Following a brief chat with @aweiker in the #erlang graphql slack channel, it was suggested that adding an or condition would make the graphql plug compatible with newer versions of poison without conflicting with existing phoenix versions.
The maximum version in the mixfile was updated but the lockfile was left deliberately unchanged.