chore(deps): update req, phoenix_live_view, mdex, swoosh, and 3 others

[zorn]

Summary

Routine dependency refresh: all seven outdated packages updated, pulling five transitive bumps along with them. No code changes were needed — mix precommit passes clean (108 tests, credo --strict with no issues).

Two things worth a reviewer's attention. First, req crossed a 0.x minor (0.6 → 0.7) that carries several breaking changes, but Flick never calls Req directly — it is only reachable through Swoosh.ApiClient.Req, and the two functions Swoosh uses (Req.get_headers_list/1 and the decode_body: false option) both still exist in 0.7.2. The configured mailer adapter is Swoosh.Adapters.Local, so the API-client path is not exercised anyway. Second, the mint bump is a security fix — it moves off three CVEs.

Separately, and not addressed by this PR: mix deps.get reports hackney 1.25.0 as vulnerable (four advisories, one HIGH — SSRF allowlist bypass, CR/LF injection, and a SOCKS5 timeout issue). The fix landed in hackney 4.0.1 and there is no patched 1.x release, but tzdata 1.1.4 (the latest) hard-requires hackney ~> 1.17, which caps us at 1.x. This predates this PR and needs its own decision — either wait for tzdata to relax the constraint or force an override and re-test.

Direct Dependencies

bandit 1.12.0 → 1.12.4
diff · changelog

• Several HTTP/1 correctness fixes: properly send Connection: close when the client requests closure (Echo connection: close when the client requests closure mtrudel/bandit#617), disallow transfer-encoding on HTTP/1.0 connections (Treat Transfer-Encoding on an HTTP/1.0 request as faulty framing mtrudel/bandit#618), reject requests with multiple Host headers (Reject requests with multiple Host headers mtrudel/bandit#619), reject malformed header lines (Reject header values containing CR, LF, or NUL mtrudel/bandit#620), and fix handling of chunk extensions (Fix crash on unrecognized chunk extensions mtrudel/bandit#621)
• Send a "100 Continue" interim response before reading the body if the client requests it (Handle clients sending an Expect: 100-continue header before sending a body mtrudel/bandit#624)
• Cache connection-level data between HTTP/1 keepalives, and coalesce header and body into a single transport send

lazy_html 0.1.11 → 0.1.12 (test only)
diff · changelog

• Relaxed the elixir_make requirement (Relax elixir_make requirement to allow 0.10.0 dashbitco/lazy_html#35) — this is what allows elixir_make to move to 0.10.0 below

mdex 0.13.3 → 0.13.5
diff · changelog

• Fixes LiveView 1.2 deprecation warnings from EEx.compile and relaxes the phoenix_live_view version requirement (fix: LiveView 1.2 deprecation warnings( EEx.compile ) leandrocp/mdex#380)
• Adds LaTeX-style math delimiters via extension: [math_latex: true], and attribute parsing for headings, fenced code blocks, inline code, links, and images (opt-in per extension option)
• Heading anchors from :header_id_prefix now render after the heading content with an accessible aria-label, and are no longer hidden from assistive technology
• Requires mdex_native >= 0.2.6

phoenix_live_reload 1.6.2 → 1.7.0 (dev only)
diff · changelog

• Adds a JavaScript helper to capture keyboard shortcuts for opening HEEx components
• Forwards log events to window for custom behaviour

phoenix_live_view 1.2.7 → 1.2.8
diff · changelog

• Client-side navigation can now be cancelled by listening for phx:before-navigate and calling event.preventDefault() — useful for "do you really want to leave" prompts on unsaved changes (Allow cancelling client-side live navigation phoenixframework/phoenix_live_view#4332)
• Upload tokens are now signed as :local so node names are not included in the token
• Fixes live components not being correctly patched when their DOM ID changes (Handle keyed root when patching live components phoenixframework/phoenix_live_view#4338), the server close handler not being reattached after a manual disconnect/connect (Ls fix handler lost phoenixframework/phoenix_live_view#4341), and detail.lock() promises on phx:push never resolving (phx:push event detail.lock() returns a promise that never resolves phoenixframework/phoenix_live_view#4351)

req 0.6.2 → 0.7.2
diff · changelog

• Breaking in 0.7.0, none of which Flick touches: run_finch replaced by the Req.Finch adapter module, put_plug/run_plug replaced by Req.Plug, Req.Request.current_request_steps removed, encode_body now switches GET to POST when a body is set, put_params now overwrites query params instead of appending, and the deprecated follow_redirects and output steps are gone
• Security-relevant: redirect now strips userinfo from redirect locations and logs a warning, so credentials supplied by a redirecting server are no longer forwarded
• Now requires Elixir 1.15+ (Flick is on ~> 1.20.1)
• 0.7.1 deprecates cache: true / the cache step, slated for removal in 0.8

swoosh 1.26.3 → 1.27.0
diff · changelog

• Adds an AhaSend adapter (Add AhaSend adapter swoosh/swoosh#1177) — no other changes

Transitive Dependencies

mint 1.9.1 → 1.9.3 — diff · changelog — Security: fixes CVE-2026-59249 (signed integers when parsing HTTP/1 chunk sizes), CVE-2026-58229 (uncapped HTTP/1 response header size), and CVE-2026-59246 (empty HTTP/2 CONTINUATION frames being stored).

ecto 3.14.0 → 3.14.1 — diff · changelog — Adds :on_writable_violation for fields and UUIDv7 helpers; several Ecto.Query planner and parameter-splicing fixes.

plug_crypto 2.1.1 → 2.2.0 — diff · changelog — Supports :compressed and :local options on encrypt/sign; this is what backs the LiveView upload-token change above.

mdex_native 0.2.5 → 0.2.6 — diff · changelog — Updates the underlying comrak Markdown parser (leandrocp/mdex_native#42); required by mdex 0.13.4+.

elixir_make 0.9.0 → 0.10.0 — diff · changelog — Build-time only: requires Elixir 1.14+, treats empty proxy vars as unset, adds :sunos to the gmake unix list, and fixes character encoding during logging on Unix.