RepoJournal
Elixir & Phoenix Elixir & Phoenix
138 wires and counting

$ follow Elixir & Phoenix

Keep up with Elixir & Phoenix in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-11
stories 14
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

PHOENIX LIVE VIEW PATCHES OPEN REDIRECT VULNERABILITY ACROSS TWO VERSIONS

By RepoJournal · Filed · About Elixir & Phoenix · Composed from the cited sources · methodology

github-actions[bot] José Valim Patric SteffenDE preciz
5 people shipped this
github-actions[bot] @github-actions[bot] 3 cited José Valim @josevalim 1 cited Patric @patric-vinicios 1 cited SteffenDE @SteffenDE preciz @preciz

Phoenix Live View shipped emergency security fixes for CVE-2026-64941 in both v1.1.33 and v1.2.9 to close an open redirect hole via ASCII control characters in the redirect/2 function.

The vulnerability lets attackers bypass redirect validation by injecting tab, line feed, or carriage return characters, a classic control character bypass that affects any app using live navigation [1] [2]. Version 1.2.9 stacks the security fix with three bug fixes including a rare live component destruction issue and parent navigation blocking [2]. Meanwhile, Phoenix core shipped v1.8.10 with its own quiet but important fixes: the code reloader's false "restart your server" messages are gone [3], websocket options got restored to the JavaScript client [3], and longpoll transport now properly retries on batch POST timeout [3]. On the JavaScript side, a buffered push on unjoin'd channels was leaking memory by never releasing stale reply bindings from the first startTimeout run [4], a sharp catch that prevents resource exhaustion in high-churn connection scenarios. Elixir core updated its design anti-patterns documentation [5], keeping the foundation current.

Action items

References

  1. [1] v1.1.33 ↗ phoenixframework/phoenix_live_view
  2. [2] v1.2.9 ↗ phoenixframework/phoenix_live_view
  3. [3] v1.8.10 ↗ phoenixframework/phoenix
  4. [4] release the stale reply binding of a buffered push (#6788) ↗ phoenixframework/phoenix
  5. [5] Update design-anti-patterns.md ↗ elixir-lang/elixir

$ ls elixir/reviews/ # the step-back reads

the week in review Phoenix rewrites every CI workflow to hardened patterns the month in review Phoenix adds CI test summary formatter
Full archive → Weekly reviews →

Quick answers

What shipped in Elixir & Phoenix on August 11, 2026?
Phoenix Live View shipped emergency security fixes for CVE-2026-64941 in both v1.1.33 and v1.2.9 to close an open redirect hole via ASCII control characters in the redirect/2 function. In total, 8 commits, 3 pull requests, and 3 releases landed.
Who contributed to Elixir & Phoenix on August 11, 2026?
5 developers shipped this update, including José Valim, Patric, github-actions[bot], SteffenDE, and preciz.
What were the notable Elixir & Phoenix updates?
v1.1.33, v1.2.9, and v1.8.10.
♥

$ log Elixir & Phoenix --recent

Algorithm L replaces inside-out shuffles in Enum 3 shipped Base validation regression fixed, formatter comments stay put 16 shipped Formatter bugs that changed program meaning, and a LiveView assign that always fired 25 shipped Base validators go SWAR, formatter output stabilizes 4 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl standardizes low-precision rollout kernels on DeepGEMM Agent Security Guardrails exposes hooks over HTTP, certifi floor raised in agent-scan

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.