hackney 4.x carries the fixes for the four advisories .mix_audit.ignore was
suppressing, so both ignore lists shrink to what is genuinely unfixable.

- hackney 4.4.5 -> 4.6.0, which fixes a hackney_conn process leak on
  connections flagged no_reuse. 4.6.0 is the ceiling: 4.6.1 and later require
  h2 ~> 0.11.0 while hackney's own webtransport dep requires h2 ~> 0.10.4.
- swoosh -> 1.26.3, fixing CVE-2026-54893. This needs tidewave 0.8, because
  swoosh 1.18.3 and later require req ~> 0.5.10, and every req that new
  requires mime ~> 2.0, which google_gax pins away from. tidewave 0.8 drops
  req altogether, so req leaves the tree and takes CVE-2026-49755 with it.
- tzdata tracks upstream master for `hackney ~> 1.17 or ~> 4.0`
  (lau/tzdata#170), which is not on Hex yet.
- Drop metrics and unicode_util_compat from the lock; hackney 4 depends on
  neither.

.mix_audit.ignore is now empty and hex_audit/0 is down to the two cowlib
advisories with no patched release. The file stays because CI passes it via
--ignore-file and mix_audit reads it with File.read!/1.

Filter the httpoison 3 callback contract warnings: hackney 4 made a client
handle a pid where it was a reference, but HTTPoison.AsyncResponse.t() still
declares id: reference().

* First pass at updating and overriding

* Tests passing

* Update Sentry config for new version

* Mitigate typespec issues in httpoison

* DIsable tzupdates for now

* Take hackney 4.6 and clear the resolved advisories

hackney 4.x carries the fixes for the four advisories .mix_audit.ignore was
suppressing, so both ignore lists shrink to what is genuinely unfixable.

- hackney 4.4.5 -> 4.6.0, which fixes a hackney_conn process leak on
  connections flagged no_reuse. 4.6.0 is the ceiling: 4.6.1 and later require
  h2 ~> 0.11.0 while hackney's own webtransport dep requires h2 ~> 0.10.4.
- swoosh -> 1.26.3, fixing CVE-2026-54893. This needs tidewave 0.8, because
  swoosh 1.18.3 and later require req ~> 0.5.10, and every req that new
  requires mime ~> 2.0, which google_gax pins away from. tidewave 0.8 drops
  req altogether, so req leaves the tree and takes CVE-2026-49755 with it.
- tzdata tracks upstream master for `hackney ~> 1.17 or ~> 4.0`
  (lau/tzdata#170), which is not on Hex yet.
- Drop metrics and unicode_util_compat from the lock; hackney 4 depends on
  neither.

.mix_audit.ignore is now empty and hex_audit/0 is down to the two cowlib
advisories with no patched release. The file stays because CI passes it via
--ignore-file and mix_audit reads it with File.read!/1.

Filter the httpoison 3 callback contract warnings: hackney 4 made a client
handle a pid where it was a reference, but HTTPoison.AsyncResponse.t() still
declares id: reference().

* Pin hackney to HTTP/1.1 and keep tzdata updates out of tests

hackney 4 negotiates HTTP/2 by default where 1.x was HTTP/1.1 only. Concurrent
requests to one host multiplex onto a single connection, so retiring that
connection fails every in-flight request at once. mix lightning.install_schemas
lost about a quarter of its fetches to :closed this way. They were retried, but
a transport change is not something this upgrade needs.

tzdata's autoupdater works again now that it accepts hackney 4, so drop the
config that disabled it. Disable it in test instead: it polls IANA a few
seconds after boot, and CI starts from a fresh container every run.

* Retry hackney's mislabelled stale-pool error in install_schemas

hackney keeps a closing pooled connection alive briefly so requests that raced
the checkout get an answer instead of crashing the caller. It means to answer
{:closed, _} -- the comment in hackney_conn.erl says as much -- but the
catch-all it falls through to answers :invalid_state, which was not in
@retriable_reasons. A package hitting that race was skipped after one attempt.

* Note the upstream fix for the httpoison dialyzer filters

edgurgel/httpoison#511 already retypes the async struct ids as `id: pid` and
drops the dead `stream_next/1` clause, so these three filters are temporary.
It merged on 2026-07-05 and 3.0.0 shipped on 2026-06-14, so there is nothing
to do but wait for the next release. Record that so the filters get removed
then rather than outliving the bug.

* Bump cowboy/cowlib, declare finch, pin the tzdata ref

cowboy 2.18.0 and cowlib 2.19.0 clear EEF-CVE-2026-65624 and EEF-CVE-2026-59248.
Both were published on 2026-07-28, about an hour after this branch's last lint
run, so hex.audit was green then and would fail now. Back to exit 0 with only
the two cowlib records that carry no fixed event.

finch backs the app's own Lightning.Finch pool and the default Tesla adapter,
but its version was resolving entirely through prom_ex and goth. Dropping or
loosening either would break the supervision tree with no compile-time signal.
Sentry 13 defaulting its client to Finch makes it worth stating outright.

tzdata takes an explicit ref. The lock pinned the commit, but `github:` with no
ref tracks the default branch, so unlocking it would pull whatever master
happens to be at that moment into a release. Also drop the guess that the fix
lands in 1.1.5: master still declares 1.1.4 and no release is scheduled.

---------

Co-authored-by: Frank Midigo <midigofrank@gmail.com>
Co-authored-by: Stuart Corbishley <corbish@gmail.com>