Who contributed to Elixir & Phoenix on July 14, 2026?

3 developers shipped this update, including Alexander Gubarev, Steffen Deusch, and github-actions[bot].

What were the notable Elixir & Phoenix updates?

v1.2.7, Fix `Process.dest()` spec and `Process.send/3` doc upd, and revert 4b63216, add test.

Elixir & Phoenix

Elixir, Phoenix, LiveView, and Ecto - the BEAM web stack

Pick a date

Topics: Elixir & Phoenix Full archive →

The Wire · Showcase

PHOENIX LIVE VIEW PATCHES SCHEME VALIDATION BYPASS

By RepoJournal · Filed 07:00 UTC on July 14, 2026 · About Elixir & Phoenix

3 people shipped this

Alexander Gubarev @AlexGx 1 cited

Steffen Deusch @SteffenDE 1 cited

github-actions[bot] @github-actions[bot] 1 cited

Phoenix LiveView 1.2.7 ships an emergency security fix for a scheme validation bypass that could let attackers inject malicious URLs into your application.

The LiveView team cut a release overnight to close CVE-2026-58228 [1], a vulnerability in Phoenix.LiveView.Utils that fails to properly validate URI schemes. This is the kind of silent killer that gets exploited in production before you notice it. The fix is in , and you need it before your next deploy. On the Elixir side, the core team landed a documentation fix for Process.dest() and Process.send/3 [2], tightening up specs that were causing confusion in the typechecker. LiveView also reverted a recent commit and added test coverage [3] to prevent regression. Minor stuff compared to the security hole, but worth noting if you're tracking every merge.

Action items

→ Upgrade phoenix_live_view to 1.2.7 immediately phoenixframework/phoenix_live_view [immediate]
→ Audit any LiveView components that construct or validate URLs for scheme-injection risks phoenixframework/phoenix_live_view [immediate]
→ Review Process.dest() and Process.send/3 type specs in your codebase if you're running strict typechecking elixir-lang/elixir [plan]

References

[1] v1.2.7 ↗ phoenixframework/phoenix_live_view
[2] Fix `Process.dest()` spec and `Process.send/3` doc upd ↗ elixir-lang/elixir
[3] revert 4b63216, add test phoenixframework/phoenix_live_view

Quick answers

What shipped in Elixir & Phoenix on July 14, 2026?: Phoenix LiveView 1.2.7 ships an emergency security fix for a scheme validation bypass that could let attackers inject malicious URLs into your application. In total, 4 commits, 1 pull requests, and 1 releases landed.
Who contributed to Elixir & Phoenix on July 14, 2026?: 3 developers shipped this update, including Alexander Gubarev, Steffen Deusch, and github-actions[bot].
What were the notable Elixir & Phoenix updates?: v1.2.7, Fix `Process.dest()` spec and `Process.send/3` doc upd, and revert 4b63216, add test.

ELIXIR FIXES SPEC AND ARITY BUGS ACROSS CORE MODULES

Elixir core shipped three precision fixes overnight that tighten specs on IEx and EEx utilities, catching the kind of type mismatches that slip past dialyzer.

elixir 7 shipped 1-min read

Elixir & Phoenix 2 days ago

ELIXIR CLOSES COMPLETION AND OPERATOR SIGNATURE GAPS

The Elixir team shipped fixes for two long-standing IDE friction points: cursor completion after operators and proper type signatures for the ++ concatenation operator.

elixir 2 shipped 1-min read

Elixir & Phoenix 3 days ago

ELIXIR FIXES TIME MATH BUG THAT ROUNDS THE WRONG WAY

NaiveDateTime.diff/3 has been silently rounding elapsed time up instead of down, breaking its documented contract and potentially causing logic errors in any code relying on time-based calculations.

elixir 35 shipped 1-min read

Elixir & Phoenix 4 days ago

STDLIB TYPESPECS TIGHTENED, PHOENIX DECOUPLES FROM COMPILER

Elixir is closing the gap between what its standard library promises and what it actually delivers, while Phoenix cuts a dependency on the compiler that was constraining its evolution.

elixir 37 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 4 hours ago

CACHYOS LINUX 7.2-RC3 SHIPS WITH HARDWARE FIXES AND EXPANDED LANGUAGE SUPPORT

CachyOS Linux 7.2-rc3-1 is live with Razer Blade speaker fixes and v4l2loopback updates, while the package installer now speaks Turkish and Azerbaijani.

infra 63 shipped 1-min read

@dotnet about 4 hours ago

RUNTIME FIXES DECIMAL AND BIGINTEGER ROUNDING BUGS THAT LOST PRECISION

Three critical numeric conversion bugs that silently corrupted precision in decimal, BigInteger, and floating-point math are now fixed across the stack.

dotnet 122 shipped 1-min read

@spring-projects about 4 hours ago

SPRING BOOT PLUGS FILE HANDLE LEAK IN IMAGE BUILDPACK

Spring Boot's image buildpack was leaking file handles and orphaning temp files when resolving missing builder images, but a fix just landed to clean up both the streams and the intermediate artifacts.

java 16 shipped 1-min read

FastAPI & Pydantic about 4 hours ago

FASTAPI AND SQLMODEL LOCK DOWN DEPENDENCY MANAGEMENT, PYDANTIC MYPY PLUGIN GETS PRECISION FIXES

Both FastAPI and SQLModel are replacing noisy weekly Dependabot updates with smarter automation, while Pydantic's type checker integration finally handles edge cases that have been breaking real codebases.

python 21 shipped 1-min read