RepoJournal
Elixir & Phoenix Elixir & Phoenix
85 wires and counting

$ follow Elixir & Phoenix

Keep up with Elixir & Phoenix in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good morning, this isn't your newsletter.

One email a day. Unsubscribe in one click.

$ status

wire 2026-08-29
stories 36
RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Phoenix defaults to Elixir's built-in JSON, Elixir patches charlist recursion

By RepoJournal · Filed · About Elixir & Phoenix

github-actions[bot] rhcarvalho Alexander Gubarev lukaszsamson José Valim elfenlaid
6 people shipped this
github-actions[bot] @github-actions[bot] 2 cited rhcarvalho @rhcarvalho 2 cited Alexander Gubarev @AlexGx 1 cited lukaszsamson @lukaszsamson 1 cited José Valim @josevalim 1 cited elfenlaid @elfenlaid 1 cited

Elixir 1.18.5 and 1.19.6 patch a charlist recursion vulnerability, and Phoenix moves closer to dropping Jason entirely.

Both Elixir 1.18.5 and 1.19.6 ship a security fix for CVE-2026-75758, avoiding unbounded recursion when invalid charlists reach `List.to_string/1` or `List.to_charlist/1`; upgrade before your next deploy [1] [2]. Phoenix now defaults to the built-in JSON library when available, falling back to Jason otherwise, and a follow-up configures Swoosh to use JSON and standardizes `:swoosh` config with `config/3` [3] [4]. The generated-app `mix.lock` still includes `:jason`, flagged for future work. Elsewhere, `phx.gen.release` simplifies Debian version parsing by consolidating the tag into a single `debian_vsn` binding and using an inline regex in `docker_tag_candidate/1` to enforce the `-slim` suffix [5] . Elixir's compiler now makes singleton-typed pin patterns precise, enabling clause subtraction that was previously impossible; all pins were unconditionally imprecise before [6]. Also under the hood, the async stream internal state no longer carries an unused task pid [7], and a fix removes infinite recursion on the charlist error path [8].

Topics: Elixir & Phoenix Full archive →

Quick answers

What shipped in Elixir & Phoenix on August 29, 2026?
Elixir 1.18.5 and 1.19.6 patch a charlist recursion vulnerability, and Phoenix moves closer to dropping Jason entirely. In total, 19 commits, 14 pull requests, and 3 releases landed.
Who contributed to Elixir & Phoenix on August 29, 2026?
6 developers shipped this update, including Alexander Gubarev, lukaszsamson, José Valim, github-actions[bot], elfenlaid, and rhcarvalho.
What were the notable Elixir & Phoenix updates?
v1.18.5, v1.19.6, and Use the built-in JSON library.

$ log Elixir & Phoenix --recent

LIVE VIEW 1.2.11 SHIPS, PHX RELEASE SLIMS DOWN 12 shipped ECT0 FIXES WARNINGS-AS-ERRORS TYPO 2 shipped Phoenix ships emergency fix for Chrome tab resume 7 shipped LiveView crash fix lands as Elixir corrects Greek casing 20 shipped

$ log --all # elsewhere on the wire

AI Agents Langchain ships MCP adapter, Cline fixes telemetry and CVEs Local LLMs OpenVINO backend lands Qwen3.5 on NPU, Whisper.cpp support

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.