Who contributed to Elixir & Phoenix on July 16, 2026?

4 developers shipped this update, including Alexander Gubarev, dependabot, Barna Kovacs, and Łukasz Samson.

What were the notable Elixir & Phoenix updates?

Bump ws from 8.18.2 to 8.21.0, Fix changed? for removed one relations (#4754), and Bump github/codeql-action/init from 4.36.2 to 4.36.3.

Elixir & Phoenix

Elixir, Phoenix, LiveView, and Ecto - the BEAM web stack

Pick a date

Topics: Elixir & Phoenix Full archive →

The Wire · Showcase

PHOENIX LIVE VIEW PATCHES WEBSOCKET DOS WHILE ECTO FIXES RELATION TRACKING

By RepoJournal · Filed 07:02 UTC on July 16, 2026 · About Elixir & Phoenix

4 people shipped this

dependabot @dependabot 3 cited

Barna Kovacs @preciz 2 cited

Łukasz Samson @lukaszsamson 1 cited

Alexander Gubarev @AlexGx

Phoenix Live View shipped a critical websocket memory exhaustion fix in its dependency chain, while Ecto quietly resolved a data integrity bug in relationship change detection.

In brief

Phoenix Live View bumps ws from 8.18.2 to 8.21.0. The ws library patched a DOS vulnerability in recent versions. If you're on Live View and haven't updated, your websocket is a DoS target.
Ecto fixed changed? for removed one relations. It was returning the wrong value when you deleted a has_one association. Small fix, huge footgun if you were relying on that check.
Phoenix Live View optimized URI scheme detection for paths. Less string parsing, faster redirects. Good kind of churn: it doesn't change behavior, just makes it run faster.

The ws library dependency jumped from 8.18.2 to 8.21.0 in Live View [1], patching a remote memory exhaustion DoS vulnerability that could be exploited through high volumes of tiny websocket fragments. This is the kind of fix that doesn't make noise but absolutely matters for production systems under load. Meanwhile, Ecto fixed a subtle but real bug where changed? would return incorrect results when removing one-to-one relationships [2], a data consistency issue that could silently corrupt your change tracking logic. On the Phoenix side, the team optimized URI scheme detection for paths starting with "/" [5], a small win that compounds across every LiveView request. Elsewhere, the Elixir core team continued CI hygiene with CodeQL action bumps [3][4] and removed a redundant nil check in Live View's child_diff handling [6], keeping the codebase lean.

Action items

→ Update Phoenix Live View to pull in ws 8.21.0 before next deploy phoenixframework/phoenix_live_view [immediate]
→ Pull Ecto fix for changed? on removed one relations if you use relationship mutations elixir-ecto/ecto [plan]
→ Monitor Phoenix Live View for any URI detection regressions in your path-heavy apps phoenixframework/phoenix_live_view [monitor]

References

[1] Bump ws from 8.18.2 to 8.21.0 ↗ phoenixframework/phoenix_live_view
[2] Fix changed? for removed one relations (#4754) elixir-ecto/ecto
[3] Bump github/codeql-action/init from 4.36.2 to 4.36.3 ↗ elixir-lang/elixir
[4] Bump github/codeql-action/analyze from 4.36.2 to 4.36.3 ↗ elixir-lang/elixir
[5] Optimize URI scheme detection for paths ↗ phoenixframework/phoenix_live_view
[6] Remove redundant nil check for child_diff (#4293) phoenixframework/phoenix_live_view

Quick answers

What shipped in Elixir & Phoenix on July 16, 2026?: Phoenix Live View shipped a critical websocket memory exhaustion fix in its dependency chain, while Ecto quietly resolved a data integrity bug in relationship change detection. In total, 5 commits and 8 pull requests landed.
Who contributed to Elixir & Phoenix on July 16, 2026?: 4 developers shipped this update, including Alexander Gubarev, dependabot, Barna Kovacs, and Łukasz Samson.
What were the notable Elixir & Phoenix updates?: Bump ws from 8.18.2 to 8.21.0, Fix changed? for removed one relations (#4754), and Bump github/codeql-action/init from 4.36.2 to 4.36.3.

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.

elixir 10 shipped 1-min read

Elixir & Phoenix 2 days ago

ELIXIR STRIPS REDUNDANT GUARDS, FIXES TUPLE PROJECTION BUG

Barna Kovacs landed three optimization PRs removing dead code from core Enum and Calendar modules, while a separate fix addresses a flawed tuple projection algorithm that was producing inconsistent type representations.

elixir 22 shipped 1-min read

Elixir & Phoenix 3 days ago

LIVEVIEW ASYNC CLEANUP FIX SHIPS ALONGSIDE RANGE OPTIMIZATIONS

Phoenix LiveView closes a critical async task test failure while Elixir cuts unnecessary abs calls from Range operations.

elixir 19 shipped 1-min read

Elixir & Phoenix 4 days ago

PHOENIX LIVE VIEW SEALS CRITICAL NODE NAME LEAK IN UPLOAD TOKENS

A reverted encryption fix exposes how Phoenix was leaking BEAM node identities through unencrypted upload tokens, and the core team is pivoting to a cleaner solution using term_to_binary.

elixir 23 shipped 2-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.