99 lines
3.7 KiB
Markdown
99 lines
3.7 KiB
Markdown
# Dependency baseline
|
|
|
|
Verified on 2026-07-18. This is a point-in-time stable baseline, not a claim
|
|
that future security updates or major-version migrations can be avoided.
|
|
Application locks and OCI digests remain committed so the same revision can be
|
|
rebuilt deterministically.
|
|
|
|
## Runtime and application
|
|
|
|
| Component | Locked version |
|
|
| --- | --- |
|
|
| Elixir | 1.20.2 |
|
|
| Erlang/OTP | 29.0.3 |
|
|
| Phoenix | 1.8.9 |
|
|
| Phoenix LiveView | 1.2.7 |
|
|
| Ecto / Ecto SQL | 3.14.1 / 3.14.0 |
|
|
| Oban | 2.23.0 |
|
|
| Assent | 0.3.1 |
|
|
| Node.js LTS | 24.18.0 |
|
|
| npm build tool | 12.0.1 |
|
|
| Tailwind CSS binary | 4.3.3 |
|
|
| esbuild binary | 0.28.1 |
|
|
| daisyUI | 5.6.18 |
|
|
| Heroicons | 2.2.0 |
|
|
| MapLibre GL JS | 5.24.0 |
|
|
|
|
`mix hex.outdated` reported every direct Hex dependency as up-to-date.
|
|
`npm outdated --json` returned an empty object, and the production `npm ci`
|
|
audit reported zero known vulnerabilities. The full transitive versions and
|
|
package checksums are in `mix.lock` and `assets/package-lock.json`.
|
|
|
|
## Services and container build
|
|
|
|
| Component | Locked version |
|
|
| --- | --- |
|
|
| PostgreSQL | 18.4 |
|
|
| PostGIS | 3.6.4 |
|
|
| Traefik | 3.7.8 |
|
|
| Mailpit | 1.30.4 |
|
|
| k6 load generator | 2.1.0 |
|
|
| Debian builder/runner snapshot | trixie-20260713-slim |
|
|
|
|
Every external Compose/kind service image and every Dockerfile base image is
|
|
locked to both an exact tag and an OCI digest. The observed local Docker tooling
|
|
was Docker Engine/CLI 29.6.2, Compose 5.3.1, and Buildx 0.35.0; their official
|
|
release feeds reported those same versions as current during verification.
|
|
|
|
## Android and local Kubernetes
|
|
|
|
| Component | Locked version |
|
|
| --- | --- |
|
|
| Android Gradle Plugin | 9.3.0 |
|
|
| Gradle | 9.6.1 |
|
|
| Android SDK Command-line Tools | 22.0 |
|
|
| Android CLI | 1.0.15857036 |
|
|
| Android Emulator | 36.6.11.0 |
|
|
| compileSdk / targetSdk | 37 / 37 |
|
|
| Android Build Tools | 37.0.0 |
|
|
| AndroidX Activity | 1.13.0 |
|
|
| kubectl | 1.36.2 |
|
|
| kind | 0.32.0 |
|
|
| Helm | 4.2.3 |
|
|
|
|
Android 17 API 37 is the stable target used here. API 37.1 was not selected
|
|
because the official SDK channel identifies it as a QPR beta.
|
|
|
|
## Primary version sources
|
|
|
|
- [Elixir releases](https://github.com/elixir-lang/elixir/releases)
|
|
- [Erlang/OTP releases](https://github.com/erlang/otp/releases)
|
|
- [Hex package registry](https://hex.pm/)
|
|
- [Node.js release schedule](https://nodejs.org/en/about/previous-releases)
|
|
- [npm registry](https://www.npmjs.com/package/npm)
|
|
- [PostgreSQL 18.4 release notes](https://www.postgresql.org/docs/release/18.4/)
|
|
- [PostGIS release notes](https://postgis.net/docs/en/release_notes.html)
|
|
- [Traefik releases](https://github.com/traefik/traefik/releases)
|
|
- [Mailpit releases](https://github.com/axllent/mailpit/releases)
|
|
- [k6 releases](https://github.com/grafana/k6/releases)
|
|
- [Android Gradle Plugin 9.3.0 release notes](https://developer.android.com/build/releases/agp-9-3-0-release-notes)
|
|
- [Android 17 SDK setup](https://developer.android.com/about/versions/17/setup-sdk)
|
|
- [Gradle release notes](https://docs.gradle.org/current/release-notes.html)
|
|
- [kubectl releases](https://dl.k8s.io/release/stable.txt)
|
|
- [kind releases](https://github.com/kubernetes-sigs/kind/releases)
|
|
- [Helm releases](https://github.com/helm/helm/releases)
|
|
- [Docker Engine releases](https://github.com/moby/moby/releases)
|
|
- [Docker Compose releases](https://github.com/docker/compose/releases)
|
|
- [Docker Buildx releases](https://github.com/docker/buildx/releases)
|
|
|
|
## Repeatable checks
|
|
|
|
```bash
|
|
docker run --rm who-need-help:test mix hex.outdated
|
|
docker build --target node_deps --tag who-need-help:node-deps .
|
|
docker run --rm who-need-help:node-deps npm --version
|
|
docker run --rm who-need-help:node-deps npm outdated --json
|
|
./scripts/test.sh
|
|
./scripts/android-build.sh
|
|
```
|