Freshen dependency locks and take espex 0.10

[bbangert]

Routine dependency freshening: every hex package the current constraints already admit moves to its latest release, plus one constraint widening for espex.

Lock-only bumps

Package	From	To
phoenix	1.8.13	1.8.14
phoenix_live_view	1.2.11	1.2.12
phoenix_live_dashboard	0.9.0	0.9.1
cowboy	2.18.0	2.19.0
cowlib	2.19.0	2.20.0
ranch	2.2.1	2.3.0
mint	1.9.3	1.10.1
ring_logger	0.11.6	0.11.7
ssh_subsystem_fwup	0.6.8	0.6.9
nerves_discovery	0.1.4	0.1.5
dialyxir	1.4.7	1.4.8
nerves_system_bbb	2.30.1	2.30.2
nerves_system_mangopi_mq_pro	0.17.1	0.17.2
nerves_system_qemu_aarch64	0.4.1	0.4.2

No lock entries were added or removed — 96 before, 96 after, versions only.

espex 0.9.0 → 0.10.0 (~> 0.9 → ~> 0.10)

The only change outside the lock. 0.10.0 advertises API 1.16 and is additive for every adapter this app implements:

• SerialProxy.Info gains configured_line_states, defaulting to [], so our %Info{} construction is unaffected. Advertising the RTS/DTR lines our ports can drive is available but not taken here.
• The new acknowledgement builders (serial_request_response/3, modem_pins_response/2, zwave_request_response/2), the runtime-reconfiguration calls (update_device_config/2, update_adapters/2, disconnect_clients/1) and the DeviceCapabilities RPC are all opt-in; no existing callback signature changed.
• One visible behaviour change: an unknown serial instance is rejected with SERIAL_PROXY_STATUS_INVALID_ARGUMENT instead of the generic SERIAL_PROXY_STATUS_ERROR. The app's behaviour is unchanged — only the status espex picks — so the SerialProxyTest assertion moves with it. That is the single test edit in this PR.

The climate feature_flags rework in 0.10 does not reach us; the app exposes no climate entities.

Left alone deliberately

• nerves_system_br stays pinned at 1.34.3 to match custom systems v0.1.10, per the note in mix.exs.
• muontrap 2.0.0 and decibel 1.0.1 are outside their ~> 1.8 / ~> 0.2 constraints — major bumps, not freshening.
• mdns_lite is our vendored path fork, not lockable.
• .mise.toml toolchain pins (erlang 29.0.5 / elixir 1.20.3-otp-29) are untouched.

Verification

Run locally on Elixir 1.20.3 / OTP 29.0.5, matching the CI pins:

• mix compile --warnings-as-errors — clean
• mix format --check-formatted — clean
• mix credo — no issues across 121 files
• mix dialyzer — passed (7 errors, all 7 pre-existing ignores, 0 unnecessary skips)
• mise run test — 1633/1635 passed

The two remaining test failures are container artifacts, not regressions — both fail identically on main's lock:

• UniversalProxy.IdentifyTest "a failed trigger restore is logged" chmods a file to 0444 and expects the write to fail; this container runs as root, which ignores the read-only bit.
• UniversalProxy.SSHAccessTest "the private key round-trips…" needs ssh-keygen, which is not installed here (the test's own message says to exclude the :ssh_keygen tag on such a host).

Both pass in CI, which runs unprivileged with openssh present.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FUnTV1ZaRvoAn1R91VertT

---

Generated by Claude Code