Elixir patches JSON and URI denial-of-service bugs

Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service elixir-lang/elixir

The unbounded port parsing let an attacker-supplied URL drive parsing work without limit, so CPU exhaustion is reachable from anywhere you feed user input to URI.parse/1, including redirect handling and webhook fetching. Upgrade to the Elixir release carrying the patch; the JSON denial-of-service fix shipped in the same window.

Wait for all ancestor locks before auto-upload phoenixframework/phoenix_live_view

by lukaszsamson

Auto-upload could start while a file input sat inside a locked ancestor, because onUnlock only waited for the nearest lock. The client now rechecks after each unlock and fires the callback only once the full ancestor chain is unlocked, so nested locked forms no longer upload early.

Handle chunk push timeouts in uploads phoenixframework/phoenix_live_view

by lukaszsamson

pushChunk gained missing client-side timeout handling; a slow chunk previously swallowed the client timeout and left the connection waiting on the server timeout until UploadChannel closed the socket. Slow uploads now fail on the client's own clock instead of hanging.

Fix form recovery completion ordering phoenixframework/phoenix_live_view

by lukaszsamson

The mount patch callback previously tracked only the last entry in the array; it now runs after every form recovery completes, regardless of completion order. Forms with several recovered fields get a consistent mount patch instead of one that raced the rest.

Optimize String.chunk with uniform fast-path and sub-binary slicing elixir-lang/elixir

by preciz

Fully valid and printable strings return [string] immediately, skipping the chunk loop and its allocations entirely, with the fallback loop reusing the first decoded codepoint and classification. String.chunk over uniform input is now close to free.

Avoid repeated dependency scans in nested Mix projects elixir-lang/elixir

by claytongentry

Mix.Dep.load_and_cache/5 rescanned the root project's already topologically sorted cache once per level of nested children and filtered it again to select records. It now traverses that cache in reverse, preserving dependency order, so deeply nested umbrella setups stop paying the repeated scan.

Avoid UTF-8 re-encoding in StringIO character reads elixir-lang/elixir

by preciz

StringIO character reads no longer re-encode the binary to build the accumulator. The author benchmarks a 1.2x to 1.3x speedup with "no regression, less memory usage", holding for wider input types like Asian strings in local benchmarks.

Keep trailing comments after nodes without closing metadata elixir-lang/elixir

by josevalim

Alongside: comment-preserving formatter fixes landed on both the trailing-comment and node-metadata paths, a registry :off_heap option and a fix for Ecto dropping true filters arrived, and DynamicSupervisor stopped leaking shutdown timeout messages.