# Dependency and toolchain review 1.3.0

Review date: 2026-09-01

## Scope and decision

Release 1.3.0 adds a bounded elevation preview without adding or updating a runtime, build or
packaging dependency. It uses the elevation readers reviewed for 1.2.0 and the Skia/Compose runtime
already included in the desktop application. The preview raster is capped at 720 × 720 samples and
does not change full-resolution export processing.

The official Gradle, Kotlin, Compose Multiplatform, Apache SIS, Mapsforge and Microsoft OpenJDK
sources checked for 1.2.0 were reviewed again on the same date. Available newer toolchain versions
are not adopted in this feature release because they would expand the compatibility test scope
without addressing a security finding or a functional requirement. The machine-readable update
report and exact toolchain evidence are regenerated by `scripts/release-all.ps1`.

## Security gate

No dependency exception is approved. Platform SBOMs and OSV scans remain mandatory release gates;
any unresolved finding blocks release 1.3.0.
