# Dependency baseline

Verified through 2026-07-19. This is a point-in-time stable baseline, not a claim
that future security updates or major-version migrations can be avoided.
Application locks and OCI digests remain committed so the same revision can be
rebuilt deterministically.

## Runtime and application

| Component | Locked version |
| --- | --- |
| Elixir | 1.20.2 |
| Erlang/OTP | 29.0.3 |
| Phoenix | 1.8.9 |
| Phoenix LiveView | 1.2.7 |
| Ecto / Ecto SQL | 3.14.1 / 3.14.0 |
| Oban | 2.23.0 |
| Assent | 0.3.1 |
| Node.js LTS | 24.18.0 |
| npm build tool | 12.0.1 |
| Tailwind CSS binary | 4.3.3 |
| esbuild binary | 0.28.1 |
| daisyUI | 5.6.18 |
| Heroicons | 2.2.0 |
| MapLibre GL JS | 5.24.0 |

`mix hex.outdated` reported every direct Hex dependency as up-to-date.
`npm outdated --json` returned an empty object, and the production `npm ci`
audit reported zero known vulnerabilities. The full transitive versions and
package checksums are in `mix.lock` and `assets/package-lock.json`.

## Services and container build

| Component | Locked version |
| --- | --- |
| PostgreSQL | 18.4 |
| PostGIS | 3.6.4 |
| Traefik | 3.7.8 |
| Mailpit | 1.30.4 |
| k6 load generator | 2.1.0 |
| Prometheus | 3.13.1 |
| Alertmanager | 0.33.1 |
| Grafana | 13.1.0 |
| Python alert/external-mock runtime | 3.14.6 / Alpine 3.23 |
| Restic | 0.19.1, rebuilt with Go 1.26.5 |
| MinIO server | RELEASE.2025-10-15T17-29-55Z, rebuilt with Go 1.26.5 |
| MinIO client | RELEASE.2025-08-13T08-35-41Z, rebuilt with Go 1.26.5 |
| Backup runtime | Alpine 3.23.3 / PostgreSQL client 18.4-r0 |
| Debian builder/runner snapshot | trixie-20260713-slim |

Every external Compose/kind service image and every Dockerfile base image is
locked to both an exact tag and an OCI digest. The observed local Docker tooling
was Docker Engine/CLI 29.6.2, Compose 5.3.1, and Buildx 0.35.0; their official
release feeds reported those same versions as current during verification.

`Dockerfile.minio` fetches checksum-pinned upstream source commits for MinIO
server and client and records every dependency override used to rebuild them.
The current overrides move Apache Thrift, jsonparser, Prometheus, Go crypto/net,
and gRPC dependencies to the versions checked by the image security gate.
Both projects are AGPLv3; anyone distributing or operating modified builds must
review and satisfy the applicable license obligations. This repository keeps
the exact upstream source identifiers and the complete modification/build
recipe; this statement is operational documentation, not legal advice.

## Android and local Kubernetes

| Component | Locked version |
| --- | --- |
| Android Gradle Plugin | 9.3.0 |
| Gradle | 9.6.1 |
| Android SDK Command-line Tools | 22.0 |
| Android CLI | 1.0.15857036 |
| Android Emulator | 36.6.11.0 |
| compileSdk / targetSdk | 37 / 37 |
| Android Build Tools | 37.0.0 |
| AndroidX Activity | 1.13.0 |
| AndroidX Test core/runner/rules | 1.7.0 |
| AndroidX Test JUnit extension | 1.3.0 |
| Espresso core/web | 3.7.0 |
| UI Automator | 2.4.0 |
| kubectl | 1.36.2 |
| kind | 0.32.0 |
| Helm | 4.2.3 |

Android 17 API 37 is the stable target used here. API 37.1 was not selected
because the official SDK channel identifies it as a QPR beta.

## Local quality and security tools

| Component | Pinned version |
| --- | --- |
| ShellCheck | 0.11.0 |
| Hadolint | 2.14.0 |
| actionlint | 1.7.12 |
| Trivy | 0.72.0 |
| Credo | 1.7.19 |
| Dialyxir | 1.4.7 |
| Sobelow | 0.14.1 |
| GitHub checkout action | 7.0.0 / commit `9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0` |

The four lint/security command-line images and the three observability
validation images are pinned by both exact tag and OCI digest in
`scripts/quality.sh`. The checkout action is pinned by commit in the workflow.
Credo, Dialyxir, and Sobelow are locked in `mix.lock`.

## Primary version sources

- [Elixir releases](https://github.com/elixir-lang/elixir/releases)
- [Erlang/OTP releases](https://github.com/erlang/otp/releases)
- [Hex package registry](https://hex.pm/)
- [Node.js release schedule](https://nodejs.org/en/about/previous-releases)
- [npm registry](https://www.npmjs.com/package/npm)
- [PostgreSQL 18.4 release notes](https://www.postgresql.org/docs/release/18.4/)
- [PostGIS release notes](https://postgis.net/docs/en/release_notes.html)
- [Traefik releases](https://github.com/traefik/traefik/releases)
- [Mailpit releases](https://github.com/axllent/mailpit/releases)
- [k6 releases](https://github.com/grafana/k6/releases)
- [Prometheus releases](https://github.com/prometheus/prometheus/releases)
- [Alertmanager releases](https://github.com/prometheus/alertmanager/releases)
- [Grafana releases](https://github.com/grafana/grafana/releases)
- [Python releases](https://www.python.org/downloads/)
- [Go release history](https://go.dev/doc/devel/release)
- [Restic releases](https://github.com/restic/restic/releases)
- [MinIO releases](https://github.com/minio/minio/releases)
- [MinIO client releases](https://github.com/minio/mc/releases)
- [Android Gradle Plugin 9.3.0 release notes](https://developer.android.com/build/releases/agp-9-3-0-release-notes)
- [Android 17 SDK setup](https://developer.android.com/about/versions/17/setup-sdk)
- [Build instrumented tests](https://developer.android.com/training/testing/instrumented-tests)
- [Run Android tests from the command line](https://developer.android.com/studio/test/command-line)
- [Gradle release notes](https://docs.gradle.org/current/release-notes.html)
- [kubectl releases](https://dl.k8s.io/release/stable.txt)
- [kind releases](https://github.com/kubernetes-sigs/kind/releases)
- [Helm releases](https://github.com/helm/helm/releases)
- [Docker Engine releases](https://github.com/moby/moby/releases)
- [Docker Compose releases](https://github.com/docker/compose/releases)
- [Docker Buildx releases](https://github.com/docker/buildx/releases)
- [ShellCheck releases](https://github.com/koalaman/shellcheck/releases)
- [Hadolint releases](https://github.com/hadolint/hadolint/releases)
- [actionlint releases](https://github.com/rhysd/actionlint/releases)
- [Trivy releases](https://github.com/aquasecurity/trivy/releases)
- [checkout releases](https://github.com/actions/checkout/releases)

## Repeatable checks

```bash
docker run --rm who-need-help:test mix hex.outdated
docker build --target node_deps --tag who-need-help:node-deps .
docker run --rm who-need-help:node-deps npm --version
docker run --rm who-need-help:node-deps npm outdated --json
./scripts/test.sh
./scripts/quality.sh
./scripts/e2e-run.sh
./scripts/android-build.sh
./scripts/android-instrumentation-test.sh
./scripts/observability-run.sh local-observability
./scripts/backup-s3-drill.sh local-encrypted-backup
./scripts/external-boundaries-run.sh local-boundaries
```