Who contributed to Elixir & Phoenix on August 11, 2026?

5 developers shipped this update, including José Valim, Patric, github-actions[bot], SteffenDE, and preciz.

Elixir & Phoenix

Elixir, Phoenix, LiveView, and Ecto - the BEAM web stack

Pick a date

Topics: Elixir & Phoenix Full archive →

The Wire · Showcase

PHOENIX LIVE VIEW PATCHES OPEN REDIRECT VULNERABILITY ACROSS TWO VERSIONS

By RepoJournal · Filed 07:01 UTC on August 11, 2026 · About Elixir & Phoenix

5 people shipped this

github-actions[bot] @github-actions[bot] 3 cited

José Valim @josevalim 1 cited

Patric @patric-vinicios 1 cited

SteffenDE @SteffenDE

preciz @preciz

Phoenix Live View shipped emergency security fixes for CVE-2026-64941 in both v1.1.33 and v1.2.9 to close an open redirect hole via ASCII control characters in the redirect/2 function.

The vulnerability lets attackers bypass redirect validation by injecting tab, line feed, or carriage return characters, a classic control character bypass that affects any app using live navigation [1] [2]. Version 1.2.9 stacks the security fix with three bug fixes including a rare live component destruction issue and parent navigation blocking [2]. Meanwhile, Phoenix core shipped v1.8.10 with its own quiet but important fixes: the code reloader's false "restart your server" messages are gone [3], websocket options got restored to the JavaScript client [3], and longpoll transport now properly retries on batch POST timeout [3]. On the JavaScript side, a buffered push on unjoin'd channels was leaking memory by never releasing stale reply bindings from the first startTimeout run [4], a sharp catch that prevents resource exhaustion in high-churn connection scenarios. Elixir core updated its design anti-patterns documentation [5], keeping the foundation current.

Action items

→ Upgrade Phoenix Live View to v1.1.33 or v1.2.9 before next deploy - closes CVE-2026-64941 phoenixframework/phoenix_live_view [immediate]
→ Update Phoenix to v1.8.10 for code reloader and websocket fixes phoenixframework/phoenix [plan]
→ Monitor for redirect-based attacks if on older Live View versions phoenixframework/phoenix_live_view [monitor]

References

[1] v1.1.33 ↗ phoenixframework/phoenix_live_view
[2] v1.2.9 ↗ phoenixframework/phoenix_live_view
[3] v1.8.10 ↗ phoenixframework/phoenix
[4] release the stale reply binding of a buffered push (#6788) phoenixframework/phoenix
[5] Update design-anti-patterns.md elixir-lang/elixir

Quick answers

What shipped in Elixir & Phoenix on August 11, 2026?: Phoenix Live View shipped emergency security fixes for CVE-2026-64941 in both v1.1.33 and v1.2.9 to close an open redirect hole via ASCII control characters in the redirect/2 function. In total, 8 commits, 3 pull requests, and 3 releases landed.
Who contributed to Elixir & Phoenix on August 11, 2026?: 5 developers shipped this update, including José Valim, Patric, github-actions[bot], SteffenDE, and preciz.
What were the notable Elixir & Phoenix updates?: v1.1.33, v1.2.9, and v1.8.10.

ELIXIR TIGHTENS GUARD SYNTAX, PHOENIX FIXES MIX DETECTION

José Valim shut down a common footgun in Elixir guards while the team fixed a startup bug that breaks when mix is available but not yet started.

elixir 6 shipped

Elixir & Phoenix Aug 10

ELIXIR FIXES UTF-8 CORRUPTION IN MACRO.TO_STRING, ECTO CUTS COMPILE DEPS

A critical fix landed for Elixir's string handling that was silently corrupting UTF-8 sequences when converting C1 control characters, while Ecto shipped a change that trims unnecessary compile-time dependencies from schema derivations.

elixir 4 shipped

Elixir & Phoenix Aug 9

MACRO.TO_STRING BUG BREAKS FOR COMPREHENSIONS WITH TRAILING KEYWORDS

Elixir's Macro.to_string/1 silently corrupts for-comprehensions that use do-end blocks with non-block trailing keywords, rendering valid code that no longer compiles.

elixir 2 shipped

Elixir & Phoenix Aug 8

ELIXIR PARSER GETS LEANER AS PHOENIX AUDITS DEAD CODE

Daniel Kukula shipped three consecutive optimizations to Elixir's date parsing pipeline, removing accumulators and intermediate allocations in a focused performance push [ref:1] [ref:2] [ref:3].

elixir 14 shipped

Elsewhere on the wire

AI Agents Aug 12

LANGCHAIN SHIPS THREE CRITICAL RELEASES IN 12 HOURS, CLOSES SETUPTOOLS VULNERABILITY

LangChain pushed langchain-core 1.5.4, langchain 1.3.15, and langchain-anthropic 1.5.5 overnight while patching a setuptools supply-chain risk that gated the Hugging Face integration.

ai-agents 59 shipped

Local LLMs Aug 12

OLLAMA CUTS REPEAT PENALTY BLOAT, LLAMA.CPP SHIPS POCKET-TTS SUPPORT

Ollama kills a decade of default penalty cruft that was drowning every model, while llama.cpp gains multimodal audio chops and vLLM fixes ROCm speculative decoding corruption.

+11

llms 258 shipped

@CachyOS Aug 12

CACHYOS KERNEL BUMPS TO 7.1.7 AS MIRROR NETWORK EXPANDS

CachyOS shipped kernel 7.1.7 overnight while extending its mirror footprint across Europe and adding Simplified Chinese to the wiki.

infra 60 shipped

@dotnet Aug 12

BROWSER WASM BLOAT FIXED, RELOCATION SHRINKING SHIPS

dotnet/runtime eliminated unnecessary cryptography dependencies from browser builds while implementing code section relocation optimizations that shrink Wasm binaries.