chore(deps): bump the production-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the production-dependencies group with 2 updates in the / directory: ash_phoenix and cinder.

Updates ash_phoenix from 2.3.23 to 2.3.24

Release notes

Sourced from ash_phoenix's releases.

v2.3.24

Bug Fixes:

• Rename Ash.Resource.record() -> Ash.Resource.Record.t() by @​jimsynz

Changelog

Sourced from ash_phoenix's changelog.

v2.3.24 (2026-07-08)

Bug Fixes:

• Rename Ash.Resource.record() -> Ash.Resource.Record.t() by @​jimsynz

Commits

• 0d0421c chore: release version v2.3.24
• 0d40671 fix: Rename Ash.Resource.record() -> Ash.Resource.Record.t()
• 54030e4 chore(deps): Update hpax, mint and phoenix because of CVEs
• 99c6526 chore: Fix reuse on macOS
• 6d119c3 chore(deps): Unlock libgraph
• a997152 chore(deps): bump the production-dependencies group across 1 directory with 5...
• 1eb145a chore(deps-dev): bump credo in the dev-dependencies group (#478)
• See full diff in compare view

Updates cinder from 0.15.0 to 0.16.0

Changelog

Sourced from cinder's changelog.

v0.16.0 (2026-07-15)

Breaking changes

• Removed the sort_asc_icon, sort_desc_icon, and sort_icon_class theme properties — list and grid layouts now render the same Heroicon sort indicators as the table (configured via sort_*_icon_name/sort_*_icon_class). See the upgrading guide for details.

Features

• Added item_class on <Cinder.collection> (and <Cinder.Table.table>) to set a per-row/item class: a string, or a fn item -> class end function evaluated per item, appended to the theme's row/item class.

Bugfixes

• *_nils_first/*_nils_last sort methods now render an icon in list and grid views.

Commits

• 3b1c868 Tag and release v0.16.0
• a692f35 Merge pull request #201 from sevenseacat/dependabot/hex/ash_phoenix-2.3.24
• 80301e7 Bump ash_phoenix from 2.3.23 to 2.3.24
• ddafd1c Merge pull request #200 from sevenseacat/dependabot/hex/phoenix_live_view-1.2.7
• 4b8d308 Merge pull request #195 from sevenseacat/dependabot/hex/ash-3.29.3
• a39db1c Bump phoenix_live_view from 1.2.6 to 1.2.7
• b288dae Bump ash from 3.29.2 to 3.29.3
• 3422e76 Merge pull request #199 from sevenseacat/dependabot/hex/phoenix_live_view-1.2.6
• 30180e6 Bump phoenix_live_view from 1.2.3 to 1.2.6
• 361f7d1 Merge pull request #193 from sevenseacat/dependabot/hex/ash-3.29.2
• Additional commits viewable in compare view

Updates phoenix_live_view from 1.2.5 to 1.2.8

Release notes

Sourced from phoenix_live_view's releases.

v1.2.8

Enhancements

• Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#4348)
• Allow opting focused form elements into DOM patching (#4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#4341)
• Fix detail.lock() promise in phx:push event never resolving (#4351)
• Fix live components not being correctly patched when changing their DOM ID (#4338)
• Gracefully handle missing upload refs (#4354)

v1.2.7

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6

Bug fixes

• Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#4321)

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.8 (2026-07-27)

Enhancements

• Allow cancelling client-side navigation (#4332) You can now listen for the phx:before-navigate event and call event.preventDefault() to cancel the navigation synchronously. This is mostly useful to prevent a "do you really want to leave" scenario when a user has unsaved changes, combined with a beforeunload listener.
• Sign LiveView upload tokens as :local to avoid node names being included in the token
• Ensure async tasks exit gracefully in LiveView tests (#4348)
• Allow opting focused form elements into DOM patching (#4339)

Bug fixes

• Fix server close handler not being reattached after a manual disconnect + connect (#4341)
• Fix detail.lock() promise in phx:push event never resolving (#4351)
• Fix live components not being correctly patched when changing their DOM ID (#4338)
• Gracefully handle missing upload refs (#4354)

v1.2.7 (2026-07-13)

Security fixes

• CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils

v1.2.6 (2026-07-07)

Bug fixes

• Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis (#4321)

Commits

• 41b9a2c temporarily allow all git
• 883b9f6 fix npm publish
• 5ee5d49 Release v1.2.8
• d46d8d3 Update assets
• 6b77658 Allow cancelling client-side live navigation (#4332)
• c7cb976 Update assets
• 33a800d Namespace diagnostics (#4344)
• 58071f0 Skip unknown upload refs in form events so the LiveView channel survives (#4354)
• c837809 Update assets
• 15a0271 Handle keyed root when patching live components (#4338)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions