chore(deps): update phoenix, phoenix_live_view, bandit, and 6 others

[zorn]

Summary

Updates all nine outdated Hex dependencies — patch and minor bumps only, no direct major bumps. mix precommit passes clean (credo, format, 108 tests). Notable: bandit 1.12.5 carries two security advisory fixes for HTTP/2, and the transitive idna major bump (6 → 7) drops unicode_util_compat, which is removed from the lock.

Direct Dependencies

bandit 1.12.4 → 1.12.5
diff · changelog

• Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532w-jv94) (Bound and cancel HTTP/2 sends blocked on the connection window (GHSA-xj8g-532w-jv94) mtrudel/bandit#671)
• Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) (Validate HTTP/2 header field values for CR/LF/NUL (GHSA-x3gh-xhj4-3vq8) mtrudel/bandit#670)
• Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings (Honor Accept-Encoding q-values, the wildcard, and case-insensitive codings mtrudel/bandit#665)
• Reject send_file ranges past EOF instead of emitting a negative Content-Length (Reject send_file ranges past EOF instead of emitting a negative Content-Length mtrudel/bandit#653)
• Enforce the RFC9112 chunk-size grammar and reject repeated transfer-encoding (Enforce the RFC9112 chunk-size grammar and reject repeated transfer-encoding mtrudel/bandit#631)

dns_cluster 0.2.0 → 0.3.0
diff · changelog

• Support SRV cluster queries

html_sanitize_ex 1.5.4 → 1.5.5
diff · changelog

• Security fixes (see the package advisories)

phoenix 1.8.11 → 1.8.13
diff · changelog

• Workaround issue where Mobile Chrome 149+ would not reconnect after tab is resumed (WebSocket does not reconnect on Chrome 149 after switching apps on mobile phoenixframework/phoenix#6804)
• [Channels] Fix channel messages being invalidly dropped when receiving messages without a join_ref (introduced in 1.8.3) (join_ref can be nil on non-join messages phoenixframework/phoenix#6800)
• [phx.gen.auth] Fix return_to session key not being cleared after logging in (phx.gen.auth: :<schema>_return_to session key is never cleared after use phoenixframework/phoenix#6798)

phoenix_live_dashboard 0.9.0 → 0.9.1
diff · changelog

• Skip Ecto repos that cannot be resolved to an extras module

phoenix_live_view 1.2.9 → 1.2.11
diff · changelog

• Ensure stale diffs are discarded when view rejoins before the initial join succeeds (Tag pending diffs and discard outdated ones phoenixframework/phoenix_live_view#4405)
• Ensure a LiveComponent's async tasks are cancelled when it is removed (Cancel async tasks of components removed from the tree phoenixframework/phoenix_live_view#4401)
• Add Phoenix.LiveView.navigation_type/2 (Add Phoenix.LiveView.navigation_type/2 phoenixframework/phoenix_live_view#4393)
• Allow dynamically updating the phx-hook attribute (Allow dynamically updating phx-hook attribute phoenixframework/phoenix_live_view#4153)
• 1.2.10 also lands a large batch of file-upload and JS-interop fixes (auto-upload validation, max_entries handling, external upload cancellation on navigation)

req 0.7.2 → 0.7.4
diff · changelog

• put_params: allow explicit duplicate query params again (a 0.7.0 regression where servers requiring duplicates broke); otherwise still overwrites previously set params
• put_path_params: do not overwrite the redirect target

swoosh 1.27.0 → 1.28.0
diff · changelog

• Add TurboSMTP adapter (Add TurboSMTP adapter swoosh/swoosh#1190)

telemetry_metrics 1.1.0 → 1.2.0
diff · changelog

• Add support for functions in tags (supersedes tag_values)
• Assorted optimizations

Transitive Dependencies

idna 6.1.1 → 7.1.0 — diff · compare — no changelog found; major bump removes the unicode_util_compat dependency (hence its removal from the lock) and updates to Unicode 17.0.0 data, targeting OTP 27/28.

mochiweb 3.4.0 → 3.5.0 — diff · changelog — adds gzip/zstd chunked and one-shot response compression; switches to passive socket mode.

phoenix_pubsub 2.2.0 → 2.3.0 — diff · changelog — adds a :group_by Registry sharding option, a configurable default dispatcher, and a metadata-matching unsubscribe; fixes object deletion in tracker state.

unicode_util_compat 0.7.1 → removed — dropped as a dependency by the idna 7.x upgrade above.