chore(deps): update dependency phoenix_live_view to v1.2.8

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
phoenix_live_view (source)	prod	minor	1.1.28 → 1.2.8

---

Release Notes

phoenixframework/phoenix_live_view (phoenix_live_view)

v1.2.8

Compare Source

Enhancements

• Allow cancelling client-side navigation (#​4332)
  You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously.
  This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#​4348)
• Allow opting focused form elements into DOM patching (#​4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#​4341)
• Fix detail.lock() promise in phx:push event never resolving (#​4351)
• Fix live components not being correctly patched when changing their DOM ID (#​4338)
• Gracefully handle missing upload refs (#​4354)

v1.2.7

Compare Source

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6

Compare Source

Bug fixes

• Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#​4321)

v1.2.5

Compare Source

Enhancements

• Ensure Phoenix.LiveView.TagEngine's EEx.Engine deprecation warning includes file and line information
• Ensure a failing custom UploadWriter does not crash the LiveView process (#​4320)

v1.2.4

Compare Source

Bug fixes

• Only warn about missing form ID when recovery actually applies (#​4315)
• Add common img attributes to live_img_preview/1 that were missing after cleaning the global attribute list in 1.2.0 (#​4316)
• Fix colocated CSS attributes being dropped if using colocated JS in the same component (#​4319)

v1.2.3

Compare Source

This is a followup release to v1.2.2 that fixes the TypeScript declaration files being in the wrong subfolder.
Again, it does not contain any changes to the Elixir or JavaScript code itself.

v1.2.2

Compare Source

This release fixes the npm package missing the TypeScript declaration files.
It does not contain any changes to the Elixir or JavaScript code itself, except small documentation improvements.

v1.2.1

Compare Source

Bug fixes

• Fix stale events from the previous LiveView being sent to the new LiveView after a live redirect (#​4291)

v1.2.0

Compare Source

Enhancements

• Support events pushed when connected mount redirects (#​4269)

Bug fixes

• Ensure for comprehensions in HEEx use deterministic variables
• Ensure connect_params are kept when following redirects in LiveViewTest (#​4005)
• Ensure exceptions during LiveComponent renders are emitted as :telemetry event (#​4258)
• Fix whitespace handling of EEx nodes in HEEx compiler (#​4277)

v1.1.32

Compare Source

Bug fixes

• Fix stale events from the previous LiveView being sent to the new LiveView after a live redirect (#​4291)

v1.1.31

Compare Source

Enhancements

• Validate URL scheme in push_patch / push_navigate, JS.patch / JS.navigate, and clientside js().patch / js().navigate (#​4250)

Bug fixes

• Fix nested assign change tracking (#​4225)
• Ensure Phoenix.LiveViewTest.live_redirect/2 properly passes the URI as a string in handle_params (#​4247)

v1.1.30

Compare Source

Bug fixes

• Ensure internal phx-viewport hook does not crash on update if no scroll container is used (#​4214), introduced in v1.1.29.

v1.1.29

Compare Source

Bug fixes

• Prevent JS crash when hook has a duplicate ID (#​4196)
• Recompute scroll container for phx-viewport bindings if it is no longer available (#​4169)
• Fix phx-viewport events not firing when container has horizontal overflow (#​3897)
• Handle locks on skipped nodes (#​4209)
• Use moveBefore if available when reordering stream elements (#​4212)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: mix.lock

Command failed: install-tool elixir v1.20.2