Update vulnerable MDEx

  mdex 0.13.1 VULNERABLE!
    EEF-CVE-2026-53426 (HIGH)
    aka: CVE-2026-53426, GHSA-923r-7vf4-5vw8
    Atom-table exhaustion denial-of-service via JSON parse_document in MDEx
    https://osv.dev/vulnerability/EEF-CVE-2026-53426

    EEF-CVE-2026-54889 (MEDIUM)
    aka: CVE-2026-54889, GHSA-4383-7xfp-gpph
    Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)
    https://osv.dev/vulnerability/EEF-CVE-2026-54889
  mdex_native 0.2.2 VULNERABLE!
    EEF-CVE-2026-53429 (MEDIUM)
    aka: CVE-2026-53429, GHSA-cmvp-gp9f-23xw
    Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service
    https://osv.dev/vulnerability/EEF-CVE-2026-53429

    EEF-CVE-2026-53428 (MEDIUM)
    aka: CVE-2026-53428, GHSA-j93q-9cvj-rxfm
    Unbounded memory allocation in highlight_lines range expansion in mdex
    https://osv.dev/vulnerability/EEF-CVE-2026-53428

    EEF-CVE-2026-53427 (LOW)
    aka: CVE-2026-53427, GHSA-v664-pmxr-mxxx
    Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute
    https://osv.dev/vulnerability/EEF-CVE-2026-53427

    EEF-CVE-2026-54888 (MEDIUM)
    aka: CVE-2026-54888, GHSA-3w4f-53g2-f66p
    Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex
    https://osv.dev/vulnerability/EEF-CVE-2026-54888

Start by locating the dependency declarations for mdex and mdex_native, then consult the linked OSV advisories for patched versions. Update both dependencies to non-vulnerable releases and run the repository's existing test suite; done means the vulnerable versions are no longer used and tests pass.