chore: support only the last three Elixir and OTP releases

[yordis]

• Carrying Elixir releases that upstream no longer patches costs CI time on every push and kept mix.exs pinned at ~> 1.11, so nothing newer could be adopted.
• Staying on Postgrex ~> 0.17 left two open SQL injection advisories against Postgrex.Notifications unaddressed (CVE-2026-32687, HIGH, and CVE-2026-58225, LOW).
• The fsm dependency is vendored rather than patched because it has had no release since 2017 and its __using__ expands into our module, so the warnings it generates cannot be suppressed from deps/.
• Breaking for consumers: the supported matrix is now Elixir 1.20/1.19/1.18 and OTP 29/28/27, and the Postgrex bump pulls decimal 2 to 3.

[cursor]

PR Summary

Medium Risk
Breaking for downstream apps on older Elixir/OTP or decimal 2, plus dependency and vendored FSM changes in subscription core; Postgrex upgrade is security-motivated but still touches DB connectivity.

Overview
Narrows supported tooling to Elixir 1.18/1.19/1.20 and OTP 27/28/29, bumps minimum Elixir in mix.exs to ~> 1.18, and refreshes CI to match (including fail-fast: false, always running mix format --check-formatted, and setting up the migration test DB).

Postgrex ~> 0.22 (with decimal 3 and related lockfile updates) addresses known Postgrex notification advisories; preferred_cli_env moves to Mix’s cli/0 API.

The unmaintained fsm hex dep is removed and replaced by a vendored EventStore.Fsm, with SubscriptionFsm switched to it plus small Dialyzer-oriented typing tweaks. Test configs disable logging via config :logger, :default_handler, false instead of backends: [].

Tests and CI hygiene fixes include descending ranges (10..1//-1), stricter snapshot assertions, and hibernation checks that accept OTP 28’s gen_server:loop_hibernate/4. Local dev pins move to mise.toml (.tool-versions cleared).

^{Reviewed by Cursor Bugbot for commit f60cadc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9a9b68b6-ae2f-44d8-9d20-74a98b1139c8

📥 Commits

Reviewing files that changed from the base of the PR and between 8796f43 and f60cadc.

📒 Files selected for processing (1)

• .github/workflows/test.yml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9745e05e-8913-4a2c-98ec-6e19744c869d

📥 Commits

Reviewing files that changed from the base of the PR and between a1268b5 and 8796f43.

⛔ Files ignored due to path filters (1)

• mix.lock is excluded by !**/*.lock

📒 Files selected for processing (16)

• .github/workflows/test.yml
• .tool-versions
• config/bench.exs
• config/jsonb.exs
• config/migration.exs
• config/test.exs
• config/text_ids.exs
• lib/event_store/fsm.ex
• lib/event_store/sql/statements/insert_events.sql.eex
• lib/event_store/storage/snapshot.ex
• lib/event_store/subscriptions/subscription_fsm.ex
• mise.toml
• mix.exs
• test/event_store_test.exs
• test/notifications/notifications_supervisor_test.exs
• test/subscriptions/subscribe_to_stream_test.exs

💤 Files with no reviewable changes (1)

• .tool-versions

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The project updates Elixir and OTP support, replaces the external FSM dependency with EventStore.Fsm, changes logger and EEx configuration, and updates CI and tests for newer runtime behavior.

Changes

Elixir and FSM modernization

Layer / File(s)	Summary
Platform and dependency updates .github/workflows/test.yml, .tool-versions, mise.toml, mix.exs	The project now targets Elixir 1.18 or newer, Postgrex 0.22, and Elixir/OTP 29 tooling. CI tests Elixir 1.18–1.20 with OTP 27–29 and always checks formatting.
FSM implementation and subscription integration lib/event_store/fsm.ex, lib/event_store/subscriptions/subscription_fsm.ex	The repository adds the EventStore.Fsm macro framework. Subscription FSM code uses it and requires %SubscriptionState{} in notify_partition_subscriber/3.
Runtime configuration and SQL template updates config/*.exs, lib/event_store/sql/statements/insert_events.sql.eex, lib/event_store/storage/snapshot.ex	Logger configuration disables the default handler. SQL comments use EEx comment syntax. Snapshot row destructuring is reformatted without a behavior change.
Compatibility test updates test/event_store_test.exs, test/notifications/notifications_supervisor_test.exs, test/subscriptions/subscribe_to_stream_test.exs	Tests use explicit descending ranges, match %SnapshotData{}, and accept both supported OTP hibernation functions.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 8796f

The supported Elixir/OTP matrix is updated without an established requirement to block newer Elixir releases, so no actionable merge risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 12 files. (3 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary change: limiting support to the three latest Elixir and OTP releases.
Description check	✅ Passed	The description directly explains the supported-release changes, Postgrex upgrade, vendored FSM implementation, dependency impact, and breaking-change scope.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 12 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yordis/chore-support-last-three-elixir-otp

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the newer state
The FSM hops through each gate
OTP dreams in hibernation
CI runs each formation
Clean templates wait at the burrow door}

_{Comment @coderabbitai help to get the list of available commands.}