- Lower Elixir floor to ~> 1.18.
- flatbuf from Hex (~> 0.1.0) instead of the GitHub dep; still dev-only
  + runtime: false, so unchanged for consumers.
- mix deps.update --all; notably req 0.5.17 -> 0.6.2 (clears the
  decompression-bomb advisory).