$ ls elixir/reviews/ # the step-back reads
Elixir & Phoenix in review
One review per week (and month): what shipped, what broke, what to act on.
Nov 2–8, 2026 weekly [act] 8 stories
Ecto stops caching interpolated JSON paths and splices
The same-change Ecto patch closes a memory-exhaustion DoS that grew one cache entry per distinct JSON path and per splice length.
Oct 26–Nov 1, 2026 weekly [act] 8 stories
Elixir patches URI denial-of-service plus two CVEs
The bulk of the period's work landed in the type checker and compiler, with Ecto closing a redaction hole in changeset errors.
Oct 19–25, 2026 weekly [act] 8 stories
Base validation rewritten with SWAR, beam shrinks 14.5%
The same week brought a second pass fixing the large-input regression this rewrite introduced, plus formatter fixes for output that had c...
Oct 12–18, 2026 weekly 8 stories
Phoenix rewrites every CI workflow to hardened patterns
Elixir's week ran the other direction: Registry gained an :off_heap option and the compiler team kept chasing allocations out of Uri and ...
Oct 5–11, 2026 weekly [plan] 8 stories
LiveView gains PubSub for LiveViews and components
Phoenix fastlanes PubSub over a behavior, requiring an intermediate 1.8.16 release before 1.9 upgrades.
Oct 1–31, 2026 monthly [act] 8 stories
Elixir patches JSON and URI denial-of-service bugs
The URI.parse/1 fix bounds port parsing, closing a CPU exhaustion path that any app parsing untrusted URLs was exposed to.
Sep 28–Oct 4, 2026 weekly 8 stories
Ecto maps insert_all fields through destination schema
The fix lands alongside an Elixir type-system change for list subtraction and a batch of LiveView form and upload corrections.
Sep 21–27, 2026 weekly [act] 8 stories
Calendar.ISO shift work lands ~1.5x faster
Phoenix also fixes phx.gen.cert certificates that Chrome refused to load, and LiveView stops erroring on dangling asset symlinks.
Sep 14–20, 2026 weekly [act] 8 stories
Comments land in the Elixir AST
The formatter now attaches comments to AST nodes, with no public API yet; Ecto and LiveView patch releases close out the week.
Sep 7–13, 2026 weekly [act] 8 stories
LiveView flash tokens verified 1000x too long
Phoenix.Token.verify/4 expected seconds, but the LiveView flash check passed :timer.seconds(60), so sessions stayed valid for 60000 secon...
Sep 1–30, 2026 monthly [plan] 8 stories
Phoenix adds CI test summary formatter
The SummaryFormatter replaces ten minutes of CI dots, while Elixir's typechecker stops crashing on impossible function clauses.
Aug 31–Sep 6, 2026 weekly
Phoenix drops Ecto from phx.new.web default
Elixir core also reworks the test manifest for parameterized runs and inlines Calendar.ISO parsing heads.
Aug 24–30, 2026 weekly
Phoenix and LiveView tighten resume and task lifecycle, Elixir culls map lookup waste
Phoenix and LiveView shored up two failure paths users hit in the wild, while Elixir cut repeated map and charlist work that showed up in...
Aug 1–31, 2026 monthly
Elixir core tuning, Ecto breaking change, LiveView patches dominate August
August saw Elixir's compiler and runtime lean out, Ecto ship a breaking DateTime cast change, and Phoenix LiveView address a security pat...
Keep up with Elixir & Phoenix in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.