chore: bump cowlib to 2.18.0 in mix.lock to fix security advisories

[devin-ai-integration]

Summary

The LaunchDarkly SDK itself needs no change: mix.exs declares {:ldclient, "~> 3.5", hex: :launchdarkly_server_sdk} and the committed mix.lock already resolves to 3.11.0, the latest 3.x on Hex.

The only real change is the committed lockfile pin of the transitive dep cowlib (via gun → shotgun → ldclient). mix deps.get reports cowlib 2.17.1 VULNERABLE!:

• EEF-CVE-2026-43966 (MEDIUM) — HTTP response splitting via non-VCHAR bytes in cow_http_struct_hd:escape_string/2
• EEF-CVE-2026-43969 (LOW) — cookie request header injection in cow_cookie:cookie/1

gun's constraint is >= 2.15.0 and < 3.0.0, so cowlib 2.18.0 is compatible; only the lockfile entry changes.

-"cowlib": {:hex, :cowlib, "2.17.1", ...},
+"cowlib": {:hex, :cowlib, "2.18.0", ...},

Verification

• mix deps.get → no advisories reported after the bump
• mix compile → clean, no warnings
• Ran the app against a real LD environment with a server-side SDK key (key from env, never committed):
  • streaming connect to https://stream.launchdarkly.com/all, Received event with 1 flags and 0 segments
  • :ldclient.all_flags_state/1 → %{flag_values: %{"hello-boolean" => true}}
  • LDApi.get(pid, "sample-feature", false, "example-user-key") → false (unknown flag, correct fallback)
• Deprecated APIs: none. :ldclient.variation/3, :ldclient_context.new/1, and :ldclient_config.tls_basic_options/0 are all current; no deprecated attributes in the SDK source.

Link to Devin session: https://app.devin.ai/sessions/28d8171e3c604b52b7fafcb96df102a4

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring