From 39a394b6bd6b08a2f4454e1f207dcd05a64ded5b Mon Sep 17 00:00:00 2001 From: Swarup Sengupta Date: Tue, 11 Aug 2026 20:27:51 +0100 Subject: [PATCH] Make timex an optional dependency MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `Surgex.DateTime` is the only module that uses Timex, and it is already guarded by `if Code.ensure_loaded?(Timex)`, so the library compiles and works without it. Making the dependency optional stops it being forced on every consumer. Two reasons this matters beyond tidiness: - **timex is on the org's banned-libs list.** surgex currently propagates it transitively into every consuming service, where it shows up as a banned-libs advisory the consumer cannot fix. - **timex caps `gettext` at `~> 0.26`**, which blocks consumers from moving to gettext 1.x. Verified on app-inventory: with this change timex leaves the lock entirely (0 entries) and gettext resolves to 1.0.2, where before it was pinned below 1.0. Consumers that use `Surgex.DateTime` keep working by declaring `:timex` themselves — the same contract as any optional dependency. Tests: 2 doctests, 207 tests, 0 failures. Timex is still fetched for surgex's own build, so the `Surgex.DateTime` tests continue to run. --- mix.exs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mix.exs b/mix.exs index 313b5cf..fec5b93 100644 --- a/mix.exs +++ b/mix.exs @@ -67,7 +67,7 @@ defmodule Surgex.Mixfile do {:ecto_sql, "~> 3.0"}, {:jabbax, "~> 0.2 or ~> 1.0"}, {:plug, "~> 1.7"}, - {:timex, "~> 3.7"} + {:timex, "~> 3.7", optional: true} ] |> Enum.map(&merge_dep_flags(&1, optional: true)) end