Who contributed to Elixir & Phoenix on June 17, 2026?

4 developers shipped this update, including sabiwara, saleyn, green-david, and dependabot[bot].

What were the notable Elixir & Phoenix updates?

Add to_unsafe_atom/1 and soft-deprecate to_atom/1, Add String.to_existing_atom/2 to validate against a list of allowed atoms, and Add List.to_existing_atom/2 to validate against a list of allowed atoms.

Elixir & Phoenix

Elixir, Phoenix, LiveView, and Ecto - the BEAM web stack

Pick a date

Topics: Elixir & Phoenix Full archive →

The Wire · Showcase

ELIXIR TIGHTENS ATOM SAFETY WITH NEW VALIDATION FUNCTIONS

By RepoJournal · Filed 06:05 UTC on June 17, 2026 · About Elixir & Phoenix

4 people shipped this

sabiwara @sabiwara 3 cited

dependabot[bot] @dependabot[bot] 2 cited

saleyn @saleyn 1 cited

green-david @green-david 1 cited

Elixir core shipped three complementary functions that finally give you safe, typed ways to convert strings and lists to atoms without opening yourself to DoS attacks.

The biggest story across the stack is the soft-deprecation of String.to_atom/1 and the arrival of three new functions designed to close the atom safety hole [1] [2]. String.to_existing_atom/2 validates against a list of allowed atoms and compiles down to pattern matching when that list is static, making it faster than the old unsafe path [2]. List.to_existing_atom/2 does the same for lists [3], and to_unsafe_atom/1 replaces the dangerous old to_atom/1 when you genuinely need it [1]. The type system now narrows return types properly, so you get `:foo | :bar` instead of `:atom`, which catches more bugs at compile time. This is production-ready and you should audit your codebase for to_atom/1 calls immediately. On the Phoenix side, LiveView v1.2.3 shipped a quick fix for TypeScript declaration files being in the wrong folder [4] [5], and the core team documented module requirements for custom JSON libraries [6]. Ecto added configurable warnings and exceptions for writes to non-writable fields [7], letting you catch silent failures that masquerade as successful updates. Dependencies are stable: Babel bumped to 7.29.6 [8] and markdown-it to 14.2.0 [9].

Action items

→ Review your codebase for String.to_atom/1 calls and replace with String.to_existing_atom/2 before next deploy elixir-lang/elixir [immediate]
→ Update phoenix_live_view to v1.2.3 if using TypeScript phoenixframework/phoenix_live_view [plan]
→ Configure Ecto non-writable field behavior in your repos to catch silent failures elixir-ecto/ecto [plan]

References

[1] Add to_unsafe_atom/1 and soft-deprecate to_atom/1 ↗ elixir-lang/elixir
[2] Add String.to_existing_atom/2 to validate against a list of allowed atoms ↗ elixir-lang/elixir
[3] Add List.to_existing_atom/2 to validate against a list of allowed atoms ↗ elixir-lang/elixir
[4] v1.2.3 ↗ phoenixframework/phoenix_live_view
[5] fix typescript declaration file path phoenixframework/phoenix_live_view
[6] Document module requirements for json_library() (see PR #6481) ↗ phoenixframework/phoenix
[7] Add ability to configure the behavior of writing to a non-writable field ↗ elixir-ecto/ecto
[8] Bump @babel/core from 7.27.4 to 7.29.6 ↗ phoenixframework/phoenix_live_view
[9] Bump markdown-it from 14.1.1 to 14.2.0 ↗ phoenixframework/phoenix_live_view

Quick answers

What shipped in Elixir & Phoenix on June 17, 2026?: Elixir core shipped three complementary functions that finally give you safe, typed ways to convert strings and lists to atoms without opening yourself to DoS attacks. In total, 15 commits, 15 pull requests, and 2 releases landed.
Who contributed to Elixir & Phoenix on June 17, 2026?: 4 developers shipped this update, including sabiwara, saleyn, green-david, and dependabot[bot].
What were the notable Elixir & Phoenix updates?: Add to_unsafe_atom/1 and soft-deprecate to_atom/1, Add String.to_existing_atom/2 to validate against a list of allowed atoms, and Add List.to_existing_atom/2 to validate against a list of allowed atoms.

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.

elixir 10 shipped 1-min read

Elixir & Phoenix 2 days ago

ELIXIR STRIPS REDUNDANT GUARDS, FIXES TUPLE PROJECTION BUG

Barna Kovacs landed three optimization PRs removing dead code from core Enum and Calendar modules, while a separate fix addresses a flawed tuple projection algorithm that was producing inconsistent type representations.

elixir 22 shipped 1-min read

Elixir & Phoenix 3 days ago

LIVEVIEW ASYNC CLEANUP FIX SHIPS ALONGSIDE RANGE OPTIMIZATIONS

Phoenix LiveView closes a critical async task test failure while Elixir cuts unnecessary abs calls from Range operations.

elixir 19 shipped 1-min read

Elixir & Phoenix 4 days ago

PHOENIX LIVE VIEW SEALS CRITICAL NODE NAME LEAK IN UPLOAD TOKENS

A reverted encryption fix exposes how Phoenix was leaking BEAM node identities through unencrypted upload tokens, and the core team is pivoting to a cleaner solution using term_to_binary.

elixir 23 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.