# Dependency baseline

Verified on 2026-07-18. This is a point-in-time stable baseline, not a claim
that future security updates or major-version migrations can be avoided.
Application locks and OCI digests remain committed so the same revision can be
rebuilt deterministically.

## Runtime and application

| Component | Locked version |
| --- | --- |
| Elixir | 1.20.2 |
| Erlang/OTP | 29.0.3 |
| Phoenix | 1.8.9 |
| Phoenix LiveView | 1.2.7 |
| Ecto / Ecto SQL | 3.14.1 / 3.14.0 |
| Oban | 2.23.0 |
| Node.js LTS | 24.18.0 |
| npm build tool | 12.0.1 |
| Tailwind CSS binary | 4.3.3 |
| esbuild binary | 0.28.1 |
| daisyUI | 5.6.18 |
| Heroicons | 2.2.0 |
| MapLibre GL JS | 5.24.0 |

`mix hex.outdated` reported every direct Hex dependency as up-to-date.
`npm outdated --json` returned an empty object, and the production `npm ci`
audit reported zero known vulnerabilities. The full transitive versions and
package checksums are in `mix.lock` and `assets/package-lock.json`.

## Services and container build

| Component | Locked version |
| --- | --- |
| PostgreSQL | 18.4 |
| PostGIS | 3.6.4 |
| Traefik | 3.7.8 |
| Mailpit | 1.30.4 |
| Debian builder/runner snapshot | trixie-20260713-slim |

Every external Compose/kind service image and every Dockerfile base image is
locked to both an exact tag and an OCI digest. The observed local Docker tooling
was Docker Engine/CLI 29.6.2, Compose 5.3.1, and Buildx 0.35.0; their official
release feeds reported those same versions as current during verification.

## Android and local Kubernetes

| Component | Locked version |
| --- | --- |
| Android Gradle Plugin | 9.3.0 |
| Gradle | 9.6.1 |
| Android SDK Command-line Tools | 22.0 |
| Android CLI | 1.0.15857036 |
| Android Emulator | 36.6.11.0 |
| compileSdk / targetSdk | 37 / 37 |
| Android Build Tools | 37.0.0 |
| AndroidX Activity | 1.13.0 |
| kubectl | 1.36.2 |
| kind | 0.32.0 |
| Helm | 4.2.3 |

Android 17 API 37 is the stable target used here. API 37.1 was not selected
because the official SDK channel identifies it as a QPR beta.

## Primary version sources

- [Elixir releases](https://github.com/elixir-lang/elixir/releases)
- [Erlang/OTP releases](https://github.com/erlang/otp/releases)
- [Hex package registry](https://hex.pm/)
- [Node.js release schedule](https://nodejs.org/en/about/previous-releases)
- [npm registry](https://www.npmjs.com/package/npm)
- [PostgreSQL 18.4 release notes](https://www.postgresql.org/docs/release/18.4/)
- [PostGIS release notes](https://postgis.net/docs/en/release_notes.html)
- [Traefik releases](https://github.com/traefik/traefik/releases)
- [Mailpit releases](https://github.com/axllent/mailpit/releases)
- [Android Gradle Plugin 9.3.0 release notes](https://developer.android.com/build/releases/agp-9-3-0-release-notes)
- [Android 17 SDK setup](https://developer.android.com/about/versions/17/setup-sdk)
- [Gradle release notes](https://docs.gradle.org/current/release-notes.html)
- [kubectl releases](https://dl.k8s.io/release/stable.txt)
- [kind releases](https://github.com/kubernetes-sigs/kind/releases)
- [Helm releases](https://github.com/helm/helm/releases)
- [Docker Engine releases](https://github.com/moby/moby/releases)
- [Docker Compose releases](https://github.com/docker/compose/releases)
- [Docker Buildx releases](https://github.com/docker/buildx/releases)

## Repeatable checks

```bash
docker run --rm who-need-help:test mix hex.outdated
docker build --target node_deps --tag who-need-help:node-deps .
docker run --rm who-need-help:node-deps npm --version
docker run --rm who-need-help:node-deps npm outdated --json
./scripts/test.sh
./scripts/android-build.sh
```