chore(deps): update dependencies to their latest versions

[thiagoesteves]

What changed

Brings every direct dependency that had a newer release up to date, and opens 0.9.14.

Picked up within the existing requirements:

Dep	From	To
bandit	1.12.4	1.12.5
mox	1.2.0	1.3.0
phoenix_live_reload	1.6.2	1.7.0
phoenix_pubsub	2.2.0	2.3.0
sobelow	0.14.1	0.15.0
swoosh	1.26.3	1.28.0
telemetry_metrics	1.1.0	1.2.0
xml_builder	2.4.0	2.4.1

Needing a requirement change:

Dep	Requirement	From	To
briefly	~> 0.4.1 → ~> 0.5	0.4.1	0.5.1
configparser_ex	~> 4.0 → ~> 5.0	4.0.0	5.0.1
dns_cluster	~> 0.1.1 → ~> 0.3	0.1.3	0.3.0
gettext	~> 0.26 → ~> 1.0	0.26.2	1.0.2
phoenix_live_dashboard	~> 0.8.3 → ~> 0.9	0.8.7	0.9.0
phoenix_live_view	~> 1.0.0 → ~> 1.2	1.0.18	1.2.11
plug_crypto	~> 2.1.0 → ~> 2.2	2.1.1	2.2.0

phoenix and ex_aws were held back by two of those requirements rather than by their own: phoenix 1.8.13 needs plug_crypto ~> 2.2 and ex_aws 2.7.0 needs configparser_ex ~> 5.0, so both only moved once foundation allowed the newer transitive dependency.
phoenix goes 1.8.9 → 1.8.13 and ex_aws 2.5.9 → 2.7.0.

Consequences of the LiveView bump

Three, none of them optional:

lazy_html added as a test dependency. LiveView 1.1 replaced Floki with LazyHTML inside Phoenix.LiveViewTest and raises at runtime without it.
floki is removed in the same change, since nothing in the repository references it and it was only ever present for LiveViewTest.

Three assertions in mode_test.exs. They matched the serialised attribute selected="selected", which LiveView 1.2 now renders as selected="".
They assert through has_element? and a CSS selector instead, which tests the selected option rather than how the attribute happens to be written, so the next change to the serialisation does not break them.

Ten HEEx templates reformatted. Phoenix 1.8.13 changed how the formatter indents comments and collapses empty elements.
mix format produced the whole diff, no template was edited by hand.

Note for release preparation

This does not decide the hot upgrade answer for 0.9.14, which is made at release prep against the full diff from 0.9.13.
The one item here worth carrying into that decision is phoenix_pubsub 2.2 → 2.3: it is stateful and carries the process groups the umbrella broadcasts through, so it wants checking against the generated appup rather than assumed.

Risk assessment

Impact: no behaviour change intended.
The dashboard, the deployment engine, the hot upgrade path and the notification adapters are untouched.
Operators see the same UI, the same YAML and the same events.

Blast radius: the dependency declarations in three mix.exs files, mix.lock, the ten reformatted templates in deployex_web, and one test file.
Nothing under apps/deployer/lib, apps/foundation/lib, apps/sentinel/lib or apps/host/lib changes.
config/runtime.exs and the config providers are untouched.

Regression risk: medium, carried almost entirely by the version jumps rather than by the diff.
phoenix_live_view 1.0 → 1.2 crosses two minor versions and is the largest of them, though the whole LiveView surface compiles with no warnings and the suite passes.
gettext 0.26 → 1.0 and configparser_ex 4.0 → 5.0 are major bumps; configparser_ex has no call site in this repository and is present only so ex_aws can read AWS credential files, and gettext is used through the generated DeployexWeb.Gettext backend.
lazy_html is a precompiled NIF but is test-only, so no release artifact contains it.

Rollback: plain commit revert. No data or configuration migration.

Verification

All CI gates run locally and green:

mix compile --warnings-as-errors, mix test --cover --warnings-as-errors (776 tests, 0 failures, every app above the 94% threshold), mix credo --strict, mix format --check-formatted, mix deps.unlock --check-unused, mix deps.audit, mix sobelow, mix dialyzer, mix docs --failed.

🤖 Generated with Claude Code (Claude Opus 5)