Who contributed to Elixir & Phoenix on July 4, 2026?

3 developers shipped this update, including SteffenDE, Gigitsu, and pnezis.

What were the notable Elixir & Phoenix updates?

Enforce longpoll batch size, Allow authToken to be a function, and Fix wrong placeholder numbering when a `from` source is a `{fragment, schema}` tuple.

Elixir & Phoenix

Elixir, Phoenix, LiveView, and Ecto - the BEAM web stack

Pick a date

Topics: Elixir & Phoenix Full archive →

The Wire · Showcase

PHOENIX TIGHTENS LONGPOLL SECURITY WHILE ELIXIR FIXES SPEC BUGS ACROSS THE STACK

By RepoJournal · Filed 06:04 UTC on July 4, 2026 · About Elixir & Phoenix

3 people shipped this

SteffenDE @SteffenDE 1 cited

Gigitsu @Gigitsu 1 cited

pnezis @pnezis 1 cited

Phoenix is enforcing a hard cap on longpoll batch sizes to close a potential attack surface, and you need to know the upgrade path.

Phoenix shipped a breaking change that enforces a maximum of 100 entries per longpoll request [1], hardening against a known attack vector. The client has enforced this limit since 1.8.6, so if you're running older versions with heavy longpoll traffic, upgrade to 1.8.6 or 1.8.7 first before jumping to the latest. On the auth front, Phoenix now lets authToken be a function instead of a static value [2], giving you a cleaner path to refresh tokens on reconnect without mutating the socket directly. Meanwhile, Elixir fixed a spec bug in File.copy/3 [4] that was incorrectly excluding 0 as a valid return value, and Ecto patched wrong placeholder numbering when using fragment sources with schemas [3], a subtle bug that would break parameterized queries in edge cases.

Action items

→ If running Phoenix with heavy longpoll load, stage upgrade to 1.8.6 or 1.8.7 first, then move to latest phoenixframework/phoenix [plan]
→ Update Ecto to pick up the fragment placeholder fix elixir-ecto/ecto [plan]
→ Migrate authToken to function-based approach for cleaner token refresh phoenixframework/phoenix [monitor]

References

[1] Enforce longpoll batch size phoenixframework/phoenix
[2] Allow authToken to be a function ↗ phoenixframework/phoenix
[3] Fix wrong placeholder numbering when a `from` source is a `{fragment, schema}` tuple ↗ elixir-ecto/ecto
[4] Fix spec of `File.copy/3` ↗ elixir-lang/elixir

Quick answers

What shipped in Elixir & Phoenix on July 4, 2026?: Phoenix is enforcing a hard cap on longpoll batch sizes to close a potential attack surface, and you need to know the upgrade path. In total, 6 commits and 3 pull requests landed.
Who contributed to Elixir & Phoenix on July 4, 2026?: 3 developers shipped this update, including SteffenDE, Gigitsu, and pnezis.
What were the notable Elixir & Phoenix updates?: Enforce longpoll batch size, Allow authToken to be a function, and Fix wrong placeholder numbering when a `from` source is a `{fragment, schema}` tuple.

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.

elixir 10 shipped 1-min read

Elixir & Phoenix 2 days ago

ELIXIR STRIPS REDUNDANT GUARDS, FIXES TUPLE PROJECTION BUG

Barna Kovacs landed three optimization PRs removing dead code from core Enum and Calendar modules, while a separate fix addresses a flawed tuple projection algorithm that was producing inconsistent type representations.

elixir 22 shipped 1-min read

Elixir & Phoenix 3 days ago

LIVEVIEW ASYNC CLEANUP FIX SHIPS ALONGSIDE RANGE OPTIMIZATIONS

Phoenix LiveView closes a critical async task test failure while Elixir cuts unnecessary abs calls from Range operations.

elixir 19 shipped 1-min read

Elixir & Phoenix 4 days ago

PHOENIX LIVE VIEW SEALS CRITICAL NODE NAME LEAK IN UPLOAD TOKENS

A reverted encryption fix exposes how Phoenix was leaking BEAM node identities through unencrypted upload tokens, and the core team is pivoting to a cleaner solution using term_to_binary.

elixir 23 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.