Clear the advisories flagged on release-2.18.0

[elias-ba]

Description

Cherry-picks the two lock-file bumps from main (#5056 and #5063) onto release-2.18.0, so 2.18.0 doesn't ship with advisories its own dependency audit raises:

• postgrex 0.22.3 -> 0.22.4 (EEF-CVE-2026-66838)
• phoenix_live_view 1.0.18 -> 1.0.19 (EEF-CVE-2026-64941)

This branch is currently on the older version of both, so mix deps.audit fails and every PR opened against release-2.18.0 shows a red lint job - #5064 and #5065 both do. This clears that as well.

Lock file only: both new versions sit inside the requirements already in mix.exs, so nothing else moved. The changelog notes go under Unreleased rather than 2.18.0-pre1, which shipped without them.

Collapsed into one commit because the two are the same change with one purpose; the original commits are on main if the history is wanted.

Validation steps

1. mix deps.get
2. mix deps.audit --ignore-file .mix_audit.ignore - should report No vulnerabilities found.
3. The lint job should pass, here and on the other release PRs once they pick this up.

Additional notes for the reviewer

No application code changes, so the risk is a patch regression in either dependency rather than anything in this diff.

AI Usage

Please disclose whether you've used AI anywhere in this PR (it's cool, we just want to know!):

• I have used Claude Code
• I have used another model
• I have not used AI

You can read more details in our Responsible AI Policy

[github-actions]

This PR is a mix.lock and CHANGELOG.md change only — no application code touched. Bumps phoenix_live_view 1.0.18→1.0.19, postgrex 0.22.3→0.22.4, and castore 1.0.20→1.0.21 to clear mix deps.audit advisories. None of S0/S1/S2 apply.

Security Review ✅

• S0 (project scoping): N/A — no queries or web-layer entrypoints touched; changes are limited to mix.lock and CHANGELOG.md.
• S1 (authorization): N/A — no new controller/LiveView/context actions on project-scoped resources.
• S2 (audit trail): N/A — no writes to config resources (workflows, credentials, project settings, etc.).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release-2.18.0@8dc1e3c). Learn more about missing BASE report.

Additional details and impacted files

@@               Coverage Diff                @@
##             release-2.18.0   #5066   +/-   ##
================================================
  Coverage                  ?   90.6%           
================================================
  Files                     ?     422           
  Lines                     ?   20032           
  Branches                  ?       0           
================================================
  Hits                      ?   18159           
  Misses                    ?    1873           
  Partials                  ?       0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.