$ the-wire · showcase
Ecto stops logging redacted fields in plaintext
By RepoJournal · Filed · About Elixir & Phoenix · Composed from the cited sources · methodology
Ecto closed a plaintext leak path for redact: true fields in changeset error messages, while the Elixir team landed a batch of type-system map optimizations and fixed a shell tab-completion crash.
Redact fields in Ecto.InvalidChangesetError and mixed keys CastError messages elixir-ecto/ecto
Ecto.InvalidChangesetError.message/1 printed applied changes and raw params with inspect/1, bypassing the redact: true option that the Ecto.Changeset Inspect implementation honours. Because Repo.insert!/update!/delete! and apply_action!/2 raise this exception, redacted values such as passwords and tokens were reaching logs in plaintext; both that message and the mixed-keys CastError message now...
Optimize map updates elixir-lang/elixir
José Valim's change to type-system map updates skips the projection check for DNF lines without negatives, caches callback results by old field, unions rests with the same new field before putting the key, restricts existence checks to named keys in the atom domain, and unions rebuilt domain maps pairwise while excluding the empty map once.
Fix map domain update elixir-lang/elixir
Guillaume Duboc's fix closes five open map domain update issues and lands alongside an earlier removal of the map leaf emptiness cache, so treat the two as one unit rather than bisecting between them when tracking down analyzer behaviour changes.
Fix crash on tab completion when shell is not found (#16021) elixir-lang/elixir
Lars Wikman's fix makes tab completion fail quietly instead of taking down the entire session when Erlang cannot find a valid shell. If you have watched IEx die on completion in a container or minimal environment, this is the cause.
Add purge and purge_all compilation tracer events elixir-lang/elixir
Two smaller additions round out the day: purge and purge_all compilation tracer events, and a Phoenix test asserting that Token.sign/4 forwards the :key_length option to the key generator. The tracer events give tooling a hook for module purging; the Phoenix test is coverage for a documented signing option that had none.
