Skip to content

build(deps): bump phoenix from 1.7.24 to 1.8.9 and migrate accordingly - #5572

Merged
JakobLichterfeld merged 5 commits into
mainfrom
dependabot/hex/phoenix-1.7.24
Aug 10, 2026
Merged

build(deps): bump phoenix from 1.7.24 to 1.8.9 and migrate accordingly#5572
JakobLichterfeld merged 5 commits into
mainfrom
dependabot/hex/phoenix-1.7.24

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps phoenix from 1.7.24 to 1.8.9.

Changelog

Sourced from phoenix's changelog.

1.8.9 (2026-07-07)

Security fixes

  • CVE-2026-56811: Add a max_channels_per_transport option (defaulting to 100) to prevent a single client from spawning an unbounded number of channels (processes), eventually exhausting the server's memory or process limit.
  • CVE-2026-56812: Prevent presence keys from colliding with Object.prototype properties members, crashing the JS Presence client
  • Enforce longpoll batch size introduced in 1.8.6. This is additional hardening against CVE-2026-32689. If your application sends events with a very high frequency and uses long polling, such that a single longpoll request would exceed 100 events, you should update to 1.8.7 first.

1.8.8 (2026-06-10)

Enhancements

  • [phx.new] Use LiveView 1.2.0

1.8.7 (2026-05-06)

Bug fixes

  • Fix invalid status when longpoll request times out

Enhancements

  • Mask token parameter in logs by default (in addition to "password")

JavaScript Client Bug Fixes

  • Fix encoding of non-ASCII metadata in binary channel messages

1.8.6 (2026-05-05)

Security fixes

  • CVE-2026-32689: Fix Phoenix.Socket Longpoll transport memory exhaustion in nd-JSON body splitting

Enhancements

  • [phoenix] Raise if use Phoenix.VerifiedRoutes is called multiple times in the same module
  • [phoenix] Fix more deprecation and type checker warnings on Elixir 1.20
  • [phoenix] Raise when interpolating a list in Phoenix.VerifiedRoutes (#6632)
  • [phoenix] Gracefully handle non-binary vsn socket parameter (#6662)
  • [phx.gen.*] Use .eex filename suffix in generator files
  • [phx.new] Add interactive mode: mix phx.new --interactive (#6630)
  • [phx.new] Add phx-no-format to generated <.live_title> tag (#6667)

Bug fixes

  • [phx.gen.*] Fix generated migrations for myxql when using scopes (#6635)
  • [phx.new] Fix crash when parent directory contains a colon (#6633)

1.8.5 (2026-03-05)

JavaScript Client Bug Fixes

  • Fix socket connecting on visibility change when never established

Enhancements

  • Fix warnings on Elixir 1.20

1.8.4 (2026-02-23)

... (truncated)

Commits
  • 734c8d1 Release v1.8.9
  • beffc4d fix presence keys colliding with object prototype chain
  • 16e295d Limit the number of channels a single transport process can join
  • 211ff62 Allow authToken to be a function (#6751)
  • 6cb2a83 Enforce longpoll batch size
  • 5bf1ce6 Add missing test file
  • 046accc Normalize route verb while grouping
  • 21d1462 Group routes by verb during compilation (#6739)
  • 9d3f1f6 phx.gen.release: Document new Bob Web UI (#6721)
  • afcac09 Bump undici from 7.25.0 to 7.28.0 (#6736)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update Elixir code labels Aug 1, 2026
@netlify

netlify Bot commented Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for teslamate ready!

Name Link
🔨 Latest commit 431431b
🔍 Latest deploy log https://app.netlify.com/projects/teslamate/deploys/6a79cbb791ab72000743fd67
😎 Deploy Preview https://deploy-preview-5572--teslamate.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@JakobLichterfeld JakobLichterfeld added this to the v4.1.0 milestone Aug 1, 2026
@dependabot dependabot Bot changed the title build(deps): bump phoenix from 1.7.23 to 1.7.24 build(deps): bump phoenix from 1.7.24 to 1.8.9 Aug 3, 2026
@dependabot
dependabot Bot force-pushed the dependabot/hex/phoenix-1.7.24 branch 2 times, most recently from 0e78cde to 2e5d8c1 Compare August 9, 2026 10:01
@JakobLichterfeld

JakobLichterfeld commented Aug 10, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot
build(deps): bump phoenix from 1.7.24 to 1.8.9
322930d 
Bumps [phoenix](https://github.com/phoenixframework/phoenix) from 1.7.24 to 1.8.9.
- [Release notes](https://github.com/phoenixframework/phoenix/releases)
- [Changelog](https://github.com/phoenixframework/phoenix/blob/v1.8.9/CHANGELOG.md)
- [Commits](phoenixframework/phoenix@v1.7.24...v1.8.9)

---
updated-dependencies:
- dependency-name: phoenix
  dependency-version: 1.7.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/hex/phoenix-1.7.24 branch from 2e5d8c1 to 322930d Compare August 10, 2026 12:35
github-actions Bot and others added 3 commits August 10, 2026 12:40
@github-actions
build(deps): update Nix hashes
1b67b36
@JakobLichterfeld @claude
fix(web): migrate controller macro to Phoenix 1.8 formats option
776c808 
Replace the deprecated :namespace option with explicit :formats and an
html layout plug to keep riveView/CarView resolution and the app layout behavior.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@JakobLichterfeld
docs(nix): note detached devenv up for non-interactive use
da4dec4
@JakobLichterfeld JakobLichterfeld changed the title build(deps): bump phoenix from 1.7.24 to 1.8.9 build(deps): bump phoenix from 1.7.24 to 1.8.9 and migrate accordingly Aug 10, 2026
@JakobLichterfeld JakobLichterfeld added the security Pull requests that address a security vulnerability label Aug 10, 2026
@JakobLichterfeld
JakobLichterfeld merged commit 9ddb11b into main Aug 10, 2026
27 checks passed
@JakobLichterfeld
JakobLichterfeld deleted the dependabot/hex/phoenix-1.7.24 branch August 10, 2026 13:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JakobLichterfeld JakobLichterfeld JakobLichterfeld approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update Elixir code security Pull requests that address a security vulnerability

Projects

None yet

Milestone

v4.1.0

Development

Successfully merging this pull request may close these issues.

1 participant

@JakobLichterfeld