RepoJournal
Elixir & Phoenix

Elixir & Phoenix

Elixir, Phoenix, LiveView, and Ecto - the BEAM web stack

Keep up with Elixir & Phoenix in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Mon 15 jun
  2. Tue 16 jun
  3. Wed 17 jun
  4. Thu 18 jun
  5. Sat 27 jun
  6. Mon 29 jun
  7. Tue 30 jun
  8. Wed 1 jul
  9. Thu 2 jul
  10. Fri 3 jul
  11. Sat 4 jul
  12. Sun 5 jul
  13. Mon 6 jul
  14. Tue 7 jul
  15. Wed 8 jul
  16. Thu 9 jul
  17. Fri 10 jul
  18. Sat 11 jul
  19. Sun 12 jul
  20. Mon 13 jul
  21. Tue 14 jul
  22. Wed 15 jul
  23. Thu 16 jul
  24. Sat 18 jul
  25. Sun 19 jul
  26. Mon 20 jul
  27. Tue 21 jul
  28. Wed 22 jul
  29. Thu 23 jul
  30. Today 24 jul
Topics: Elixir & Phoenix Full archive →

The Wire · Showcase

PHOENIX LIVE VIEW SEALS CRITICAL NODE NAME LEAK IN UPLOAD TOKENS

By RepoJournal · Filed · About Elixir & Phoenix

AlexGx Eurico Nicacio lukaszsamson SteffenDE José Valim
5 people shipped this
AlexGx @AlexGx 4 cited Eurico Nicacio @euriconicacio 2 cited lukaszsamson @lukaszsamson 2 cited SteffenDE @SteffenDE 1 cited José Valim @josevalim 1 cited

A reverted encryption fix exposes how Phoenix was leaking BEAM node identities through unencrypted upload tokens, and the core team is pivoting to a cleaner solution using term_to_binary.

Phoenix Live View shipped an encryption layer for upload tokens after discovering that `allow_upload/3` was signing but not encrypting payloads [1]. The tokens embedded PIDs whose binary representation includes the source node name literally, making them trivially decodable by any client and exposing internal hostnames and pod IPs in container environments [2]. The fix landed, then José Valim reverted it hours later [3], pivoting to a simpler approach: encoding tokens with `term_to_binary(data, [:local])` instead, which will ship through Plug.Crypto support. This is a security fix that matters for anyone running Phoenix apps in Kubernetes or behind load balancers where node names leak infrastructure topology. In parallel, the Live View team added programmatic access to debug and error events normally hidden in console logs via a new `phx:live-view:diagnostic` event, with debug output gated behind `LiveSocket.enableDebug()` on localhost [4]. The team also patched a silent disconnect bug where reconnection logic failed to re-register socket-close callbacks after clean closes, leaving pages in a phantom disconnected state until manual refresh [5]. On the Elixir side, Alexander Gubarev landed five type and documentation fixes across the compiler, ExUnit, and Calendar modules [7][8][9][10]. Ecto fixed preloader validation for multiple association combinations that previously triggered cryptic DB errors or misassociated data [6].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] Encrypt LiveView upload tokens (#4337) phoenixframework/phoenix_live_view
  2. [2] Encrypt LiveView upload tokens ↗ phoenixframework/phoenix_live_view
  3. [3] Revert "Encrypt LiveView upload tokens (#4337)" phoenixframework/phoenix_live_view
  4. [4] Add a phx:live-view:diagnostic event ↗ phoenixframework/phoenix_live_view
  5. [5] Ls fix handler lost ↗ phoenixframework/phoenix_live_view
  6. [6] Fix preloader validation for multiple combinations ↗ elixir-ecto/ecto
  7. [7] Fix Kernel.ParallelCompiler.compile_opts() type each_cycle spec (#15664) elixir-lang/elixir
  8. [8] Fix Calendar.strftime negative year as 2-digits formatting (#15658) elixir-lang/elixir
  9. [9] Fix ExUnit.RunnerStats.increment_failure_counter/2 spec (#15659) elixir-lang/elixir
  10. [10] Fix pages code examples ↗ elixir-lang/elixir

Quick answers

What shipped in Elixir & Phoenix on July 24, 2026?
A reverted encryption fix exposes how Phoenix was leaking BEAM node identities through unencrypted upload tokens, and the core team is pivoting to a cleaner solution using term_to_binary. In total, 13 commits and 10 pull requests landed.
Who contributed to Elixir & Phoenix on July 24, 2026?
5 developers shipped this update, including AlexGx, Eurico Nicacio, SteffenDE, lukaszsamson, and José Valim.
What were the notable Elixir & Phoenix updates?
Encrypt LiveView upload tokens (#4337), Encrypt LiveView upload tokens, and Revert "Encrypt LiveView upload tokens (#4337)".

More from Elixir & Phoenix

Elixir & Phoenix Elixir & Phoenix

ELIXIR FIXES CALENDAR AND COMPILER EDGE CASES ACROSS FIVE PATCHES

Alexander Gubarev landed five targeted fixes to Calendar.ISO and ParallelCompiler that close gaps in time parsing, validation guards, and documentation.

Alexander Gubarev
elixir 15 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ELIXIR TOOLING FIXES LAND AHEAD OF SYSTEM COMPATIBILITY PUSH

The compiler stops misinterpreting profile flags, string reversal handles invalid UTF8 correctly, and Ecto gains fragment column selection in a wave of fixes that shores up core library reliability.

Alexander Gubarev Frank Hunleth greg-rychlewski
elixir 11 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ECTO GAINS FRAGMENT COLUMN NAMING, PHOENIX PLUGS GET SMARTER

Ecto's new with_columns/2 lets you assign names to SQL fragments, while Phoenix now handles module plugs with options in pipe_through declarations.

José Valim AlexGx preciz Flo0807 +3
elixir 14 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ELIXIR COMPILER GETS 20% FASTER TYPE CHECKING

Multi-clause function analysis now runs significantly faster after the core team eliminated unnecessary list allocations in disjoint argument checking.

Alexander Gubarev preciz José Valim
elixir 6 shipped 1-min read

Daily updates, in your inbox

Follow Elixir & Phoenix

Keep up with Elixir & Phoenix in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

LANGCHAIN SHIPS COORDINATED PROVIDER UPDATES WITH LANGSMITH GATEWAY SUPPORT

All four core LangChain packages bumped to 1.5.1 overnight with unified LangSmith gateway routing and provider-specific fixes across OpenAI, Anthropic, and Fireworks.

github-actions[bot] ccurme ak684 tofarr +2
ai-agents 62 shipped 1-min read
Local LLMs Local LLMs

LLAMA.CPP SHIPS FIVE RELEASES IN 24 HOURS, FIXES SPECULATIVE DECODING ACROSS THE STACK

The inference stack is consolidating around speculative decoding, and the bugs surfacing there are getting squashed across three major projects simultaneously.

Jesse Gross github-actions[bot] yuyue0225sc davidjpyu +8
llms 157 shipped 2-min read
CachyOS @CachyOS

INSTALLER REFACTOR TAKES SHAPE, PACKAGE UPDATES ROLL STEADY

CachyOS is modernizing its CLI installer with a comprehensive typed partition system overhaul while maintaining smooth automation across the AUR-derived package repository.

github-actions Vladislav Nepogodin loathingKernel cantosun99 +2
infra 57 shipped 1-min read
.NET @dotnet

MACIOS DOCS OVERHAUL SPANS 31 TYPES, ASPNETCORE VALIDATION MOVES TO SOURCE GENERATION

Rolf Bjarne shipped 31 types with proper XML documentation across macios while aspnetcore refactors validation classes out of the public API entirely.

rolfbjarne kubaflo Tamilarasan Paranthaman RikkiGibson +4
dotnet 25 shipped 1-min read
Want every project, not just this one?