chore(deps): consume the event store fork the adapter is written against

[yordis]

• Resolving :eventstore by name from Hex pulled a different event store than the one this adapter is written for, so the adapter was compiled and tested against code that does not ship with it. The subscription fixes it depends on were never exercised.
• The advisories the tree was carrying all had published fixes available, and leaving them in place meant every consumer inherited them.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[cursor]

PR Summary

Medium Risk
Swapping the event-store source and bumping Ecto/decimal/Postgres-related transitive deps affects optional EventStore and projection test paths; misalignment could surface integration issues, though scope is dependency resolution only.

Overview
Pins the optional :eventstore dependency to the TrogonStack fork (commanded_eventstore tag v1.4.9) instead of resolving eventstore from Hex, so dev/CI builds and tests run against the same EventStore implementation the Commanded.EventStore.Adapters.EventStore adapter is written for (including subscription behavior that Hex’s package did not provide).

mix.lock is refreshed as a result: eventstore is locked from Git, and several transitive packages move forward (notably Ecto 3.14, decimal 3.x, postgrex, db_connection, jason, telemetry) to match what the fork pulls in—addressing previously inherited advisory fixes without changing application code in this repo.

^{Reviewed by Cursor Bugbot for commit aa40f2f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: e394d443-c958-4a48-8a96-69cbb3e27442

📥 Commits

Reviewing files that changed from the base of the PR and between a1dbd95 and aa40f2f.

⛔ Files ignored due to path filters (1)

• mix.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• mix.exs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The optional eventstore dependency now uses the TrogonStack/commanded_eventstore GitHub repository, pinned to tag v1.4.9.

Changes

Eventstore Dependency

Layer / File(s)	Summary
Pin Eventstore Git source mix.exs	The optional dependency now points to the TrogonStack/commanded_eventstore repository at tag v1.4.9, replacing the Hex version requirement.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to aa40f

The optional Eventstore dependency now points to the intended pinned fork. No actionable merge-blocking issue is established, although the fork’s manifest remains unverified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: consuming the event store fork used by the adapter.
Description check	✅ Passed	The description explains the dependency mismatch and the advisory fixes addressed by the pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the tag with care,
Then hops along without a scare.
The source is set, the pin is neat,
One small change beneath its feet.
It tucks the mix file in its nook,
And dreams of carrots—and a book.}

_{Comment @coderabbitai help to get the list of available commands.}

[yordis]

Superseded by #112, same change with an allowed commit type.