Who contributed to Elixir & Phoenix on July 30, 2026?

6 developers shipped this update, including Alexander Gubarev, dependabot, SteffenDE, lukaszsamson, rdeese, and makoto-developer.

What were the notable Elixir & Phoenix updates?

Allow configuring LongPoll to send its token via headers, Close and retry the longpoll transport when a batch POST times out, and Force a full render for components marked for deletion.

Elixir & Phoenix

Elixir, Phoenix, LiveView, and Ecto - the BEAM web stack

Pick a date

Topics: Elixir & Phoenix Full archive →

The Wire · Showcase

PHOENIX LONGPOLL SECURITY HARDENING AND LIVEVIEW COMPONENT DELETION FIX

By RepoJournal · Filed 07:01 UTC on July 30, 2026 · About Elixir & Phoenix

6 people shipped this

SteffenDE @SteffenDE 2 cited

lukaszsamson @lukaszsamson 2 cited

Alexander Gubarev @AlexGx 1 cited

rdeese @rdeese 1 cited

dependabot @dependabot

makoto-developer @makoto-developer

Phoenix shipped two critical transport fixes overnight: LongPoll can now send tokens via headers instead of query parameters, and LiveView components marked for deletion now force a full render to prevent orphaned DOM.

The LongPoll transport upgrade [1] closes a security exposure by allowing tokens to travel in request headers instead of query strings, with backward compatibility for older clients still sending via params. Simultaneously, a batch timeout bug [2] that left LongPoll stuck in an unrecoverable state has been fixed, closing and retrying the transport on POST timeout instead of silently deadlocking the send queue. On the LiveView side, the component deletion render fix [3] addresses a critical bug where deleted components could be resurrected on re-renders by forcing a full render pass when a component is marked for removal. The Phoenix origin policy cache [4] now correctly includes per-mount check_origin options in the cache key, preventing the first mount to be reached from deciding policy for all subsequent mounts of the same socket module. Elixir core fixed spec collection for type variables [5], ensuring that nested type vars in annotated arguments are properly captured and displayed in h/1 documentation. Ecto's autogenerate options for composite types [6] are now correctly applied.

Action items

→ Review LongPoll token configuration and migrate to header-based transport where possible phoenixframework/phoenix [plan]
→ Test LiveView component deletion behavior in production-like conditions after deploying phoenixframework/phoenix_live_view [plan]
→ Audit multi-mount socket configurations with different check_origin options phoenixframework/phoenix [monitor]

References

[1] Allow configuring LongPoll to send its token via headers ↗ phoenixframework/phoenix
[2] Close and retry the longpoll transport when a batch POST times out ↗ phoenixframework/phoenix
[3] Force a full render for components marked for deletion ↗ phoenixframework/phoenix_live_view
[4] Include per-mount :check_origin in the origin policy cache key (#6774) phoenixframework/phoenix
[5] Fix Code.Typespec.spec_to_quoted/2 incomplete variable type collection ↗ elixir-lang/elixir
[6] Fix autogenerate options for composite types (#4773) elixir-ecto/ecto

Quick answers

What shipped in Elixir & Phoenix on July 30, 2026?: Phoenix shipped two critical transport fixes overnight: LongPoll can now send tokens via headers instead of query parameters, and LiveView components marked for deletion now force a full render to prevent orphaned DOM. In total, 11 commits and 11 pull requests landed.
Who contributed to Elixir & Phoenix on July 30, 2026?: 6 developers shipped this update, including Alexander Gubarev, dependabot, SteffenDE, lukaszsamson, rdeese, and makoto-developer.
What were the notable Elixir & Phoenix updates?: Allow configuring LongPoll to send its token via headers, Close and retry the longpoll transport when a batch POST times out, and Force a full render for components marked for deletion.

ELIXIR BUMPS ZIZMOR SECURITY SCANNER TO 1.28.0

The Elixir repo updated its CI security action overnight, pulling in the latest zizmor static analysis tooling.

elixir 1 shipped

Elixir & Phoenix Aug 5

ELIXIR 1.20.3 TIGHTENS TYPE CHECKING, PHOENIX CUTS AGENT GUIDANCE BLOAT

Elixir shipped a compiler speedup and five type precision fixes that close the gaps developers keep finding in map and tuple handling.

elixir 5 shipped

Elixir & Phoenix Aug 4

PHOENIX TIGHTENS OUTPUT FORMATTING WHILE ELIXIR PATCHES DEPRECATION DOCS

Phoenix now enforces single trailing newlines in generated files to eliminate code churn, while the Elixir team corrects documentation errors in core modules.

elixir 14 shipped

Elixir & Phoenix Aug 3

SQLITE TEST FLAKES FIXED, DATETIME CASTING BREAKING CHANGE LANDS

Phoenix killed a long-standing SQLite test flakey that has haunted generated apps since day one, while Ecto ships a backward-incompatible DateTime normalization that tightens UTC handling.

elixir 12 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.

+10

llms 240 shipped

@CachyOS Aug 6

WIKI TRANSLATION ROLLBACK CHAOS, MIRROR STACK HOLDING STEADY

CachyOS wiki maintainers are caught in a revert loop over German translations while the status infrastructure logs 55 commits without incident.

infra 57 shipped

@dotnet Aug 6

DOTNET FOUNDATION PULLS iOS METRICS INTO FOCUS AS RUNTIME HARDENS HTTP PARSING

Performance team fixed iOS size reporting to measure only distributable packages, while runtime clamped down on RFC 9112 compliance for chunked encoding.