Drop Elixir 1.14/1.15, update dependencies

[drozdzynski]

Stacked on #10 — see "Branching" at the bottom for why this is not branched off master.

Drop Elixir 1.14 and 1.15

mix.exs now declares elixir: "~> 1.16", and the CI matrix drops the five 1.14/1.15 jobs (18 → 13).

Rationale:

• 1.16–1.20 is Elixir's support window (five most recent minors). 1.14 is two minors below it, 1.15 one.
• 1.14 released 2022-09-01 (4 years ago), 1.15 on 2023-06-19 (3 years 3 months). Both cap out at OTP 25 or older, which is why those rows were pinned to ubuntu-22.04.
• The declared ~> 1.10 floor was already fiction: the runtime dependency nanoid requires ~> 1.12, so a 1.10/1.11 project could never resolve the tree.

Remove the :pg2 fallback

lib/storex.ex and lib/storex/pg.ex carried Code.ensure_loaded?(:pg) branches falling back to :pg2. :pg2 was removed in OTP 24 and Elixir 1.16 needs OTP 24+, so those branches were already unreachable — the matrix has not tested an OTP that could hit them since before 1.14 was dropped.

Update dependencies

Notable moves:

dep	from	to
plug	1.16.1	1.20.3
bandit	1.5.5	1.12.5
cowboy	2.12.0	2.18.0
ranch	1.8.0	2.2.1
hpax	0.2.0	1.0.4
tesla	1.11.2	1.21.3
wallaby	0.30.9	0.30.12
websock_adapter	0.5.6	0.5.9
ex_doc	0.34.2	0.40.4

Everything the resolver could move, moved; no dependency constraint in mix.exs needed changing. All updated packages declare an Elixir requirement of ~> 1.15 or lower, so the new 1.16 floor holds.

Also drops the stale earmark 1.3.1 lock entry — nothing in the tree has referenced it since ex_doc switched to earmark_parser.

mix hex.audit

Retired packages: none after the earmark removal (it was the only one).

Advisories: two packages, both already at the newest version the resolver can reach, and both test-only — neither reaches library consumers:

• hackney 1.25.0 — 4 advisories (one HIGH: SOCKS5 TLS upgrade ignores caller timeout). Pulled in by wallaby → httpoison → hackney. httpoison 2.3.0 requires hackney ~> 1.21, so the fixed 4.x line is unreachable until httpoison widens that constraint. Nothing actionable here.
• cowlib 2.19.0 — 3 advisories (max MEDIUM). 2.19.0 is the latest release; there is no fixed version to move to. Pulled in by cowboy, which is only: :test.

Neither appears in the :prod dependency tree, so mix.exs's published requirements are unaffected.

Verified locally

mix compile --force --warnings-as-errors → 0 warnings, non-browser suite → 52 passed, on:

• Elixir 1.20.4 / OTP 29.0.6
• Elixir 1.19.5 / OTP 28.4
• Elixir 1.18.1 / OTP 27.2
• Elixir 1.16.2 / OTP 26.2.3 (the new floor)

Browser tests (Wallaby) not run locally — no chromedriver on this machine.

Branching

Requested off master, but built on fix/elixir-1.18-type-warnings (#10) instead: that PR adds the mix compile --warnings-as-errors step and the 1.18–1.20 matrix rows, and without its Storex.Store fix those jobs fail on the type warnings. Branching off master would have shipped a red matrix or silently dropped those rows.

Retarget to master once #10 merges.

Note on versioning

CHANGELOG.md folds #10's entry into this one: the ## 0.6.2 section added there becomes ## 0.7.0 here, carrying all four bullets. Only 0.7.0 gets tagged, so 0.6.2 never becomes a phantom release. #10's Version 0.6.2 commit is left in place so that PR still stands on its own; it is superseded by the Version 0.7.0 commit here.

[Copilot]

🟢 Approval recommended

The changes are cohesive and low-risk (version floor + dependency/CI updates) with only a minor maintainability nit outstanding.

Pull request overview

This PR bumps Storex to 0.7.0, raises the minimum supported Elixir version to 1.16+, and refreshes the dependency lockfile/CI matrix accordingly while removing the now-unreachable :pg2 fallback.

Changes:

• Drop Elixir 1.14/1.15 support (project requirement + CI matrix reduction).
• Remove conditional :pg/:pg2 branching and standardize on :pg.
• Update locked dependency versions and bump project/package versions + changelog entry.

File summaries

File	Description
package.json	Bump npm package version to 0.7.0.
mix.exs	Bump library version and raise required Elixir to ~> 1.16.
mix.lock	Refresh locked dependency versions (Plug/Bandit/Cowboy/Tesla/etc.) and drop stale entries.
lib/storex.ex	Always start a :pg instance and remove conditional child construction.
lib/storex/pg.ex	Remove :pg2 fallback helpers and use :pg APIs directly.
.github/workflows/main.yml	Remove Elixir 1.14/1.15 jobs from the CI matrix (and PR branch restriction).
CHANGELOG.md	Add 0.7.0 entry documenting breaking/support/dependency changes.
.gitignore	Add .DS_Store and normalize .elixir_ls entry formatting.

Review details

• Files reviewed: 6/8 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.