What should Elixir & Phoenix teams do about it?

Review your codebase for String.to_atom/1 calls and replace with String.to_existing_atom/2 before next deploy • Update phoenix_live_view to v1.2.3 if using TypeScript • Configure Ecto non-writable field behavior in your repos to catch silent failures

Which Elixir & Phoenix repositories shipped on June 17, 2026?

elixir-lang/elixir, phoenixframework/phoenix_live_view, phoenixframework/phoenix, elixir-ecto/ecto

ELIXIR TIGHTENS ATOM SAFETY WITH NEW VALIDATION FUNCTIONS

By RepoJournal · Filed 06:05 UTC on June 17, 2026 · About Elixir & Phoenix

Elixir core shipped three complementary functions that finally give you safe, typed ways to convert strings and lists to atoms without opening yourself to DoS attacks.

The biggest story across the stack is the soft-deprecation of String.to_atom/1 and the arrival of three new functions designed to close the atom safety hole [1] [2]. String.to_existing_atom/2 validates against a list of allowed atoms and compiles down to pattern matching when that list is static, making it faster than the old unsafe path [2]. List.to_existing_atom/2 does the same for lists [3], and to_unsafe_atom/1 replaces the dangerous old to_atom/1 when you genuinely need it [1]. The type system now narrows return types properly, so you get `:foo | :bar` instead of `:atom`, which catches more bugs at compile time. This is production-ready and you should audit your codebase for to_atom/1 calls immediately. On the Phoenix side, LiveView v1.2.3 shipped a quick fix for TypeScript declaration files being in the wrong folder [4] [5], and the core team documented module requirements for custom JSON libraries [6]. Ecto added configurable warnings and exceptions for writes to non-writable fields [7], letting you catch silent failures that masquerade as successful updates. Dependencies are stable: Babel bumped to 7.29.6 [8] and markdown-it to 14.2.0 [9].

FAQ

What changed in Elixir & Phoenix on June 17, 2026?: Elixir core shipped three complementary functions that finally give you safe, typed ways to convert strings and lists to atoms without opening yourself to DoS attacks.
What should Elixir & Phoenix teams do about it?: Review your codebase for String.to_atom/1 calls and replace with String.to_existing_atom/2 before next deploy • Update phoenix_live_view to v1.2.3 if using TypeScript • Configure Ecto non-writable field behavior in your repos to catch silent failures
Which Elixir & Phoenix repositories shipped on June 17, 2026?: elixir-lang/elixir, phoenixframework/phoenix_live_view, phoenixframework/phoenix, elixir-ecto/ecto

ELIXIR TIGHTENS ATOM SAFETY WITH NEW VALIDATION FUNCTIONS

The showcase is a teaser. Your wire is the product.

The showcase is a teaser.
Your wire is the product.