chore(deps): bump the mix-minor group across 1 directory with 5 updates

[dependabot]

Bumps the mix-minor group with 3 updates in the / directory: ex_machina, phoenix and phoenix_live_view.

Updates ex_machina from 2.8.0 to 2.8.2

Release notes

Sourced from ex_machina's releases.

v2.8.2

2.8.2 (2026-08-02)

Bug Fixes

• Support schemas with PolymorphicEmbed fields (#521) (8d58431)

v2.8.1

2.8.1 (2026-07-14)

Bug Fixes

• Unblock common-config sync, pinned actions-sync release had no build output (#560) (029d074)

Changelog

Sourced from ex_machina's changelog.

2.8.2 (2026-08-02)

Bug Fixes

• Support schemas with PolymorphicEmbed fields (#521) (8d58431)

2.8.1 (2026-07-14)

Bug Fixes

• Unblock common-config sync, pinned actions-sync release had no build output (#560) (029d074)

Commits

• 8dc7cf6 chore(main): release 2.8.2 (#567)
• 8d58431 fix: support schemas with PolymorphicEmbed fields (#521)
• f3e8e46 chore: sync files with beam-community/common-config (#566)
• 4d5c649 chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#565)
• bda9e97 chore(deps): bump postgrex from 0.22.2 to 0.22.3 in the dev group (#564)
• 5f39c8d chore(deps): bump ecto from 3.14.0 to 3.14.1 in the prod group (#563)
• b72f281 chore(main): release 2.8.1 (#561)
• 9352ea4 chore: sync files with beam-community/common-config (#562)
• 029d074 fix: unblock common-config sync, pinned actions-sync release had no build out...
• 09ac18a chore: sync files with beam-community/common-config (#551)
• Additional commits viewable in compare view

Updates phoenix from 1.8.8 to 1.8.12

Release notes

Sourced from phoenix's releases.

v1.8.12

Bug fixes

• [phx.gen.auth] Fix return_to session key not being cleared after logging in (#6798)
• [Channels] Fix channel messages being invalidly dropped when receiving messages without a join_ref (introduced in 1.8.3) (#6800)

v1.8.11

Bug fixes

• Fix Phoenix crashing on boot if Mix is available, but not started (#6789)

v1.8.10

Bug fixes

• [Phoenix.CodeReloader] Fix "must restart your server" messages from code reloader when compile.lock mtime changes without a content change (#6753)
• [Phoenix.Endpoint] add missing websocket options (#6758)
• [phoenix.js] Close and retry the longpoll transport when a batch POST times out (#6769)
• [phoenix.js] Release the stale reply binding of a buffered push (#6788)

Enhancements

• [phx.gen.release] Use Bob API to find Docker images in phx.gen.release --docker
• [Channels] Allow LongPoll transport token to be sent in header (this will change in 1.9)
• [Phoenix.Router] Support plugs with options in pipe_throught (#6755)
• [Phoenix.Token] document encode options (see the change in plug_crypto)
• [phoenix.js] Ensure transport errors are identifiable (#6763)

Changelog

Sourced from phoenix's changelog.

v1.8.12 (2026-08-20)

Bug fixes

• [phx.gen.auth] Fix return_to session key not being cleared after logging in (#6798)
• [Channels] Fix channel messages being invalidly dropped when receiving messages without a join_ref (introduced in 1.8.3) (#6800)

v1.8.11 (2026-08-12)

Bug fixes

• Fix Phoenix crashing on boot if Mix is available, but not started (#6789)

v1.8.10 (2026-08-10)

Bug fixes

• [Phoenix.CodeReloader] Fix "must restart your server" messages from code reloader when compile.lock mtime changes without a content change (#6753)
• [Phoenix.Endpoint] add missing websocket options (#6758)
• [phoenix.js] Close and retry the longpoll transport when a batch POST times out (#6769)
• [phoenix.js] Release the stale reply binding of a buffered push (#6788)

Enhancements

• [phx.gen.release] Use Bob API to find Docker images in phx.gen.release --docker
• [Channels] Allow LongPoll transport token to be sent in header (this will change in 1.9)
• [Phoenix.Router] Support plugs with options in pipe_throught (#6755)
• [Phoenix.Token] document encode options (see the change in plug_crypto)
• [phoenix.js] Ensure transport errors are identifiable (#6763)

v1.8.9 (2026-07-07)

Security fixes

• CVE-2026-56811: Add a max_channels_per_transport option (defaulting to 100) to prevent a single client from spawning an unbounded number of channels (processes), eventually exhausting the server's memory or process limit.
• CVE-2026-56812: Prevent presence keys from colliding with Object.prototype properties members, crashing the JS Presence client
• Enforce longpoll batch size introduced in 1.8.6. This is additional hardening against CVE-2026-32689. If your application sends events with a very high frequency and uses long polling, such that a single longpoll request would exceed 100 events, you should update to 1.8.7 first.

Commits

• a27a032 Release v1.8.12
• 11e30af Clear :return_to session key after logging in (#6799)
• a2bda2d join_ref can be nil on non-join messages (#6800)
• ce109c9 Fix release date for v1.8.11 (#6795)
• 7e9fb23 update deps
• 3765e81 Add markdown formatter to docs output (#6794)
• a986654 Release v1.8.11
• 51121f3 fix starting phoenix with mix available but not started (#6790)
• 109aacd Release v1.8.10
• c6c1761 Update assets
• Additional commits viewable in compare view

Updates phoenix_live_view from 1.0.18 to 1.0.19

Changelog

Sourced from phoenix_live_view's changelog.

1.0.19 (2026-08-10)

Security fixes

• CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR

Commits

• d8584e1 Release v1.0.19
• 0b8c733 expand invalid local url chars
• e79ef30 amend changelog
• See full diff in compare view

Updates plug_cowboy from 2.8.1 to 2.9.0

Changelog

Sourced from plug_cowboy's changelog.

v2.9.0

Enhancements

• Implement get_sock_data from Plug
• Require Plug v1.18+

Commits

• 74dab49 Release v2.9.0
• 45b941f Implement get_sock_data (#115)
• 0ef2cc9 CI housekeeping (#114)
• See full diff in compare view

Updates postgrex from 0.19.3 to 0.22.4

Changelog

Sourced from postgrex's changelog.

v0.22.4 (2026-08-07)

• Security
  • Escape comments on Postgrex.stream/4 (CVE-2026-66838)

v0.22.3 (2026-07-09)

• Security
  • Escape dollar signs in channel names in Postgrex.Notifications.listen/3 (CVE-2026-58225)

v0.22.2 (2026-05-12)

• Security
  • Escape quotes in channel names in Postgrex.Notifications.listen/3 (CVE-2026-32687)

v0.22.1 (2026-03-05)

• Enhancements

  • Relax decimal requirement
  • Set process labels in Postgrex processes

• Bug fixes

  • Return proper error when getting tcp closed after fatal errors

v0.22.0 (2026-01-10)

• Enhancements
  • Automatically retry when a connection disconnects on first read/write
  • Make timeouts for TypeServer configurable
  • Require Elixir v1.15+

v0.21.1 (2025-08-03)

• Bug fixes
  • Fix ssl: true with missing ssl_opts handling

v0.21.0 (2025-07-31)

This release requires Erlang/OTP 25+

• Enhancements

  • Add query timeout option on ReplicationConnection

• Bug fixes

  • PGHOST option does not override explicitly given endpoint configuration
  • Add ltxtquery support

v0.20.0 (2025-02-05)

• Deprecations

... (truncated)

Commits

• 7a12d0b Release v0.22.4
• 4011be8 Reject invalid comments on streams
• 797d395 Release v0.22.3
• f1ffdb5 Release v0.22.2
• 7cdedbd Escape quotes, check null bytes, and name length for channel names
• f78f401 Release v0.22.1
• 03717e9 Add multirange to sidebar section
• 0f92ae3 Return proper error when getting tcp closed after fatal errors (#765)
• 3385a98 Set some process labels (#764)
• e4f7942 Simplify decode simple handling to avoid unused clauses
• Additional commits viewable in compare view