Bump phoenix_live_view from 1.2.5 to 1.2.8

[dependabot]

Bumps phoenix_live_view from 1.2.5 to 1.2.8.

Release notes

Sourced from phoenix_live_view's releases.

v1.2.8

Enhancements

• Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#4348)
• Allow opting focused form elements into DOM patching (#4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#4341)
• Fix detail.lock() promise in phx:push event never resolving (#4351)
• Fix live components not being correctly patched when changing their DOM ID (#4338)
• Gracefully handle missing upload refs (#4354)

v1.2.7

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6

Bug fixes

• Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#4321)

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.8 (2026-07-27)

Enhancements

• Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#4348)
• Allow opting focused form elements into DOM patching (#4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#4341)
• Fix detail.lock() promise in phx:push event never resolving (#4351)
• Fix live components not being correctly patched when changing their DOM ID (#4338)
• Gracefully handle missing upload refs (#4354)

v1.2.7 (2026-07-13)

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6 (2026-07-07)

Bug fixes

• Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#4321)

Commits

• 41b9a2c temporarily allow all git
• 883b9f6 fix npm publish
• 5ee5d49 Release v1.2.8
• d46d8d3 Update assets
• 6b77658 Allow cancelling client-side live navigation (#4332)
• c7cb976 Update assets
• 33a800d Namespace diagnostics (#4344)
• 58071f0 Skip unknown upload refs in form events so the LiveView channel survives (#4354)
• c837809 Update assets
• 15a0271 Handle keyed root when patching live components (#4338)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[nelsonic]

Thanks @dependabot 🤖📕👌