Who contributed to Elixir & Phoenix on July 16, 2026?

4 developers shipped this update, including Alexander Gubarev, dependabot, Barna Kovacs, and Łukasz Samson.

What were the notable Elixir & Phoenix updates?

Bump ws from 8.18.2 to 8.21.0, Fix changed? for removed one relations (#4754), and Bump github/codeql-action/init from 4.36.2 to 4.36.3.

Elixir & Phoenix

Elixir, Phoenix, LiveView, and Ecto - the BEAM web stack

Pick a date

Topics: Elixir & Phoenix Full archive →

The Wire · Showcase

PHOENIX LIVE VIEW PATCHES WEBSOCKET DOS WHILE ECTO FIXES RELATION TRACKING

By RepoJournal · Filed 07:02 UTC on July 16, 2026 · About Elixir & Phoenix

4 people shipped this

dependabot @dependabot 3 cited

Barna Kovacs @preciz 2 cited

Łukasz Samson @lukaszsamson 1 cited

Alexander Gubarev @AlexGx

Phoenix Live View shipped a critical websocket memory exhaustion fix in its dependency chain, while Ecto quietly resolved a data integrity bug in relationship change detection.

In brief

Phoenix Live View bumps ws from 8.18.2 to 8.21.0. The ws library patched a DOS vulnerability in recent versions. If you're on Live View and haven't updated, your websocket is a DoS target.
Ecto fixed changed? for removed one relations. It was returning the wrong value when you deleted a has_one association. Small fix, huge footgun if you were relying on that check.
Phoenix Live View optimized URI scheme detection for paths. Less string parsing, faster redirects. Good kind of churn: it doesn't change behavior, just makes it run faster.

The ws library dependency jumped from 8.18.2 to 8.21.0 in Live View [1], patching a remote memory exhaustion DoS vulnerability that could be exploited through high volumes of tiny websocket fragments. This is the kind of fix that doesn't make noise but absolutely matters for production systems under load. Meanwhile, Ecto fixed a subtle but real bug where changed? would return incorrect results when removing one-to-one relationships [2], a data consistency issue that could silently corrupt your change tracking logic. On the Phoenix side, the team optimized URI scheme detection for paths starting with "/" [5], a small win that compounds across every LiveView request. Elsewhere, the Elixir core team continued CI hygiene with CodeQL action bumps [3][4] and removed a redundant nil check in Live View's child_diff handling [6], keeping the codebase lean.

Action items

→ Update Phoenix Live View to pull in ws 8.21.0 before next deploy phoenixframework/phoenix_live_view [immediate]
→ Pull Ecto fix for changed? on removed one relations if you use relationship mutations elixir-ecto/ecto [plan]
→ Monitor Phoenix Live View for any URI detection regressions in your path-heavy apps phoenixframework/phoenix_live_view [monitor]

References

[1] Bump ws from 8.18.2 to 8.21.0 ↗ phoenixframework/phoenix_live_view
[2] Fix changed? for removed one relations (#4754) elixir-ecto/ecto
[3] Bump github/codeql-action/init from 4.36.2 to 4.36.3 ↗ elixir-lang/elixir
[4] Bump github/codeql-action/analyze from 4.36.2 to 4.36.3 ↗ elixir-lang/elixir
[5] Optimize URI scheme detection for paths ↗ phoenixframework/phoenix_live_view
[6] Remove redundant nil check for child_diff (#4293) phoenixframework/phoenix_live_view

Quick answers

What shipped in Elixir & Phoenix on July 16, 2026?: Phoenix Live View shipped a critical websocket memory exhaustion fix in its dependency chain, while Ecto quietly resolved a data integrity bug in relationship change detection. In total, 5 commits and 8 pull requests landed.
Who contributed to Elixir & Phoenix on July 16, 2026?: 4 developers shipped this update, including Alexander Gubarev, dependabot, Barna Kovacs, and Łukasz Samson.
What were the notable Elixir & Phoenix updates?: Bump ws from 8.18.2 to 8.21.0, Fix changed? for removed one relations (#4754), and Bump github/codeql-action/init from 4.36.2 to 4.36.3.

ELIXIR FIXES ENUM SORTER BUG THAT BROKE CUSTOM COMPARATORS

Enum.min and Enum.max were silently returning wrong results when you passed a custom sorter on ranges, and the core team just caught it.

elixir 16 shipped 1-min read

Elixir & Phoenix 2 days ago

PHOENIX LIVE VIEW PATCHES SCHEME VALIDATION BYPASS

Phoenix LiveView 1.2.7 ships an emergency security fix for a scheme validation bypass that could let attackers inject malicious URLs into your application.

elixir 6 shipped 1-min read

Elixir & Phoenix 3 days ago

ELIXIR FIXES SPEC AND ARITY BUGS ACROSS CORE MODULES

Elixir core shipped three precision fixes overnight that tighten specs on IEx and EEx utilities, catching the kind of type mismatches that slip past dialyzer.

elixir 7 shipped 1-min read

Elixir & Phoenix 4 days ago

ELIXIR CLOSES COMPLETION AND OPERATOR SIGNATURE GAPS

The Elixir team shipped fixes for two long-standing IDE friction points: cursor completion after operators and proper type signatures for the ++ concatenation operator.

elixir 2 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 9 hours ago

CACHYOS 7.2-RC3-3 LANDS WITH AMD DISPLAY FIXES AND TSC TUNING

CachyOS Linux 7.2-rc3-3 ships critical AMD graphics vblank handling consolidation and direct TSC synchronization for systems without IA32_TSC_ADJUST support.

infra 55 shipped 1-min read

@dotnet about 9 hours ago

CLANGSHARP CLOSES THE C++ AST GAP, MACIOS SHIPS XCODE 26.6 SUPPORT

ClangSharp landed the native bridges and managed API expansion needed to faithfully parse real-world C++ headers, while .NET for macOS is now Xcode 26.6 ready.

dotnet 85 shipped 2-min read

@spring-projects about 9 hours ago

SPRING BOOT CLEANS HOUSE WHILE INTEGRATION FIXES KAFKA BATCH MODE

Spring Boot is removing deprecated code and exposing critical NIO APIs, while Spring Integration ships a fix for Kafka batch processing that was breaking downstream splitters.