chore(deps): backport Phoenix security dependency refresh

[AyobamiH]

Summary

Backports the dependency-security maintenance from phoenixframework/phoenix#6784 ahead of the next upstream sync, then refreshes the affected dependency graph to current compatible patched releases.

This follows Phoenix's upstream dependency policy: public Phoenix dependency constraints remain unchanged. The only declared requirement change is in the internal integration-test project, where Bandit moves from ~> 1.0 to ~> 1.12 so the repository test graph cannot resolve affected Bandit releases.

Changed files are limited to:

• mix.lock
• integration_test/mix.exs
• integration_test/mix.lock

Security state

The root repository graph now resolves Bandit 1.12.5 and Cowlib 2.19.0.

The integration-test graph resolves Bandit 1.12.5, Postgrex 0.22.4, and Phoenix LiveView 1.2.10, plus only the compatible transitive changes required by Mix.

The integration-test graph passes mix hex.audit with no known advisories.

The root graph intentionally still reports exactly three Cowlib 2.19.0 advisories because there is currently no newer patched Cowlib release:

• EEF-CVE-2026-43966
• EEF-CVE-2026-43969
• EEF-CVE-2026-43971

Those advisories remain visible rather than being suppressed or described as fixed.

Verification

Final commit: 3db2aa589cd24a2668df0b22e336f4fbaecdc8b1

The final commit is signed, and its Git tree matches the independently validated tree exactly.

Phoenix native CI passed on the signed commit:

• mix test on Elixir/OTP 1.15.8/25.3.2.21
• mix test on Elixir/OTP 1.18.4/27.3.4.13
• mix test on Elixir/OTP 1.19.5/28.5.0.2
• latest-toolchain compile with warnings as errors
• installer tests on old and current supported toolchains
• mix_phx_new generator integration tests on both installer toolchains
• DB-backed integration tests on Elixir/OTP 1.17.3/25.3.2.21
• DB-backed integration tests on Elixir/OTP 1.19.5/28.3.3
• PostgreSQL, MySQL, and MSSQL integration services
• npm install, lint, and tests

Independent exact-tree validation additionally passed:

• TypeScript declaration build
• root and integration lockfile stability
• integration_test/mix.exs formatting
• exact Git-tree/blob provenance
• clean integration-test mix hex.audit
• root advisory boundary of exactly the three known Cowlib advisories above

[PragTob]

👋 Hi there,

thank you very much for your contribution! 💚

We're currently not running phoenix/realtime off of this fork (or well, we are but with the complete mainline code + one small patch on a branch). Hence, those updates aren't needed.

As the JS client is still needed I just made a sync that should include all the changes: #56

Hence, closing here. But still, thank you very much for your contribution!