# Dependency review 1.5.1 — 2026-09-01

## Scope

- No library, plugin, Gradle, Kotlin, Compose, JDK or IDE dependency was changed.
- GeoTIFF elevation output now uses JDK executor, channel, byte-buffer and management APIs already
  provided by the bundled runtime.
- Geographic source indexing and exact rectangle/circle row intervals are implemented in project
  code and introduce no external native or GPU runtime.

## Decision

- Keep all dependency and toolchain versions from 1.5.0.
- Use a bounded CPU implementation instead of adding CUDA, OpenCL or a platform-specific raster
  library. This preserves Windows/Linux portability and deterministic low-memory fallback behavior.
- Retain the 4 GiB worker heap. Available physical memory increases safe parallelism and buffer size;
  it does not become an unconditional minimum requirement.

## Stable-update review

Review date: 2026-09-01. Official Gradle, Kotlin, JetBrains Compose, Maven Central, Mapsforge,
kotlinx.coroutines, Apache SIS, CycloneDX, OSV Scanner, Microsoft OpenJDK and Android Studio release
sources are checked by the release audit. The generated `dependency-updates.json` is the
machine-readable record for the exact declarations and transitive components.

The reviewed toolchain remains Gradle 9.7.1, Kotlin 2.4.10, Compose Multiplatform 1.12.0,
Material 3 1.9.0, coroutines 1.11.0, Mapsforge 0.29.0, Apache SIS 1.6, CycloneDX 3.4.1,
OSV Scanner 2.5.1, Microsoft OpenJDK 25.0.4.1 and Android Studio 2026.1.3 Patch 1. No dependency
change is required for the elevation performance correction.

## Security and compatibility

- Worker and buffer counts are capped; memory calculations reserve operating-system capacity and
  are covered for 4 GiB and high-resource systems.
- Positional strip writes use precomputed, non-overlapping offsets. Parallel and sequential tests
  require byte-identical GeoTIFF output.
- Cancellation tests require removal of both final and partial output files.
- A real 24-HGT benchmark produced two identical 570.590.372-byte outputs and is recorded under
  `documentation/benchmarks/elevation-geotiff-windows-1.5.1.json`.

The remaining compatibility risk is low. Stateful ASC and GeoTIFF input readers serialize sample
access, while HGT and DTED use parallel-safe absolute reads. Release SBOM and OSV results are recorded
after the complete Windows and Linux release gate.
