Who contributed to Elixir & Phoenix on June 17, 2026?

4 developers shipped this update, including sabiwara, saleyn, green-david, and dependabot[bot].

What were the notable Elixir & Phoenix updates?

Add to_unsafe_atom/1 and soft-deprecate to_atom/1, Add String.to_existing_atom/2 to validate against a list of allowed atoms, and Add List.to_existing_atom/2 to validate against a list of allowed atoms.

Jun 17, 2026

$ the-wire · showcase

ELIXIR TIGHTENS ATOM SAFETY WITH NEW VALIDATION FUNCTIONS

By RepoJournal · Filed 06:05 UTC on June 17, 2026 · About Elixir & Phoenix · Composed from the cited sources · methodology

4 people shipped this

sabiwara @sabiwara 3 cited

dependabot[bot] @dependabot[bot] 2 cited

saleyn @saleyn 1 cited

green-david @green-david 1 cited

Elixir core shipped three complementary functions that finally give you safe, typed ways to convert strings and lists to atoms without opening yourself to DoS attacks.

The biggest story across the stack is the soft-deprecation of String.to_atom/1 and the arrival of three new functions designed to close the atom safety hole [1] [2]. String.to_existing_atom/2 validates against a list of allowed atoms and compiles down to pattern matching when that list is static, making it faster than the old unsafe path [2]. List.to_existing_atom/2 does the same for lists [3], and to_unsafe_atom/1 replaces the dangerous old to_atom/1 when you genuinely need it [1]. The type system now narrows return types properly, so you get `:foo | :bar` instead of `:atom`, which catches more bugs at compile time. This is production-ready and you should audit your codebase for to_atom/1 calls immediately. On the Phoenix side, LiveView v1.2.3 shipped a quick fix for TypeScript declaration files being in the wrong folder [4] [5], and the core team documented module requirements for custom JSON libraries [6]. Ecto added configurable warnings and exceptions for writes to non-writable fields [7], letting you catch silent failures that masquerade as successful updates. Dependencies are stable: Babel bumped to 7.29.6 [8] and markdown-it to 14.2.0 [9].

Action items

→ Review your codebase for String.to_atom/1 calls and replace with String.to_existing_atom/2 before next deploy elixir-lang/elixir [immediate]
→ Update phoenix_live_view to v1.2.3 if using TypeScript phoenixframework/phoenix_live_view [plan]
→ Configure Ecto non-writable field behavior in your repos to catch silent failures elixir-ecto/ecto [plan]

References

[1] Add to_unsafe_atom/1 and soft-deprecate to_atom/1 ↗ elixir-lang/elixir
[2] Add String.to_existing_atom/2 to validate against a list of allowed atoms ↗ elixir-lang/elixir
[3] Add List.to_existing_atom/2 to validate against a list of allowed atoms ↗ elixir-lang/elixir
[4] v1.2.3 ↗ phoenixframework/phoenix_live_view
[5] fix typescript declaration file path ↗ phoenixframework/phoenix_live_view
[6] Document module requirements for json_library() (see PR #6481) ↗ phoenixframework/phoenix
[7] Add ability to configure the behavior of writing to a non-writable field ↗ elixir-ecto/ecto
[8] Bump @babel/core from 7.27.4 to 7.29.6 ↗ phoenixframework/phoenix_live_view
[9] Bump markdown-it from 14.1.1 to 14.2.0 ↗ phoenixframework/phoenix_live_view