chore(deps): bump phoenix_live_view from 1.2.7 to 1.2.9

[dependabot]

Bumps phoenix_live_view from 1.2.7 to 1.2.9.

Release notes

Sourced from phoenix_live_view's releases.

v1.2.9

Security fixes

• CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR

Bug fixes

• Fix live components being wrongly destroyed in some rare cases (#4350)
• Ensure parent navigation succeeds with a blocked child (#4359)

Enhancements

• Add internal debug tooling to customize clientside rendering (#4364)

v1.2.8

Enhancements

• Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#4348)
• Allow opting focused form elements into DOM patching (#4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#4341)
• Fix detail.lock() promise in phx:push event never resolving (#4351)
• Fix live components not being correctly patched when changing their DOM ID (#4338)
• Gracefully handle missing upload refs (#4354)

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.9 (2026-08-10)

Security fixes

• CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR

Bug fixes

• Fix live components being wrongly destroyed in some rare cases (#4350)
• Ensure parent navigation succeeds with a blocked child (#4359)

Enhancements

• Add internal debug tooling to customize clientside rendering (#4364)

v1.2.8 (2026-07-27)

Enhancements

• Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#4348)
• Allow opting focused form elements into DOM patching (#4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#4341)
• Fix detail.lock() promise in phx:push event never resolving (#4351)
• Fix live components not being correctly patched when changing their DOM ID (#4338)
• Gracefully handle missing upload refs (#4354)

Commits

• 6bd7b84 Release v1.2.9
• 2068b30 expand invalid local url chars
• 491ed72 Update assets
• c230032 Rendered debug buffer (#4364)
• fb29f55 Use entry.done? in UploadConfig.uploaded_entries/1 (#4366)
• c8104d8 Simplify upload reference filtering (#4363)
• 6ba6f4e Update assets
• b100e10 Ensure parent navigation succeeds with a blocked child (#4361)
• 01b8517 Force a full render for components marked for deletion (#4357)
• b97790b Update assets
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)