# Dependency review 1.5.0 — 2026-09-01

## Scope

- No library, plugin, Gradle, Kotlin, Compose, JDK or IDE dependency was changed.
- Multiple Mapsforge POI databases are normalized, filtered and merged with the SQLite JDBC driver
  already contained in the verified official Mapsforge POI writer artifact.
- Duplicate detection uses JDK SHA-256 and a temporary SQLite table, so the number of POIs does not
  create an equally large in-memory set.

## Decision

- Keep all dependency and toolchain versions from 1.4.0.
- Reuse the existing Mapsforge/SQLite implementation instead of adding a database or geospatial
  merge dependency.
- Open source POI databases read-only, assign fresh output-local POI and category IDs, merge category
  trees by complete hierarchy and remove only byte-for-byte equivalent POIs at identical coordinates.

## Stable-update review

Review date: 2026-09-01. Official Gradle, Kotlin, JetBrains Compose, Maven Central, Mapsforge,
kotlinx.coroutines, Apache SIS, CycloneDX, OSV Scanner, Microsoft OpenJDK and Android Studio release
sources were reviewed. The generated `dependency-updates.json` is the machine-readable record for
the exact project declarations and transitive components.

Gradle 9.7.1, Kotlin 2.4.10, Compose Multiplatform 1.12.0, Material 3 1.9.0, coroutines 1.11.0,
Mapsforge 0.29.0, Apache SIS 1.6, CycloneDX 3.4.1, OSV Scanner 2.5.1, Microsoft OpenJDK
25.0.4.1 and Android Studio 2026.1.3 Patch 1 remain the reviewed toolchain. No update is required for
the multi-POI feature.

Newer Guava, JAXB, SQLite JDBC and support-library entries in the generated report describe the
fixed contents of the official Mapsforge writer fat JARs. They cannot be upgraded independently
without rebuilding those artifacts and repeating Mapsforge output compatibility tests. The Kotlin
build-tools 2.4.0 entry is an internal compatibility configuration; the active compiler and plugins
remain at 2.4.10.

## Security gate

The Windows and Linux CycloneDX SBOMs each contain 243 packages. OSV Scanner reports no known
vulnerabilities for either platform, and no vulnerability exception is active.

The compatibility risk is moderate: the individual POI schema and spatial filtering paths are
unchanged, but the new merger must preserve category relationships, spatial and full-text indexes,
and source-local ID independence across country databases. Unit and worker integration tests cover
mixed v3/v4 inputs, colliding IDs, category remapping, clipping and exact boundary duplicates.
