security version updates

[btihen]

• allow decimal 3.x
• remove outdated hackney
• address compiler warnings

Fixes

❯ mix deps.audit
         
Name: decimal
Version: 2.4.1
Lockfile: /Users/wti0405/devel/garaio/smart_invoice/mix.lock
URL: https://github.com/advisories/GHSA-rhv4-8758-jx7v
Title: Decimal: Unbounded exponent in `Decimal.new` enables unauthenticated DoS
Severity: moderate
Vulnerable versions: >= 0.1.0, < 3.0.0
First patched versions: 3.0.0

Vulnerabilities found!

[walter]

For anyone else that is in the boat of having security vulnerabilities in decimal that are stuck because number isn't maintained. Consider replacing your Number use with Cldr.Number, etc.

Cldr is pretty heavyweight, but it has a lot of stuff you probably want anyway. My project already uses it so it's a matter of moving the calls over to corresponding Cldr api and adjusting.

YMMV

[Ch4s3]

I've forked Number here https://github.com/Ch4s3/number_formatter and released it to hex https://hex.pm/packages/number_formatter/1.0.0