hIu5Z/tJRZjq5aHM2zDve9YZ8HngVHbhk66RStobhb1sqPMIPEleV6cNKYK4eGrAbE9Ulbl2g==",
+      "license": "MIT",
       "dependencies": {
         "esbuild": "^0.18.10",
         "postcss": "^8.4.27",
diff --git a/package.json b/package.json
index 28c0369..f3d1fa1 100644
--- a/package.json
+++ b/package.json
@@ -16,8 +16,13 @@
   "dependencies": {
     "@tokenizer/http": "^0.9.2",
     "@tokenizer/range": "^0.13.1",
+    "@types/react": "^18.3.3",
+    "@types/react-dom": "^18.3.0",
+    "@vitejs/plugin-react": "^4.2.1",
+    "autoprefixer": "^10.4.19",
     "bcryptjs": "^2.4.3",
     "better-sqlite3": "^9.6.0",
+    "browser-id3-writer": "4.4.0",
     "cors": "^2.8.5",
     "dotenv": "^16.4.5",
     "exiftool-vendored": "^28.3.1",
@@ -27,20 +32,14 @@
     "lucide-react": "^0.390.0",
     "multer": "^2.0.0",
     "music-metadata": "^11.12.3",
+    "music-metadata-browser": "2.5.11",
+    "postcss": "^8.4.38",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "stripe": "^16.2.0",
-    "@types/react": "^18.3.3",
-    "@types/react-dom": "^18.3.0",
-    "@vitejs/plugin-react": "^4.2.1",
-    "autoprefixer": "^10.4.19",
-    "postcss": "^8.4.38",
     "tailwindcss": "^3.4.4",
     "typescript": "^5.5.2",
-    "vite": "^4.5.3",
-    "browser-id3-writer": "4.4.0",
-    "music-metadata-browser": "2.5.11"
+    "vite": "^4.5.14"
   },
-  "devDependencies": {},
   "license": "MIT"
 }