Deps: phoenix family + misc freshness

[bbangert]

Summary

Deliberate freshness pass for the deps that transiently appeared during the v0.1.10 resolution — same versions, now pinned via an explicit mix.exs edit + scoped mix deps.update instead of an incidental side effect.

Coupled Phoenix family (moved together):

• phoenix 1.8.11 → 1.8.13 — bug fixes only: phx.gen.auth return_to session-key clear, a channel-message-drop regression (introduced 1.8.3), and a Chrome 149 tab-resume reconnect workaround.
• phoenix_live_view 1.2.9 → 1.2.11 — bug fixes (upload/hook/JS-transition edge cases) + enhancements (navigation_type/2, dynamic phx-hook, external-upload cancel-on-navigate). No breaking changes for this app's usage.
• phoenix_live_dashboard 0.8.0 → 0.9.0 (minor, mix.exs constraint bumped ~> 0.8 → ~> 0.9) — see verdict below.
• phoenix_pubsub 2.2.0 → 2.3.0 — adds :group_by Registry-sharding option and a configurable default :dispatcher (both opt-in, unused here), plus a tracker-state cleanup bug fix. Phoenix.PubSub.Supervisor internals changed (registry :keys computed from :group_by) but default behavior (:pid/:duplicate) is unchanged.
• telemetry_metrics 1.1.0 → 1.2.0 — adds function support for :tags (supersedes :tag_values); no removal, existing config still works.

Plus:

• improv 0.1.2 → 0.1.3 (our own lib) — pure constraint bump, {:bluez, "~> 0.1"} → {:bluez, "~> 0.2"}. No code changes. bluez was already locked at 0.2.0.
• req 0.7.2 → 0.7.4 — 0.7.3 reverted the "auto GET→POST when body is set" behavior added in 0.7.0 (restores plain GET semantics); 0.7.4 allows explicit duplicate query params in put_params and fixes put_path_params overwriting redirect targets. Not used in a way that depended on the reverted behavior.
• ssh_subsystem_fwup 0.6.7 → 0.6.8 — improves UUID-nickname/error visibility in mix upload; no functional change to the proxy.
• nerves_toolchain_x86_64_nerves_linux_musl 15.3.0 → 15.3.1 — build-script/mirror-URL patches only (matches the toolchain bump already shipped for the other 4 targets in Deps: nerves_discovery 0.1.4 + toolchains 15.3.1 #186).

phoenix_live_dashboard 0.9.0 changelog verdict — no action needed

Full delta (mix hex.package diff phoenix_live_dashboard 0.8.0..0.9.0, CHANGELOG hunk):

## v0.9.0 (2026-08-12)
* Require Phoenix LiveView 1.0+
* Require Elixir 1.15+
* Add a compact nested list view for application supervision trees
* Allow overriding the Ecto Stats info module per repository by passing {repo, info_module} tuples in :ecto_repos
* Add refresh_interval as a reporting option for chart components
* Display process label in application and process views

(plus the intervening 0.8.1–0.8.7 patch entries, all bug fixes)

• Both new floor requirements (LiveView 1.0+, Elixir 1.15+) are already satisfied by this app (LiveView 1.2.11, Elixir 1.20.3) — no forced coupling beyond what we're already bumping.
• UI-visible: the Applications page gets a new compact nested-supervision-tree view and process labels; Process/Application views now render process labels. This only affects the /dashboard route (dev-only live_dashboard "/dashboard" mount, not user-facing), so no impact on the Overview/Audio/etc. app pages.
• The Ecto Stats per-repo info_module override doesn't apply — this app has no Ecto repo configured.
• No removals or breaking API changes found in the diff. mix.exs constraint bumped from "~> 0.8" to "~> 0.9" since the lock was already (harmlessly) sitting at 0.9.0 ahead of that constraint from the v0.1.10 resolution — this PR makes that consistent again.

diff.hex.pm links

• https://diff.hex.pm/diff/phoenix/1.8.11..1.8.13
• https://diff.hex.pm/diff/phoenix_live_view/1.2.9..1.2.11
• https://diff.hex.pm/diff/phoenix_live_dashboard/0.8.0..0.9.0
• https://diff.hex.pm/diff/phoenix_pubsub/2.2.0..2.3.0
• https://diff.hex.pm/diff/telemetry_metrics/1.1.0..1.2.0
• https://diff.hex.pm/diff/improv/0.1.2..0.1.3
• https://diff.hex.pm/diff/req/0.7.2..0.7.4
• https://diff.hex.pm/diff/ssh_subsystem_fwup/0.6.7..0.6.8
• https://diff.hex.pm/diff/nerves_toolchain_x86_64_nerves_linux_musl/15.3.0..15.3.1

mix.lock diff (only these 8 rows changed)

improv                                     0.1.2  → 0.1.3
nerves_toolchain_x86_64_nerves_linux_musl  15.3.0 → 15.3.1
phoenix                                    1.8.11 → 1.8.13
phoenix_live_view                          1.2.9  → 1.2.11
phoenix_pubsub                             2.2.0  → 2.3.0
req                                        0.7.2  → 0.7.4
ssh_subsystem_fwup                         0.6.7  → 0.6.8
telemetry_metrics                          1.1.0  → 1.2.0

(phoenix_live_dashboard was already locked at 0.9.0; only its mix.exs constraint needed the edit.)

No assets/package.json-driven npm install applies — this is a Nerves-embedded Phoenix app; assets/package.json only has file:../deps/... local references (no npm registry deps, no lockfile, no npm/node in the toolchain), so it's untouched.

Gate results

• mix format --check-formatted — clean
• mise exec -- sh -c 'MIX_TARGET=host mix compile --warnings-as-errors --force' — clean (only pre-existing, unrelated vendored mdns_lite warnings, which aren't part of this app's own compile and don't fail the build)
• mise run test — 1607/1607 passed (2 doctests, 1605 tests, 3 excluded) on the final run. One earlier run showed a single flake (UniversalProxy.ESPHome.BluetoothScannerTest "a dead subscriber is auto-removed", a 100ms assert_receive under full-suite CPU load); reproduced 3/3 in isolation with 0 failures, confirming it's a pre-existing timing flake in a test that only touches core Elixir Registry (no Phoenix/PubSub/req/etc. involved) — unrelated to this bump.
• mise exec -- sh -c 'MIX_TARGET=host MIX_ENV=dev mix dialyzer' — passed successfully (7 pre-existing ignored findings, per .dialyzer_ignore.exs; 0 new)
• LiveView sanity: overview_live_test.exs, audio_live_test.exs, header_clients_test.exs, overview_fma120_test.exs and the rest of the LiveView suite are all green in the full run above.

Test plan

• mix format --check-formatted
• mix compile --warnings-as-errors
• mise run test (full suite, 1607/1607)
• MIX_TARGET=host MIX_ENV=dev mix dialyzer
• git diff mix.lock scoped to exactly the 8 intended rows
• hex.package diffs captured for all 9 updates, LiveDashboard 0.9 changelog read in full

🤖 Generated with Claude Code