Bump phoenix_live_view from 1.1.31 to 1.2.8

[dependabot]

Bumps phoenix_live_view from 1.1.31 to 1.2.8.

Release notes

Sourced from phoenix_live_view's releases.

v1.2.8

Enhancements

• Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#4348)
• Allow opting focused form elements into DOM patching (#4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#4341)
• Fix detail.lock() promise in phx:push event never resolving (#4351)
• Fix live components not being correctly patched when changing their DOM ID (#4338)
• Gracefully handle missing upload refs (#4354)

v1.2.7

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6

Bug fixes

• Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#4321)

v1.2.5

Enhancements

• Ensure Phoenix.LiveView.TagEngine's EEx.Engine deprecation warning includes file and line information
• Ensure a failing custom UploadWriter does not crash the LiveView process (#4320)

v1.2.4

Bug fixes

• Only warn about missing form ID when recovery actually applies (#4315)
• Add common img attributes to live_img_preview/1 that were missing after cleaning the global attribute list in 1.2.0 (#4316)
• Fix colocated CSS attributes being dropped if using colocated JS in the same component (#4319)

v1.2.3

This is a followup release to v1.2.2 that fixes the TypeScript declaration files being in the wrong subfolder. Again, it does not contain any changes to the Elixir or JavaScript code itself.

v1.2.2

... (truncated)

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.8 (2026-07-27)

Enhancements

• Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#4348)
• Allow opting focused form elements into DOM patching (#4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#4341)
• Fix detail.lock() promise in phx:push event never resolving (#4351)
• Fix live components not being correctly patched when changing their DOM ID (#4338)
• Gracefully handle missing upload refs (#4354)

v1.2.7 (2026-07-13)

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6 (2026-07-07)

Bug fixes

• Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#4321)

v1.2.5 (2026-06-30)

Enhancements

• Ensure Phoenix.LiveView.TagEngine's EEx.Engine deprecation warning includes file and line information
• Ensure a failing custom UploadWriter does not crash the LiveView process (#4320)

v1.2.4 (2026-06-29)

Bug fixes

• Only warn about missing form ID when recovery actually applies (#4315)
• Add common img attributes to live_img_preview/1 that were missing after cleaning the global attribute list in 1.2.0 (#4316)
• Fix colocated CSS attributes being dropped if using colocated JS in the same component (#4319)

v1.2.3 (2026-06-12)

This is a followup release to v1.2.2 that fixes the TypeScript declaration files being in the wrong subfolder. Again, it does not contain any changes to the Elixir or JavaScript code itself.

v1.2.2 (2026-06-12)

... (truncated)

Commits

• 41b9a2c temporarily allow all git
• 883b9f6 fix npm publish
• 5ee5d49 Release v1.2.8
• d46d8d3 Update assets
• 6b77658 Allow cancelling client-side live navigation (#4332)
• c7cb976 Update assets
• 33a800d Namespace diagnostics (#4344)
• 58071f0 Skip unknown upload refs in form events so the LiveView channel survives (#4354)
• c837809 Update assets
• 15a0271 Handle keyed root when patching live components (#4338)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)