# Dependency and toolchain review 1.1.0

Review date: 2026-08-31
Responsibility: ArxSilex project

## Result

Release 1.1.0 adds complete-job progress reporting and optional concurrent map/POI worker execution.
It adds no external production dependency. The desktop runtime explicitly includes the standard JDK
management module so that the application can select the safe sequential or parallel path from the
available processor and memory resources.

| Component | Used | Latest stable checked | Decision | Official source |
| --- | --- | --- | --- | --- |
| Gradle | 9.7.1 | 9.7.1 | retained | https://docs.gradle.org/9.7.1/release-notes.html |
| Kotlin | 2.4.10 | 2.4.10 | retained | https://kotlinlang.org/docs/releases.html |
| Kotlin Coroutines | 1.11.0 | 1.11.0 | retained | https://github.com/Kotlin/kotlinx.coroutines/releases/tag/1.11.0 |
| Compose Multiplatform | 1.12.0 | 1.12.0 | retained | https://github.com/JetBrains/compose-multiplatform/releases |
| Material3 | 1.9.0 | 1.9.0 | retained | https://maven.pkg.jetbrains.space/public/p/compose/dev/org/jetbrains/compose/material3/material3/ |
| Mapsforge Reader/Writer | 0.29.0 | 0.29.0 | retained; current stable release and required for POI v4 | https://github.com/mapsforge/mapsforge/releases/tag/0.29.0 |
| Osmosis | 0.49.2 | 0.49.2 | retained | https://github.com/openstreetmap/osmosis/releases/tag/0.49.2 |
| OSM Binary | 1.6.1 | 1.6.1 | retained | https://github.com/openstreetmap/osmosis-osm-binary/releases/tag/1.6.1 |
| CycloneDX Gradle Plugin | 3.4.1 | 3.4.1 | retained | https://plugins.gradle.org/plugin/org.cyclonedx.bom |
| Gradle Versions Plugin | 0.61.0 | 0.61.0 | retained | https://plugins.gradle.org/plugin/io.github.ben-manes.versions |
| OSV-Scanner | 2.5.1 | 2.5.1 | retained | https://github.com/google/osv-scanner/releases/tag/v2.5.1 |
| Microsoft OpenJDK | 25.0.4.1 LTS | 25.0.4.1 LTS | retained | https://learn.microsoft.com/java/openjdk/download |
| Android Studio | 2026.1.3 Patch 1 | 2026.1.3 Patch 1 | retained | https://developer.android.com/studio/releases |

## Compatibility decision

The packaged Mapsforge writer fat JARs remain unchanged and are verified by SHA-256. Their embedded
Guava, JAXB, JTS and SQLite components are not overridden individually because doing so would risk
duplicate or binary-incompatible classes. All runtime components remain covered by the generated
CycloneDX SBOMs and OSV scans.

The 4 GiB maximum heap remains unchanged for every worker. Parallel map and POI generation is enabled
only when the host reports sufficient currently free memory; otherwise the established sequential
path is selected. Regression tests cover both policy branches and monotonic progress aggregation.

## Security gate

The machine-readable dependency report, toolchain evidence, platform SBOMs and final OSV results are
generated by `scripts/release-all.ps1`. Release 1.1.0 is publishable only if that gate completes with
no unresolved vulnerabilities. `security/vulnerability-exceptions.json` remains empty.
