[daniboybye]

Requested by Daniel Urumov · project thread

Summary

Adds docs/UPDATING_DEPENDENCIES.md, a repeatable procedure covering:

• Erlang/Elixir versions (.tool-versions, mix.exs, setup-beam on Linux/macOS/Windows runners)
• The engine dependency and Hex dependencies, including Phoenix, esbuild/tailwind binaries, heroicons and the mix.local.lock caveat
• Analysis and formatting tools (credo, dialyxir, sobelow, formatter, trivy, swiftlint)
• GitHub Actions (SHA pins) and runner images (ubuntu, xcode-27, Windows)
• Verification, PR conventions (English, branch cleanup, local validation of cloud-agent PRs)

Docs only; no code or workflow changes. The local .claude/ directory is gitignored, so the procedure lives in a tracked doc.

---

Generated by Claude Code

[daniboybye]

CI is red because of mix hex.audit, not because of this PR, which only adds docs/UPDATING_DEPENDENCIES.md. Two new advisories hit the committed mix.lock: phoenix_html 4.3.0 (EEF-CVE-2026-117645, medium) and ssl_verify_fun 1.1.7 (EEF-CVE-2026-117666, critical). main fails the same step. The fix is a mix.lock bump (mix deps.update phoenix_html ssl_verify_fun, with ELIXIR_TORRENT_HEX=1) and needs local validation, so I'm keeping it out of this docs PR and proposing it as a separate dependency-update PR.

---

Generated by Claude Code