chore: update phoenix_pubsub to 2.3.0 in mix.lock

[devin-ai-integration]

Summary

Refreshes the committed mix.lock to the latest versions allowed by the existing mix.exs constraints; only phoenix_pubsub had a newer release.

• phoenix_pubsub 2.2.0 → 2.3.0 (transitive, only lock entry that moved on mix deps.update --all)
• No mix.exs changes: launchdarkly_server_sdk ~> 3.0 already locks the latest 3.11.2, and every other dep is already at latest-within-constraint
• No deprecated API usage; mix compile --warnings-as-errors is clean
• Verified by running the app against the hello-apps environment with a real server SDK key

Implementation details

Built and run in docker run elixir:1.17-otp-26 (no Elixir on the test machine):

• mix deps.update --all → single lock change (phoenix_pubsub 2.3.0)
• mix compile --warnings-as-errors → clean
• mix test → 3 tests, 0 failures
• LD_SDK_KEY=<hello-apps server key> mix phx.server → streaming connection established, /hello-launchdarkly/Joe renders (screenshot above)

Notes / not fixed here:

• The hello-apps environment has no alternate.page flag (only hello-boolean), so the SDK logs Unknown feature flag "alternate.page"; returning default value and the page shows the default (non-alternate) variation. This is an environment-data gap, not a code issue.
• mix deps.get reports security advisories for cowlib 2.19.0 and gun 2.5.0, both pulled in transitively via shotgun ← launchdarkly_server_sdk. No fixed releases exist within the allowed ranges, so nothing to change repo-side.
• mix format cannot run in this repo (.formatter.exs imports :ecto, which is not a dependency); pre-existing.

Link to Devin session: https://app.devin.ai/sessions/10d6310decae4a1092f0aa85b16d9af4
Open in Devin Desktop: https://app.devin.ai/desktop/session/10d6310decae4a1092f0aa85b16d9af4?variant=devin

---

Note

Overview
Updates mix.lock only: phoenix_pubsub 2.2.0 → 2.3.0 (checksum and lock metadata updated). There are no mix.exs or application code changes—this is the resolved version Phoenix already allows via ~> 2.1.

This is a routine transitive dependency refresh (e.g. after mix deps.update --all); behavior should stay the same aside from whatever fixes ship in 2.3.0.

^{Reviewed by Cursor Bugbot for commit 8136414. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@cursor review