Elixir patches URI denial-of-service plus two CVEs

Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service elixir-lang/elixir

Port parsing in URI.parse/1 had no bound, so a crafted URI burns CPU in a function most applications call on untrusted input. If you parse URLs from requests, redirect headers, or user-supplied strings, this is the one to patch first.

Raise when decoding integers in json beyond float range (CVE-2026-115274) elixir-lang/elixir

by José Valim

Decoding a JSON integer past float range now raises instead of silently losing precision. It changes behavior for payloads that previously decoded, notably large IDs from other services; CVE-2026-115274 covers the fix, with no affected or fixed versions stated in the input.

Validate deps.partition configuration with checksum (CVE-2026-97209) elixir-lang/elixir

by José Valim

Configuration for deps.partition is now validated against a checksum, filed as CVE-2026-97209. Check that your partition config still passes validation before you upgrade.

Redact fields in Ecto.InvalidChangesetError and mixed keys CastError messages elixir-ecto/ecto

by Martin Karrer

Ecto.InvalidChangesetError.message/1 printed the applied changes and raw params with inspect/1, sidestepping the redact: true option the Changeset Inspect implementation respects. The exception text reaches logs and error trackers, so previously redacted values could surface there.

Do not discard reason in DynamicSupervisor, closes #16020 elixir-lang/elixir

by José Valim

DynamicSupervisor no longer discards the reason attached to a child, so a supervisor shutdown now reports why the child went down. The companion change stopped timeout messages from leaking; together they make failure reports from dynamic trees match what you get from a plain Supervisor.

Update all named keys at once for non-finite atom keys elixir-lang/elixir

by josevalim

For keys that may be any atom outside a finite set, map updates computed one alternative per named key, and chained updates multiplied map lines on every step. Each line now updates all named keys at once, which cuts the work the type checker does on heavily updated maps.

Send fastlane frames as a shared binary phoenixframework/phoenix

by Snehil-Shah

Encoded fastlane frames are flattened and sent as one shared binary, since refc binaries over 64 bytes are shared between processes, which avoids a copy per subscriber. The measurement in the change covers a single Phoenix.Channel.Server.broadcast/4 call.

Only call handle_params/3 on patch if it's defined, raising if nothing handles params phoenixframework/phoenix_live_view

by sevenseacat

Patching a LiveView called handle_params/3 unconditionally when :handle_params hooks returned {:cont, socket}, so a LiveView handling params only through a hook crashed with UndefinedFunctionError on its first patch. It now calls handle_params/3 only when defined and raises if nothing handles the params. Alongside: the formatter no longer moves comments inside interpolations where they could co...