Bump the patch-updates group across 1 directory with 3 updates

[dependabot]

Bumps the patch-updates group with 3 updates in the / directory: lazy_html, phoenix_live_view and postgrex.

Updates lazy_html from 0.1.11 to 0.1.12

Release notes

Sourced from lazy_html's releases.

v0.1.12

Changed

• Relaxed elixir_make requirement (#35)

Changelog

Sourced from lazy_html's changelog.

Commits

• f30bc5e Release v0.1.12
• 5e9e3ee Bump otp on ci (#39)
• fd02a1d Do not start elixir_make and fine at runtime (#36)
• bb64356 Relax elixir_make requirement to allow 0.10.0 (#35)
• e65f0cd Update version
• See full diff in compare view

Updates phoenix_live_view from 1.2.6 to 1.2.9

Release notes

Sourced from phoenix_live_view's releases.

v1.2.9

Security fixes

• CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR

Bug fixes

• Fix live components being wrongly destroyed in some rare cases (#4350)
• Ensure parent navigation succeeds with a blocked child (#4359)

Enhancements

• Add internal debug tooling to customize clientside rendering (#4364)

v1.2.8

Enhancements

• Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#4348)
• Allow opting focused form elements into DOM patching (#4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#4341)
• Fix detail.lock() promise in phx:push event never resolving (#4351)
• Fix live components not being correctly patched when changing their DOM ID (#4338)
• Gracefully handle missing upload refs (#4354)

v1.2.7

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.9 (2026-08-10)

Security fixes

• CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR

Bug fixes

• Fix live components being wrongly destroyed in some rare cases (#4350)
• Ensure parent navigation succeeds with a blocked child (#4359)

Enhancements

• Add internal debug tooling to customize clientside rendering (#4364)

v1.2.8 (2026-07-27)

Enhancements

• Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#4348)
• Allow opting focused form elements into DOM patching (#4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#4341)
• Fix detail.lock() promise in phx:push event never resolving (#4351)
• Fix live components not being correctly patched when changing their DOM ID (#4338)
• Gracefully handle missing upload refs (#4354)

v1.2.7 (2026-07-13)

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

Commits

• 6bd7b84 Release v1.2.9
• 2068b30 expand invalid local url chars
• 491ed72 Update assets
• c230032 Rendered debug buffer (#4364)
• fb29f55 Use entry.done? in UploadConfig.uploaded_entries/1 (#4366)
• c8104d8 Simplify upload reference filtering (#4363)
• 6ba6f4e Update assets
• b100e10 Ensure parent navigation succeeds with a blocked child (#4361)
• 01b8517 Force a full render for components marked for deletion (#4357)
• b97790b Update assets
• Additional commits viewable in compare view

Updates postgrex from 0.22.3 to 0.22.4

Changelog

Sourced from postgrex's changelog.

v0.22.4 (2026-08-07)

• Security
  • Escape comments on Postgrex.stream/4 (CVE-2026-66838)

Commits

• 7a12d0b Release v0.22.4
• 4011be8 Reject invalid comments on streams
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions