RepoJournal
Elixir & Phoenix Elixir & Phoenix
107 wires and counting

$ follow Elixir & Phoenix

Keep up with Elixir & Phoenix in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-14
stories 6
RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

PHOENIX LIVE VIEW PATCHES SCHEME VALIDATION BYPASS

By RepoJournal · Filed · About Elixir & Phoenix · Composed from the cited sources · methodology

Alexander Gubarev Steffen Deusch github-actions[bot]
3 people shipped this
Alexander Gubarev @AlexGx 1 cited Steffen Deusch @SteffenDE 1 cited github-actions[bot] @github-actions[bot] 1 cited

Phoenix LiveView 1.2.7 ships an emergency security fix for a scheme validation bypass that could let attackers inject malicious URLs into your application.

The LiveView team cut a release overnight to close CVE-2026-58228 [1], a vulnerability in Phoenix.LiveView.Utils that fails to properly validate URI schemes. This is the kind of silent killer that gets exploited in production before you notice it. The fix is in , and you need it before your next deploy. On the Elixir side, the core team landed a documentation fix for Process.dest() and Process.send/3 [2], tightening up specs that were causing confusion in the typechecker. LiveView also reverted a recent commit and added test coverage [3] to prevent regression. Minor stuff compared to the security hole, but worth noting if you're tracking every merge.

Action items

References

  1. [1] v1.2.7 ↗ phoenixframework/phoenix_live_view
  2. [2] Fix `Process.dest()` spec and `Process.send/3` doc upd ↗ elixir-lang/elixir
  3. [3] revert 4b63216, add test ↗ phoenixframework/phoenix_live_view

$ ls elixir/reviews/ # the step-back reads

the week in review Comments land in the Elixir AST the month in review Elixir core tuning, Ecto breaking change, LiveView patches dominate August
Topics: Elixir & Phoenix Full archive → Weekly reviews →

Quick answers

What shipped in Elixir & Phoenix on July 14, 2026?
Phoenix LiveView 1.2.7 ships an emergency security fix for a scheme validation bypass that could let attackers inject malicious URLs into your application. In total, 4 commits, 1 pull requests, and 1 releases landed.
Who contributed to Elixir & Phoenix on July 14, 2026?
3 developers shipped this update, including Alexander Gubarev, Steffen Deusch, and github-actions[bot].
What were the notable Elixir & Phoenix updates?
v1.2.7, Fix `Process.dest()` spec and `Process.send/3` doc upd, and revert 4b63216, add test.
♥

$ log Elixir & Phoenix --recent

Elixir trims Calendar.ISO parsing and weekday math, densifies coverage accounting 6 shipped File stat functions accept open handles, Keyword.drop aligns its membership check 5 shipped phx.new templates pin a Tailwind CLI that fails on macOS, LiveView starts 1.3.0-dev 3 shipped Elixir reverts duplicate alias detection, stale test deps resolve from source records 8 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.