chore(deps): bump the production-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the production-dependencies group with 3 updates in the / directory: ash, phoenix and phoenix_live_view.

Updates ash from 3.27.7 to 3.29.3

Release notes

Sourced from ash's releases.

v3.29.3

Bug Fixes:

• scrub private arguments w/ string values by @​zachdaniel

v3.29.0

Features:

• add Ash.update_many/4 by Zach Daniel

Bug Fixes:

• look up field policies by calc_name when authorizing calculation sorts (#2754) by Jesse Williams [(#2754)](ash-project/ash#2754)

• ensure modules are loaded before optional callback checks (#2753) by Vasilis Spilka

• relate_actor with field: raises BadMapError for belongs_to (#2751) by diogomrts [(#2751)](ash-project/ash#2751)

Improvements:

• set upsert_action metadata in ETS and Mnesia by Zach Daniel

• allow partial identity join sorting (#2746) by Jechol Lee [(#2746)](ash-project/ash#2746)

• Make attribute_in delegate to one_of (#1713) (#2748) by nashjar000 [(#2748)](ash-project/ash#2748)

• Prompt to add use Ash.Domain when module exists but is not a domain (#2744) by gixtrem [(#2744)](ash-project/ash#2744)

Changelog

Sourced from ash's changelog.

v3.29.3 (2026-06-23)

Bug Fixes:

• scrub private arguments w/ string values by @​zachdaniel

Fixes CVE-2026-55736

v3.29.2 (2026-06-22)

Bug Fixes:

• properly retain override messages on list of errors by @​zachdaniel

• narrow input/2 spec to no_return for resources without actions (#2758) by diogomrts [(#2758)](ash-project/ash#2758)

• respect actor from scope: in bulk actions under require_actor? (#2757) by @​emadshaaban92 [(#2757)](ash-project/ash#2757)

• support uuidv7 generation when Ecto isn't started by @​zachdaniel

• ensure calc context is added to m2m through query by @​zachdaniel

Improvements:

• add explanatory comment on backwards compat config by @​zachdaniel

v3.29.1 (2026-06-14)

Bug Fixes:

• handle all hook types in update_many by @​zachdaniel

• require primary keys explicitly as update_many targets by @​zachdaniel

v3.29.0 (2026-06-14)

Features:

... (truncated)

Commits

• 1ae2cad chore: release version v3.29.3
• d9b3100 fix: scrub private arguments w/ string values
• d83c2e2 chore: update docs
• 451d648 chore: release version v3.29.2
• e52296e fix: properly retain override messages on list of errors
• 1cb230b fix: narrow input/2 spec to no_return for resources without actions (#2758)
• c2fb4f9 fix: respect actor from scope: in bulk actions under require_actor? (#2757)
• 6b2e8a5 fix: support uuidv7 generation when Ecto isn't started
• aaf10db fix: ensure calc context is added to m2m through query
• 2d5e9ed improvement: add explanatory comment on backwards compat config
• Additional commits viewable in compare view

Updates igniter from 0.8.1 to 0.8.2

Release notes

Sourced from igniter's releases.

v0.8.2

Bug Fixes:

• handle empty list in configures_key by Zach Daniel

Improvements:

• Add scoped configure/6 options for runtime env blocks (#385) by RhettPoole

• Send issue output to stderr (#384) by daphnerosepurcell

• allow remapping modules to their file locations w/ regexes (#378) by aheiner2001

• add --except to igniter.upgrade --all (#383) by febarnett3

• intercept --help for igniter.new and other tasks. (#382) by CaydenLords

Changelog

Sourced from igniter's changelog.

v0.8.2 (2026-06-24)

Bug Fixes:

• handle empty list in configures_key by Zach Daniel

Improvements:

• Add scoped configure/6 options for runtime env blocks (#385) by RhettPoole

• Send issue output to stderr (#384) by daphnerosepurcell

• allow remapping modules to their file locations w/ regexes (#378) by aheiner2001

• add --except to igniter.upgrade --all (#383) by febarnett3

• intercept --help for igniter.new and other tasks. (#382) by CaydenLords

Commits

• 0625839 chore: release version v0.8.2
• 021a000 fix: handle empty list in configures_key
• c2a3521 chore: fix test ordering issue
• a060158 chore: format
• 168f64f improvement: Add scoped configure/6 options for runtime env blocks (#385)
• 200d237 improvement: Send issue output to stderr (#384)
• 549e01c improvement: allow remapping modules to their file locations w/ regexes (#378)
• bc3edcd improvement: add --except to igniter.upgrade --all (#383)
• caa4134 improvement: intercept --help for igniter.new and other tasks. (#382)
• b7fb1fc build(deps): bump the production-dependencies group across 1 directory with 4...
• Additional commits viewable in compare view

Updates phoenix from 1.8.7 to 1.8.8

Changelog

Sourced from phoenix's changelog.

1.8.8 (2026-06-10)

Enhancements

• [phx.new] Use LiveView 1.2.0

Commits

• 99df0a9 Release v1.8.8
• 729f781 Generator changes for LiveView 1.2 (#6696)
• d453e37 Use Elixir's builtin consolidation from v1.19, closes #4951
• f30fa36 Clarify channel payloads can be any serializable value (#6695)
• e1e7912 Replace all hexdocs URLs with the subdomain format (#6693)
• cf9dd26 Add README template for Phoenix umbrella (#6691)
• 39eb5dd Refactor template override backward compatibility test (#6684)
• e1c3816 chore: small typo fix in controllers.md (#6689)
• b6a4e31 Make websocket disconnect codes explicit (#6678)
• eea4895 Add eex suffix to phx.gen.auth template override test (#6680)
• Additional commits viewable in compare view

Updates phoenix_live_view from 1.1.31 to 1.2.5

Release notes

Sourced from phoenix_live_view's releases.

v1.2.5

Enhancements

• Ensure Phoenix.LiveView.TagEngine's EEx.Engine deprecation warning includes file and line information
• Ensure a failing custom UploadWriter does not crash the LiveView process (#4320)

v1.2.4

Bug fixes

• Only warn about missing form ID when recovery actually applies (#4315)
• Add common img attributes to live_img_preview/1 that were missing after cleaning the global attribute list in 1.2.0 (#4316)
• Fix colocated CSS attributes being dropped if using colocated JS in the same component (#4319)

v1.2.3

This is a followup release to v1.2.2 that fixes the TypeScript declaration files being in the wrong subfolder. Again, it does not contain any changes to the Elixir or JavaScript code itself.

v1.2.2

This release fixes the npm package missing the TypeScript declaration files. It does not contain any changes to the Elixir or JavaScript code itself, except small documentation improvements.

v1.2.1

Bug fixes

• Fix stale events from the previous LiveView being sent to the new LiveView after a live redirect (#4291)

v1.2.0

Enhancements

• Support events pushed when connected mount redirects (#4269)

Bug fixes

• Ensure for comprehensions in HEEx use deterministic variables
• Ensure connect_params are kept when following redirects in LiveViewTest (#4005)
• Ensure exceptions during LiveComponent renders are emitted as :telemetry event (#4258)
• Fix whitespace handling of EEx nodes in HEEx compiler (#4277)

v1.2.0-rc.3

Enhancements

• Add official documentation for the JavaScript client
• Validate URL scheme in push_patch / push_navigate, JS.patch / JS.navigate, and clientside js().patch / js().navigate (#4250)

... (truncated)

Changelog

Sourced from phoenix_live_view's changelog.

v1.2.5 (2026-06-30)

Enhancements

• Ensure Phoenix.LiveView.TagEngine's EEx.Engine deprecation warning includes file and line information
• Ensure a failing custom UploadWriter does not crash the LiveView process (#4320)

v1.2.4 (2026-06-29)

Bug fixes

• Only warn about missing form ID when recovery actually applies (#4315)
• Add common img attributes to live_img_preview/1 that were missing after cleaning the global attribute list in 1.2.0 (#4316)
• Fix colocated CSS attributes being dropped if using colocated JS in the same component (#4319)

v1.2.3 (2026-06-12)

This is a followup release to v1.2.2 that fixes the TypeScript declaration files being in the wrong subfolder. Again, it does not contain any changes to the Elixir or JavaScript code itself.

v1.2.2 (2026-06-12)

This release fixes the npm package missing the TypeScript declaration files. It does not contain any changes to the Elixir or JavaScript code itself, except small documentation improvements.

v1.2.1 (2026-06-11)

Bug fixes

• Fix stale events from the previous LiveView being sent to the new LiveView after a live redirect (#4291)

v1.2.0 (2026-06-10) 🚀

Enhancements

• Support events pushed when connected mount redirects (#4269)

Bug fixes

• Ensure for comprehensions in HEEx use deterministic variables
• Ensure connect_params are kept when following redirects in LiveViewTest (#4005)
• Ensure exceptions during LiveComponent renders are emitted as :telemetry event (#4258)
• Fix whitespace handling of EEx nodes in HEEx compiler (#4277)

v1.2.0-rc.3 (2026-05-29)

Enhancements

• Add official documentation for the JavaScript client
• Validate URL scheme in push_patch / push_navigate, JS.patch / JS.navigate, and clientside js().patch / js().navigate (#4250)

... (truncated)

Commits

• 2c33b9e Release v1.2.5
• d4a019e Stop upload channel with {:shutdown, :closed} on writer error so the LiveView...
• 9e445c8 improve TagEngine EEx.Engine deprecation warning
• 6c2dc63 Release v1.2.4
• d4b8703 fix: don't drop directives with multiple macro components (#4319)
• 0735009 allow common image attributes on live_img_preview
• 05e4ec0 LiveViewTest: only warn about missing form id when recovery applies (#4315)
• a02c571 docs: improved explanation of .form usage in Form Bindings guide (#4300)
• b52509a docs: clarified ideas in External Uploads guide (#4299)
• 28af5e7 slightly adjust binding guide
• Additional commits viewable in compare view

Updates spark from 2.7.0 to 2.7.2

Release notes

Sourced from spark's releases.

v2.7.1

Bug Fixes:

• fix elixir 1.20 warning by Zach Daniel

• resolve Elixir 1.20 compilation warnings (#278) by Gilbert

Changelog

Sourced from spark's changelog.

v2.7.2 (2026-06-07)

Bug Fixes:

• revert pmap introduction (#282) by nxy7

v2.7.1 (2026-06-05)

Bug Fixes:

• fix elixir 1.20 warning by Zach Daniel

• resolve Elixir 1.20 compilation warnings (#278) by Gilbert

Commits

• 5c28073 chore: release version v2.7.2
• 60985df fix: revert pmap introduction (#282)
• 614e6cf chore: release version v2.7.1
• b6da465 fix: fix elixir 1.20 warning
• 35bd143 chore(deps): bump igniter from 0.7.9 to 0.8.1 (#281)
• 33338cd chore(deps): bump jason from 1.4.4 to 1.4.5 (#280)
• e7ff5cd chore(deps-dev): bump ex_doc from 0.40.1 to 0.40.3 (#279)
• 334a1ff fix: resolve Elixir 1.20 compilation warnings (#278)
• See full diff in compare view