chore(deps): update mdex, phoenix, lazy_html, and 2 others

[zorn]

Summary

This updates all outdated dependencies, including a pre-1.0 breaking bump of mdex to 0.14. That bump needed only a widened constraint in mix.exs, because its breaking change touches Lumis syntax highlighting, which Flick does not use. lazy_html 0.1.13 fixes a CVE; it is a test-only dependency.

Direct Dependencies

mdex 0.13.5 → 0.14.0
diff · changelog

• ⚠ Breaking: requires mdex_native >= 0.2.9 and lumis ~> 0.9. Lumis v0.9 no longer auto-loads languages, and each language is now its own Hex package. (Flick does not enable syntax highlighting, so this has no effect here.)
• Introduce Stream API (feat: introduce Stream API leandrocp/mdex#397)
• Add :auto_close option to close open Markdown syntax (feat: add :auto_close option to close open Markdown syntax leandrocp/mdex#403)
• Do not append a table row when a blank line closed the table (fix(parser): do not append a table row when a blank line closed the table leandrocp/mdex#402)
• Preserve escaped AST children (fix: preserve escaped AST children leandrocp/mdex#413)
• Skip AST struct conversion when rendering Markdown (perf: skip AST struct conversion when rendering Markdown leandrocp/mdex#404)

phoenix 1.8.14 → 1.8.15
diff · changelog

• [phx.gen.cert] Fix certificate not being accepted by Chromium (Certificates from mix phx.gen.cert are rejected by Chrome phoenixframework/phoenix#6847)
• [phoenix.js] Fix asynchronous transport close tearing down the replacement transport (Long-poll fallback from an open WebSocket triggers a LiveView page reload loop phoenixframework/phoenix#6852)
• [phx.new] Update Tailwind version to 4.3.3

lazy_html 0.1.12 → 0.1.13 (test only)
diff · changelog

• Fixed to_html/2 functions to escape <style> and <script> content inside SVG and MathML (CVE-2026-92106, GHSA-8rqp-v692-v82q)
• Added LazyHTML.css_path/1 for generating queryable document-relative paths for selections

Transitive Dependencies

mdex_native 0.2.8 → 0.2.9 — diff · changelog — Update comrak to 0.55.0, faster Markdown rendering, Lumis 0.9 support, and declare children on Escaped AST nodes.

hpax 1.0.4 → 1.1.0 — diff · changelog — Add HPAX.protocol_resize/2, return errors instead of raising on malformed Huffman strings and table size updates, and speed up Huffman decoding.