4.9 KiB
Dependency baseline
Verified on 2026-07-18. This is a point-in-time stable baseline, not a claim that future security updates or major-version migrations can be avoided. Application locks and OCI digests remain committed so the same revision can be rebuilt deterministically.
Runtime and application
| Component | Locked version |
|---|---|
| Elixir | 1.20.2 |
| Erlang/OTP | 29.0.3 |
| Phoenix | 1.8.9 |
| Phoenix LiveView | 1.2.7 |
| Ecto / Ecto SQL | 3.14.1 / 3.14.0 |
| Oban | 2.23.0 |
| Assent | 0.3.1 |
| Node.js LTS | 24.18.0 |
| npm build tool | 12.0.1 |
| Tailwind CSS binary | 4.3.3 |
| esbuild binary | 0.28.1 |
| daisyUI | 5.6.18 |
| Heroicons | 2.2.0 |
| MapLibre GL JS | 5.24.0 |
mix hex.outdated reported every direct Hex dependency as up-to-date.
npm outdated --json returned an empty object, and the production npm ci
audit reported zero known vulnerabilities. The full transitive versions and
package checksums are in mix.lock and assets/package-lock.json.
Services and container build
| Component | Locked version |
|---|---|
| PostgreSQL | 18.4 |
| PostGIS | 3.6.4 |
| Traefik | 3.7.8 |
| Mailpit | 1.30.4 |
| k6 load generator | 2.1.0 |
| Debian builder/runner snapshot | trixie-20260713-slim |
Every external Compose/kind service image and every Dockerfile base image is locked to both an exact tag and an OCI digest. The observed local Docker tooling was Docker Engine/CLI 29.6.2, Compose 5.3.1, and Buildx 0.35.0; their official release feeds reported those same versions as current during verification.
Android and local Kubernetes
| Component | Locked version |
|---|---|
| Android Gradle Plugin | 9.3.0 |
| Gradle | 9.6.1 |
| Android SDK Command-line Tools | 22.0 |
| Android CLI | 1.0.15857036 |
| Android Emulator | 36.6.11.0 |
| compileSdk / targetSdk | 37 / 37 |
| Android Build Tools | 37.0.0 |
| AndroidX Activity | 1.13.0 |
| AndroidX Test core/runner/rules | 1.7.0 |
| AndroidX Test JUnit extension | 1.3.0 |
| Espresso core/web | 3.7.0 |
| UI Automator | 2.4.0 |
| kubectl | 1.36.2 |
| kind | 0.32.0 |
| Helm | 4.2.3 |
Android 17 API 37 is the stable target used here. API 37.1 was not selected because the official SDK channel identifies it as a QPR beta.
Local quality and security tools
| Component | Pinned version |
|---|---|
| ShellCheck | 0.11.0 |
| Hadolint | 2.14.0 |
| actionlint | 1.7.12 |
| Trivy | 0.72.0 |
| Credo | 1.7.19 |
| Dialyxir | 1.4.7 |
| Sobelow | 0.14.1 |
| GitHub checkout action | 7.0.0 / commit 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 |
The four containerized command-line tools are pinned by both exact tag and OCI
digest in scripts/quality.sh. The checkout action is pinned by commit in the
workflow. Credo, Dialyxir, and Sobelow are locked in mix.lock.
Primary version sources
- Elixir releases
- Erlang/OTP releases
- Hex package registry
- Node.js release schedule
- npm registry
- PostgreSQL 18.4 release notes
- PostGIS release notes
- Traefik releases
- Mailpit releases
- k6 releases
- Android Gradle Plugin 9.3.0 release notes
- Android 17 SDK setup
- Build instrumented tests
- Run Android tests from the command line
- Gradle release notes
- kubectl releases
- kind releases
- Helm releases
- Docker Engine releases
- Docker Compose releases
- Docker Buildx releases
- ShellCheck releases
- Hadolint releases
- actionlint releases
- Trivy releases
- checkout releases
Repeatable checks
docker run --rm who-need-help:test mix hex.outdated
docker build --target node_deps --tag who-need-help:node-deps .
docker run --rm who-need-help:node-deps npm --version
docker run --rm who-need-help:node-deps npm outdated --json
./scripts/test.sh
./scripts/quality.sh
./scripts/e2e-run.sh
./scripts/android-build.sh
./scripts/android-instrumentation-test.sh