Notes from a dependency-health audit. None of these are urgent — nothing here is currently vulnerable — but they're the part of the tree with no one behind it, so it's worth a deliberate decision on each rather than discovering it later.
Dormant packages
Last publish dates as of 2026-07:
JS
| Package |
Last publish |
videojs-offset |
2021-03 |
jszip |
2022-08 |
leaflet-defaulticon-compatibility |
2023-07 |
react-fast-marquee |
2024-07 |
Elixir
| Package |
Last publish |
logfmt |
2022-01 |
redoc_ui_plug |
2022-11 |
picosat_elixir |
2022-12 |
configparser_ex |
2023-ish |
corsica |
2023-10 |
remote_ip |
2024-06 |
broadway_sqs |
2024-06 |
geo_postgis |
2024-09 |
Most of these are narrow, stable, and fine to keep — picosat_elixir and logfmt do one thing and do it. The ones I'd look at hardest are videojs-offset and leaflet-defaulticon-compatibility: both tiny, both single-maintainer, both the profile that gets targeted for account takeover, and both plausibly replaceable with a few lines of our own code.
ash_uuid
26k lifetime downloads and last released 2024-11 — three orders of magnitude less used than anything else in the tree, and it sits in the data layer. Ash has since grown built-in UUIDv7 support; worth checking whether we can drop this.
Redundant HTTP clients
We currently pull in four: httpoison, hackney, finch, and req (transitive). That's four advisory surfaces for one job — hackney alone has 8 open advisories at our locked 1.25.0.
reverse_proxy_plug supports Finch as an adapter, and ex_aws supports Req. Consolidating would meaningfully shrink the surface. Not a small change, so probably its own issue if we decide to pursue it.
poison alongside jason
We declare {:poison, "~> 6.0"} directly while also using Jason. Poison appears to be pulled in mainly as an optional dependency of geo_postgis and open_api_spex, both of which prefer Jason. Worth checking whether the direct declaration can just be dropped.
Ash ecosystem concentration
Not an action item, just something to have said out loud: we take ~10 direct Ash dependencies plus spark/igniter/reactor/splode transitively, essentially all from one org. The quality bar is high and release velocity is excellent. But it is a single point of failure across our data layer, API layer, auth and admin simultaneously, and that velocity is also why deferred upgrades compound so fast (see #1004). ash_authentication is now at 5.0.0-rc, so the 4.x line we're on is winding down.
Related: #930, #998.
Notes from a dependency-health audit. None of these are urgent — nothing here is currently vulnerable — but they're the part of the tree with no one behind it, so it's worth a deliberate decision on each rather than discovering it later.
Dormant packages
Last publish dates as of 2026-07:
JS
videojs-offsetjszipleaflet-defaulticon-compatibilityreact-fast-marqueeElixir
logfmtredoc_ui_plugpicosat_elixirconfigparser_excorsicaremote_ipbroadway_sqsgeo_postgisMost of these are narrow, stable, and fine to keep —
picosat_elixirandlogfmtdo one thing and do it. The ones I'd look at hardest arevideojs-offsetandleaflet-defaulticon-compatibility: both tiny, both single-maintainer, both the profile that gets targeted for account takeover, and both plausibly replaceable with a few lines of our own code.ash_uuid26k lifetime downloads and last released 2024-11 — three orders of magnitude less used than anything else in the tree, and it sits in the data layer. Ash has since grown built-in UUIDv7 support; worth checking whether we can drop this.
Redundant HTTP clients
We currently pull in four:
httpoison,hackney,finch, andreq(transitive). That's four advisory surfaces for one job —hackneyalone has 8 open advisories at our locked 1.25.0.reverse_proxy_plugsupports Finch as an adapter, andex_awssupports Req. Consolidating would meaningfully shrink the surface. Not a small change, so probably its own issue if we decide to pursue it.poisonalongsidejasonWe declare
{:poison, "~> 6.0"}directly while also using Jason. Poison appears to be pulled in mainly as an optional dependency ofgeo_postgisandopen_api_spex, both of which prefer Jason. Worth checking whether the direct declaration can just be dropped.Ash ecosystem concentration
Not an action item, just something to have said out loud: we take ~10 direct Ash dependencies plus
spark/igniter/reactor/splodetransitively, essentially all from one org. The quality bar is high and release velocity is excellent. But it is a single point of failure across our data layer, API layer, auth and admin simultaneously, and that velocity is also why deferred upgrades compound so fast (see #1004).ash_authenticationis now at5.0.0-rc, so the 4.x line we're on is winding down.Related: #930, #998.