[johnnyt]

Moves the one decimal line of mix.lock from 3.1.1 to 3.2.0.

Why

3.1.1 is in the range of a published advisory on Decimal.round/3 (an unbounded allocation driven by the places argument). mix deps.get printed it as vulnerable before the move and prints nothing about advisories after; mix hex.audit now reports no retired or security advisory packages.

What moves

• mix.lock: the decimal line only (git diff --stat: one line changed). mix deps.update decimal moved nothing else.
• This is a dev lock move with no requirement change. The edge is dev-only: doctor (only: :dev) requires decimal "~> 3.1", jason lists it as optional, and mix.exs names no decimal requirement. 3.2.0 satisfies all of them.
• A library's lock is not what a host resolves, so no consumer of the package sees a difference.

Changelog

No fragment. changelog.d/README.md is silent on lock-only moves; its test (could someone who only calls the public API tell the difference?) answers no, since no code, requirement or runtime dependency changes.

Verification

• Full mix quality green on the branch: tests 1,214 of 1,214 passed, dialyzer, credo, doctor and docs clean.
• Acceptance: decimal resolves to a version with no published advisory; only the decimal lock line moves; the full gate is green.

Provenance

Version choice (3.2.0, the one lock line) decided by the conductor under a standing consent, 2026-10-19.

Refs: sui-nwkz