chore(deps): bump the mix-minor group across 1 directory with 4 updates

[dependabot]

Bumps the mix-minor group with 2 updates in the / directory: ex_machina and phoenix.

Updates ex_machina from 2.8.0 to 2.8.1

Release notes

Sourced from ex_machina's releases.

v2.8.1

2.8.1 (2026-07-14)

Bug Fixes

• Unblock common-config sync, pinned actions-sync release had no build output (#560) (029d074)

Changelog

Sourced from ex_machina's changelog.

2.8.1 (2026-07-14)

Bug Fixes

• Unblock common-config sync, pinned actions-sync release had no build output (#560) (029d074)

Commits

• b72f281 chore(main): release 2.8.1 (#561)
• 9352ea4 chore: sync files with beam-community/common-config (#562)
• 029d074 fix: unblock common-config sync, pinned actions-sync release had no build out...
• 09ac18a chore: sync files with beam-community/common-config (#551)
• f8b8bb7 chore(deps): bump erlef/setup-beam from 1.24.0 to 1.24.1 (#559)
• a530b5d chore(deps): bump erlef/setup-beam from 1 to 1.24.0 (#558)
• 9fba371 chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#557)
• 6a1aa9c chore(deps): bump credo from 1.7.18 to 1.7.19 in the dev group (#555)
• 7386691 chore(deps): bump ex_doc from 0.40.2 to 0.40.3 in the dev group (#554)
• 6db1db8 chore(deps): bump ecto_sql from 3.13.5 to 3.14.0 in the prod group (#553)
• Additional commits viewable in compare view

Updates phoenix from 1.8.8 to 1.8.9

Changelog

Sourced from phoenix's changelog.

1.8.9 (2026-07-07)

Security fixes

• CVE-2026-56811: Add a max_channels_per_transport option (defaulting to 100) to prevent a single client from spawning an unbounded number of channels (processes), eventually exhausting the server's memory or process limit.
• CVE-2026-56812: Prevent presence keys from colliding with Object.prototype properties members, crashing the JS Presence client
• Enforce longpoll batch size introduced in 1.8.6. This is additional hardening against CVE-2026-32689. If your application sends events with a very high frequency and uses long polling, such that a single longpoll request would exceed 100 events, you should update to 1.8.7 first.

Commits

• 734c8d1 Release v1.8.9
• beffc4d fix presence keys colliding with object prototype chain
• 16e295d Limit the number of channels a single transport process can join
• 211ff62 Allow authToken to be a function (#6751)
• 6cb2a83 Enforce longpoll batch size
• 5bf1ce6 Add missing test file
• 046accc Normalize route verb while grouping
• 21d1462 Group routes by verb during compilation (#6739)
• 9d3f1f6 phx.gen.release: Document new Bob Web UI (#6721)
• afcac09 Bump undici from 7.25.0 to 7.28.0 (#6736)
• Additional commits viewable in compare view

Updates plug_cowboy from 2.8.1 to 2.9.0

Changelog

Sourced from plug_cowboy's changelog.

v2.9.0

Enhancements

• Implement get_sock_data from Plug
• Require Plug v1.18+

Commits

• 74dab49 Release v2.9.0
• 45b941f Implement get_sock_data (#115)
• 0ef2cc9 CI housekeeping (#114)
• See full diff in compare view

Updates postgrex from 0.19.3 to 0.22.3

Changelog

Sourced from postgrex's changelog.

v0.22.3 (2026-07-09)

• Security
  • Escape dollar signs in channel names in Postgrex.Notifications.listen/3 (CVE-2026-58225)

v0.22.2 (2026-05-12)

• Security
  • Escape quotes in channel names in Postgrex.Notifications.listen/3 (CVE-2026-32687)

v0.22.1 (2026-03-05)

• Enhancements

  • Relax decimal requirement
  • Set process labels in Postgrex processes

• Bug fixes

  • Return proper error when getting tcp closed after fatal errors

v0.22.0 (2026-01-10)

• Enhancements
  • Automatically retry when a connection disconnects on first read/write
  • Make timeouts for TypeServer configurable
  • Require Elixir v1.15+

v0.21.1 (2025-08-03)

• Bug fixes
  • Fix ssl: true with missing ssl_opts handling

v0.21.0 (2025-07-31)

This release requires Erlang/OTP 25+

• Enhancements

  • Add query timeout option on ReplicationConnection

• Bug fixes

  • PGHOST option does not override explicitly given endpoint configuration
  • Add ltxtquery support

v0.20.0 (2025-02-05)

• Deprecations

  • Deprecate :search_path and use :parameters option instead

• Bug fixes

  • Ensure Duration type returns same units as Postgrex.Interval
  • Call disconnect on protocol when reconnecting in Postgrex.ReplicationConnection

... (truncated)

Commits

• 797d395 Release v0.22.3
• f1ffdb5 Release v0.22.2
• 7cdedbd Escape quotes, check null bytes, and name length for channel names
• f78f401 Release v0.22.1
• 03717e9 Add multirange to sidebar section
• 0f92ae3 Return proper error when getting tcp closed after fatal errors (#765)
• 3385a98 Set some process labels (#764)
• e4f7942 Simplify decode simple handling to avoid unused clauses
• df184a4 Release v0.22.0
• de38918 Add text query support (#761)
• Additional commits viewable in compare view