build(deps): bump phoenix_live_view from 1.2.3 to 1.2.9 in the phoenix group across 1 directory

[dependabot]

Bumps the phoenix group with 1 update in the / directory: phoenix_live_view.

Updates phoenix_live_view from 1.2.3 to 1.2.9

Release notes

Sourced from phoenix_live_view's releases.

v1.2.9

Security fixes

• CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR

Bug fixes

• Fix live components being wrongly destroyed in some rare cases (#4350)
• Ensure parent navigation succeeds with a blocked child (#4359)

Enhancements

• Add internal debug tooling to customize clientside rendering (#4364)

v1.2.8

Enhancements

• Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#4348)
• Allow opting focused form elements into DOM patching (#4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#4341)
• Fix detail.lock() promise in phx:push event never resolving (#4351)
• Fix live components not being correctly patched when changing their DOM ID (#4338)
• Gracefully handle missing upload refs (#4354)

v1.2.7

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6

Bug fixes

• Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#4321)

v1.2.5

Enhancements

• Ensure Phoenix.LiveView.TagEngine's EEx.Engine deprecation warning includes file and line information
• Ensure a failing custom UploadWriter does not crash the LiveView process (#4320)

... (truncated)

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.9 (2026-08-10)

Security fixes

• CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR

Bug fixes

• Fix live components being wrongly destroyed in some rare cases (#4350)
• Ensure parent navigation succeeds with a blocked child (#4359)

Enhancements

• Add internal debug tooling to customize clientside rendering (#4364)

v1.2.8 (2026-07-27)

Enhancements

• Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#4348)
• Allow opting focused form elements into DOM patching (#4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#4341)
• Fix detail.lock() promise in phx:push event never resolving (#4351)
• Fix live components not being correctly patched when changing their DOM ID (#4338)
• Gracefully handle missing upload refs (#4354)

v1.2.7 (2026-07-13)

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6 (2026-07-07)

Bug fixes

• Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#4321)

v1.2.5 (2026-06-30)

Enhancements

• Ensure Phoenix.LiveView.TagEngine's EEx.Engine deprecation warning includes file and line information

... (truncated)

Commits

• 6bd7b84 Release v1.2.9
• 2068b30 expand invalid local url chars
• 491ed72 Update assets
• c230032 Rendered debug buffer (#4364)
• fb29f55 Use entry.done? in UploadConfig.uploaded_entries/1 (#4366)
• c8104d8 Simplify upload reference filtering (#4363)
• 6ba6f4e Update assets
• b100e10 Ensure parent navigation succeeds with a blocked child (#4361)
• 01b8517 Force a full render for components marked for deletion (#4357)
• b97790b Update assets
• Additional commits viewable in compare view

[maxekman]

/dependabot rebase