The best part: you don't need a project, or even Elixir installed, to play with it.

• The Localize playground runs in your browser, no code required. Pick a locale (there are plenty), then poke at number, currency, date, time, unit and MessageFormat 2 formatting, with CLDR pattern references built in.
• The inputs playground shows off the new LiveView input components across every CLDR locale: number, unit and money inputs, plus date pickers that work in Gregorian, Buddhist, Japanese imperial, Islamic, Persian, Hebrew and ROC calendars.
• The Livebook Kip built for tonight walks through the library hands-on. Run it in Livebook and follow along at your own pace.

If Kip's name rings a bell beyond the meetup, we've covered his Image library before; Localize is cut from the same all-of-it-in-one-place cloth. Full recap and the talk video to come; in the meantime, the event page has the details.

• ElixirConf US, 10 to 11 September, Chicago and online (a virtual ticket gets you both tracks).
• Goatmire Elixir, 28 September to 3 October, Varberg, Sweden, with AshConf capping it off.
• Code BEAM Europe, 21 to 22 October, Haarlem, Netherlands and online.

Goatmire

Goatmire is the one we keep hearing about: a community-first Elixir gathering in the seaside town of Varberg that optimises for connection over scale. The week runs free community workshops at Campus Varberg on the 28th and 29th, then three conference days at Varbergs Teater, with day one doubling as NervesConf EU. Speakers include Nerves core's Frank Hunleth, Sonic Pi creator Sam Aaron, and Ash creator Zach Daniel among 35+ others.

AshConf, co-presented by Alembic

Saturday 3 October is AshConf, a dedicated one-day Ash Framework conference presented by the Ash project together with Alembic, with talks from Ash core team members, key contributors and expert users. It's free for Erlang Ecosystem Foundation annual supporting members (everyone else is invited to donate to the Ash Open Collective), lunch included. The call for speakers is open on Sessionize, and you can register on Luma.

I'll be there too, talking about precision domain modelling with Ash and Localize (yes, the library Kip showed us this month), and what becomes possible when your domain model has better types. Zach's announcement was far too kind about it.

Familiar faces on the programme

The Goatmire week is thick with people who've stood in front of this meetup:

• Conor Sinclair (tech lead at Alembic) co-leads the free Ash Demystified workshop with Ash core's Barnabas Jovanovics: a ground-level introduction to why developers won't shut up about Ash.
• James Harton (principal engineer at Alembic, Ash core team, author of Reactor and Ash Authentication) is doing double duty: the Beam Bots: Robotics on the BEAM talk with live robot demos, plus the Achieving Balance in the Workshop session where attendees assemble a Nerves-powered balance bot, drive it from a Phoenix app on their phone, and take the robot home.
• Rebecca Le (Alembic, Ash core team, co-author of the Ash book) presents Video Game Archaeology with Elixir: parsing Morrowind's 24-year-old binary format, modelling the game world with Ash and Postgres, and browsing it all in LiveView.

If Sweden is a stretch, the ElixirConf US virtual ticket is the easy way to get a conference fix from this timezone, and Code BEAM Europe streams online too. Closer to home, we'll see you at the September Hack Night.

Work on whatever you like: a side project, an open source itch, or the Phoenix app you keep meaning to start. Plenty of us will be pairing up and sharpening our AI-assisted coding workflows, so come see how other people drive their agents. It's also a perfect night for beginners and the Elixir curious: there'll be experienced folks at every table happy to pair and get you unstuck.

This one is in person only, no livestream. RSVP on Luma to see the venue address and entry instructions.

Talks return at the next meetup. Got one in you? Full-length or lightning, and first-timers are very welcome. Pitch us a talk.

absinthe_federation

• CVE-2026-67585 HIGH 8.7: unauthenticated GraphQL _entities requests with crafted keys hit String.to_atom/1, exhausting the atom table and crashing the VM.

  Fix Upgrade absinthe_federation to 0.9.3.

Livebook

• CVE-2026-66298 HIGH 8.6: untrusted notebook JS can synthesize keyboard events from the sandboxed iframe to trigger session shortcuts, forcing cell evaluation or a runtime restart.

• CVE-2026-68746 HIGH 7.7: Teams identity enforcement fails open when a deployment group can't be resolved, granting unauthenticated access.

• CVE-2026-66881 HIGH 7.0: relative path traversal in file entry imports lets a malicious notebook write files anywhere the Livebook process can.

• CVE-2026-66885 MEDIUM 6.8: login CSRF, missing OAuth state/nonce validation in Teams sign-in.

• CVE-2026-66297 MEDIUM 5.0: env var values interpolated unescaped into generated Docker/Fly.io deployment commands, so $(...) substitution runs.

  Fix Upgrade Livebook to 0.19.9 (or 0.18.7 on the older branch). One upgrade covers all five.

html_sanitize_ex

• CVE-2026-68749 HIGH 8.2: CPU-exhaustion DoS via unbounded greedy regex in the CSS scrubber, around 2.4s of CPU per 80KB style body.

• CVE-2026-68750 HIGH 8.2: quadratic sibling traversal, 20k siblings holds a scheduler for about 1.7s.

• CVE-2026-66370 MEDIUM 4.8: the html5 scrubber keeps form/formaction attributes, so injected inputs can redirect submissions of an existing form.

• CVE-2026-68747 LOW 2.3: CSS allowlist bypass, at-rules like @import url(//attacker/style.css) survive sanitisation.

• CVE-2026-66829 LOW 2.3: <meta http-equiv="refresh"> is retained, an open redirect.

• CVE-2026-66843 LOW 2.3: <object data=...> URI validation only checks a lowercase javascript: prefix.

  Fix Upgrade html_sanitize_ex to 1.5.4. Gotcha: 1.5.3 fixes five of the six but not the @import bypass, so don't stop there.

guardian

• CVE-2026-55735 HIGH 8.2: Guardian.revoke/3 decodes tokens without verifying the signature, so an unauthenticated attacker with a forged JWT can revoke victims' sessions.

• CVE-2026-55733 MEDIUM 6.9: atom exhaustion in Guardian.Permissions.AtomEncoding on untrusted input.

• CVE-2026-55734 MEDIUM 6.9: atom exhaustion via untrusted permission map keys.

• CVE-2026-54894 MEDIUM 6.9: atom exhaustion in Guardian.Plug.Keys when key names come from attacker-influenced input like tenant IDs.

  Fix Upgrade guardian to 2.4.1. One bump covers all four.

ash

• CVE-2026-67579 HIGH 7.5: filter expression injection via forged keyset pagination cursors. Deserialised %Ash.Query.Call{} structs bypass the safety gates, which means SQL injection on AshPostgres or in-process code execution on the ETS/Simple data layers.

• CVE-2026-69659 MEDIUM 5.9: keyset cursors accept zlib-compressed binary_to_term payloads with no size cap, kilobytes in, tens of megabytes out.

• CVE-2026-70395 LOW 2.1: predicate injection in manage_relationship belongs_to lookups can leak secret lookup keys.

  Fix Upgrade ash to 3.31.3. Gotcha: 3.31.1 fixed the two lower ones but not the HIGH filter injection, which landed three days later. Go straight to 3.31.3.

oidcc_plug

• CVE-2026-66883 MEDIUM 6.3: a case-sensitive "User-Agent" header lookup silently disables session user-agent binding even with check_useragent: true.

• CVE-2026-66884 LOW 2.1: the authorization callback accepts callbacks missing session state, a CSRF enabling forced login.

  Fix Upgrade oidcc_plug to 0.5.0.

cowlib

• CVE-2026-43971 MEDIUM 6.3: cow_link:link/1 interpolates unescaped > in target URIs and "/\ in rel values, letting attackers smuggle arbitrary Link header entries.

  Fix No tagged release at time of writing; the fix is commit 89da27e. If you build Link headers from user input, sanitise it (reject > in targets and quotes/backslashes in rel values) and watch for the next cowlib release.

postgrex

• CVE-2026-66838 MEDIUM 5.9: SQL injection via the :comment option of Postgrex.stream/4, where a */ closes the comment block early. Only stream/4 skips the comment validation.

  Fix Upgrade postgrex to 0.22.4.

oaskit

• CVE-2026-66296 MEDIUM 5.1: reflected XSS, the default HTML error handler interpolates request-controlled values unescaped.

  Fix Upgrade oaskit to 0.14.1, or set html_errors: false.

phoenix_live_view

• CVE-2026-64941 LOW 2.1: open redirect, validate_local_url!/2 didn't strip the ASCII tab/newline characters browsers ignore when parsing URLs.

  Fix Upgrade phoenix_live_view to 1.2.9 (or 1.1.33 / 1.0.19 on older branches). Yes, again; we bumped this site's lockfile too.

What to do

1. Run mix hex.audit, and let Hex 2.5 fail CI on a vulnerable lockfile (see the Hex 2.5 write-up).
2. Patch worst first: the Guardian revoke/3 signature bypass and the Livebook trio if you run either, then the DoS pile.
3. Mind the two version gotchas: html_sanitize_ex needs 1.5.4 (not 1.5.3) and ash needs 3.31.3 (not 3.31.1).
4. Watch the EEF CNA advisory list.

The theme this month is untrusted input reaching places that assume trust: atoms, filters, cursors, sanitisers. Nothing here is a remote takeover of a patched stack, but the Guardian and Ash ones are genuinely nasty in the wrong app shape, so run the audit today rather than at the next meetup.

It's a great excuse to finally start that thing, and an even better one to watch how other people work: plenty of us will be pairing on Elixir and comparing AI-assisted coding workflows on real code. If you're new to Elixir or just curious, this is honestly the best possible first meetup. There's no pressure to know anything yet, and you'll have experienced folks at the table to pair with and get you unstuck.

One thing to note: unlike our usual meetups, this one is in person only, with no livestream. RSVP on Luma to see the venue address and entry instructions, and we'll see you on the 16th.

Got a talk in you? We're after speakers, full-length or lightning, and first-timers are very welcome. Pitch us a talk.

Phoenix and Bandit, by the numbers

Praia Labs published two posts putting actual numbers on things we usually only have vibes for. Their Phoenix version adoption analysis of Hex download data has Phoenix 1.8.x at roughly 64% of monthly downloads by mid-2026 (it crossed the 50% line back in March), with 1.7.x still above 28%. The companion Bandit adoption post is the fun one: Bandit reached download parity with Cowboy in July, up from about 2% in late 2023, with the big jump coming when it became the Phoenix default. Bandit users also patch faster: 38% were on a new security release within three days, versus 28% for Cowboy. The usual caveat applies, downloads are a proxy rather than a census, but the trend lines are hard to argue with.

Sobelow 0.15

The Phoenix security scanner Sobelow shipped 0.15.0, its first release since October 2025, from its new home at sobelow/sobelow. The headline: a --no-router flag so plain Elixir projects can be scanned, not just Phoenix apps. It also gains Elixir 1.20 support, a usage-rules.md so AI coding assistants use it properly, and an end-to-end test harness that lifted coverage from 29% to 67%. Given last month's CVE volume, having the scanner actively maintained again is very welcome.

De-slopping AI-generated code

A whole cottage industry of Credo plugins has sprung up to catch the smells LLMs leave behind. ExSlop is the most developed: 40 checks for things like blanket rescues, narrator comments and anti-idiomatic Enum usage. Llamex targets LLM-refactor smells and cheerfully admits to being largely vibe-coded itself, and Jump's credo_checks includes checks aimed squarely at vacuous LLM-generated tests.

Related, and worth sitting with: the Syntax podcast's Vibe Health survey of 1,252 developers found 59% feel their coding skills are diminishing with heavy AI use, 54% report less enjoyment or flow, and 65% feel pressure to produce more. Tools that keep the slop out of your codebase are good; keeping your own skills sharp is better. Come practise both at our September Hack Night.

Elixir for Finance

Elixir for Finance is a new book from Dr. Dimitrios Koutmos and Alexander Koutmos, edited by Hugo Baraúna: market analysis with Livebook, Explorer, Scholar and Nx, from pulling FRED and Yahoo Finance data through portfolio risk and backtesting. It's in beta with five chapters so far, and every chapter ships as runnable Livebook notebooks.

Quick hits

Tidewave Connect lets the coding agent you already run in a terminal or editor (Claude Code, Cursor and friends) plug into your running Phoenix app: click an element in the browser and your prompt is enriched with framework traces, while the agent can query the database, read logs and run code in the live app. Dokploy v0.30.0 is out for the self-hosters deploying Phoenix with it, adding external secrets managers and Cloudflare/Route53 DNS automation. And if you want the wider AI security context, the Black Hat USA debrief on the OpenAI and Hugging Face incident is worth an hour, with a good written timeline from Simon Willison.

The framing that makes it click: concurrency gives us more workers; demand tells us when to stop sending them work. Back-pressure is the whole point of GenStage, and the post walks through it visually. max_demand caps how many events can be in flight for a subscription at once, while min_demand is the threshold that triggers the consumer to ask the producer for more. Seeing the numbers flow between stages makes it obvious why the defaults behave the way they do, and what actually changes when you tune them.

Andrea co-wrote Testing Elixir and his posts are reliably worth your time. This one deserves a bookmark for the next time someone on your team asks why their pipeline sits idle in batches, a question min_demand usually answers.

There's no blog post announcing it (the site itself is the announcement), but José Valim filled in the story in the Hacker News thread, which racked up 250+ points: the design is by the Software Mansion folks, iterated on together in Figma, and José rewrote all of the copy himself with feedback from the core maintainers. The thread's reception says a lot about where Elixir sits in 2026: less "what is this language?" and more appreciation for a mature ecosystem that keeps investing in its front door.

If you want the community hot takes, the first episode of the new Macro Mayhem podcast spends a chunk of its news segment on the redesign.

Enter Macro Mayhem, a new podcast from Peter Ullrich and Gus Workman covering the latest Elixir news and broader software industry topics. Episode 001, "Redesigns, Conferences, and Rogue Agents", landed on 27 July and sets the template: Hex 2.5.0's new vulnerability warnings, the elixir-lang.org redesign, the conference season ahead (Goatmire with AshConf, ElixirConf US, Code BEAM EU), and a discussion segment on AI news of the week.

Subscribe on Apple Podcasts or Spotify, or grab the feed from macromayhem.fm. And thanks to the Thinking Elixir crew for six great years.

Erlang/OTP

• CVE-2026-55953 CRITICAL 9.1: the TLS 1.2 (and earlier) and DTLS client accepts a cipher suite the server selected even if the client never offered it, enabling an algorithm downgrade and adversary-in-the-middle against ssl clients.

• CVE-2026-58227 HIGH 8.7: TLS/DTLS denial of service via unbounded recursion on a cross-signed peer certificate chain.

• CVE-2026-59251 HIGH 8.7: public_key DoS via exponential certificate-policy-tree growth during path validation.

• CVE-2026-59250 HIGH 8.3: Megaco flex scanner buffer overflow via an oversized property parm name.

• CVE-2026-54890 HIGH 8.2: BEAM VM crash via an integer underflow in binary_to_term BIT_BINARY_EXT decoding, a DoS anywhere you decode untrusted external term format.

• CVE-2026-42792 MEDIUM 6.3: epmd permanent DoS via file-descriptor exhaustion (EMFILE) on accept(2).

• CVE-2026-55737 MEDIUM 5.1: heap pointer corruption via a signed/unsigned mismatch in LARGE_TUPLE_EXT decoding.

• CVE-2026-47078 MEDIUM 4.8: relative path traversal in zip:unzip/1 and zip:extract/1 via a depth-counter bypass in check_dir_level.

  Fix Upgrade Erlang/OTP to 29.0.4, 28.5.0.4, or 27.3.4.15. Same drill as two weeks ago: an OTP upgrade, not a Hex bump.

cowlib

• CVE-2026-59248 HIGH 8.7: unbounded HPACK/QPACK prefixed-integer decoding, a memory-exhaustion DoS reachable through HTTP/2 and HTTP/3.

  Fix Upgrade cowlib to 2.19.0.

cowboy

• CVE-2026-65624 MEDIUM 6.9: duplicate header names bypass the HTTP/1.1 max_headers limit, enabling memory exhaustion.

  Fix Upgrade cowboy to 2.18.0. Newer Phoenix apps default to Bandit, but plenty of deployed apps still serve on Cowboy, so check your lockfile.

What to do

1. Update OTP first: the critical ssl cipher-suite bypass undermines TLS server authentication for every outbound connection your node makes.
2. Run mix hex.audit for the Cowboy/Cowlib pair, and remember Hex 2.5 flags advisories during mix deps.get (see the Hex 2.5 write-up).
3. Watch the EEF CNA advisory list. At this cadence it's worth a bookmark.

The pattern from the last batch holds: mostly DoS via unbounded resource use, but the one that isn't (the TLS downgrade) is the one to lose sleep over. Patch that today.

Got a talk in you? We're after speakers, full-length or lightning, and first-timers are very welcome. Pitch us a talk.

ueberauth_apple

• CVE-2026-55954 CRITICAL 9.1: the JWT signature is checked but ID-token claims aren't, so any Apple-signed token bearing a victim's identifier can be replayed for account takeover.

  Fix Upgrade ueberauth_apple to 0.6.2. Patch this today if you offer Sign in with Apple.

phoenix

• CVE-2026-56811 HIGH 8.7: no per-connection channel-join limit, process-exhaustion DoS from a single unauthenticated connection.

• CVE-2026-56812 MEDIUM 6.3: Presence client crashes on prototype-key collisions in syncState/syncDiff.

  Fix Upgrade phoenix to 1.8.9 (or 1.7.24 / 1.6.17 / 1.5.15 on older branches).

mint

• CVE-2026-56810 HIGH 8.7: buffers an entire chunked response chunk in memory.

• CVE-2026-58229 HIGH 8.2: unbounded HTTP/1 response-header accumulation, memory-exhaustion DoS.

• CVE-2026-59246 MEDIUM 6.3: zero-length HTTP/2 CONTINUATION frames slip past the header byte-size cap.

  Fix Upgrade mint to 1.9.2. Mint sits under Finch, Req and friends, so you may pull it in transitively.

hpax

• CVE-2026-58226 HIGH 8.7: unbounded HPACK integer decoding, unauthenticated DoS.

  Fix Upgrade hpax to 1.0.4. Transitive via Bandit and Mint.

ssl (Erlang/OTP)

• CVE-2026-55950 HIGH 8.7: DTLS listener crash via a race in dtls_packet_demux.

• CVE-2026-55952 HIGH 8.2: TLS 1.3 server DoS via a malformed ClientHello pre-shared-key extension.

• CVE-2026-54891 MEDIUM 6.3: plaintext APPLICATION_DATA injected during the TLS handshake, delivered post-handshake.

• CVE-2026-54887 MEDIUM 6.3: DTLS cookie bypass during the startup window.

  Fix Upgrade Erlang/OTP to 29.0.3, 28.5.0.3, or 27.3.4.14 (whichever matches your branch). An OTP upgrade, not a Hex bump.

mdex

• CVE-2026-53426 HIGH: atom-table exhaustion DoS via JSON parse_document.

• CVE-2026-54889 MEDIUM: javascript: injection (XSS) in Quill Delta output.

• CVE-2026-54888 MEDIUM: uncontrolled recursion over deeply nested Markdown crashes the BEAM.

• CVE-2026-53429 MEDIUM: native memory leak in escaped-tag rendering.

• CVE-2026-53428 MEDIUM: unbounded allocation in highlight_lines range expansion.

• CVE-2026-53427 LOW: XSS via an unescaped highlight_lines_class code-fence attribute.

  Fix Upgrade mdex to 0.13.x (we run 0.13.3). We hit these on this very site, see the Hex 2.5 write-up.

plug

• CVE-2026-56814 MEDIUM 6.9: multipart part headers aren't charged to the :length limit, so uploads can create unbounded temp files.

• CVE-2026-56813 LOW 2.1: cookie attribute injection in Plug.Conn.Cookies.encode/2.

  Fix Upgrade plug to 1.20.3 (or 1.19.5 / 1.18.5 / 1.17.4 / 1.16.6 on older branches).

ssh (Erlang/OTP)

• CVE-2026-54886 MEDIUM 5.3: SFTP server DoS via an extended channel-data infinite loop.

• CVE-2026-53422 LOW 2.3: SFTP REALPATH path-existence oracle allows enumeration outside the configured root.

  Fix The same OTP releases as above: 29.0.3 / 28.5.0.3 / 27.3.4.14.

phoenix_live_view

• CVE-2026-58228 MEDIUM 5.1: scheme-validation bypass in Phoenix.LiveView.Utils, XSS via <.link>.

  Fix Upgrade phoenix_live_view to 1.2.7.

postgrex

• CVE-2026-58225 LOW 2.1: SQL injection via an unescaped dollar-quote in notification reconnect replay, causing DoS.

  Fix Upgrade postgrex to 0.22.3.

swoosh

• CVE-2026-54893 LOW 2.1: email-derived URL path injection in the Microsoft Graph adapter, only if you derive the sender address from untrusted input.

  Fix Upgrade swoosh to 1.26.3.

What to do

1. Run mix hex.audit. On Hex 2.5 it also flags advisories inline during mix deps.get and fails CI on a vulnerable lockfile (see the Hex 2.5 write-up).
2. Patch worst first: the CRITICAL ueberauth_apple account-takeover, then the HIGH memory-exhaustion DoS in Phoenix, Mint, hpax and OTP ssl. Update Erlang/OTP for the ssl and ssh ones.
3. Watch the EEF CNA advisory list.

Most of these are denial-of-service via unbounded memory, but the Apple auth bypass is a real account takeover and the LiveView issue is an XSS, so don't sit on those. The reassuring part: the ecosystem catalogues this properly now and the tooling surfaces it, so staying current is mostly a matter of running the audit and not ignoring it.

There's a nice symmetry to it: Kip gave a talk at Elixir Sydney in May 2024, Fast and efficient image processing in Elixir, on exactly this topic, using libvips, Vix and Image to scale, transform and compose images fast. We're now running his library to build the very page you're reading.

What it does for us

• A mix images build step walks the image folder and writes a right-sized .webp next to each source (avatars capped at 160px, event photos at 800px). On-page images dropped from roughly 5 MB to about 900 KB.
• The OpenGraph share cards are re-encoded to lossless WebP through the same library (libvips' webpsave), taking the card set from around 26 MB to 9 MB with no loss of crispness on the text.
• It's self-contained: Vix ships a precompiled libvips, so there's nothing to install in CI.

Image is a lovely piece of the ecosystem: a clean Elixir API over a very fast C library, precompiled so it just works. If you push images around in an Elixir app, watch Kip's talk and reach for Image.

If your company runs Elixir, Erlang, Gleam or anything else on the BEAM, we'd love to include you. There are two other places worth getting listed, both a quick way to show your support for the ecosystem:

• The EEF company registry, where companies formally register their use of the ecosystem so the Erlang Ecosystem Foundation can point to who depends on it.

• elixir-companies.com, the community directory. Adding yourself is a pull request on the repo.

Getting on these lists helps people find BEAM work locally and makes the community a little more visible. Tell us at a meetup or drop us a line and we'll add you to the Sydney list too.

Advisories in the terminal

mix deps.get and mix deps.update now flag known-vulnerable packages inline, tagging them "VULNERABLE" with a short summary and deduplicating advisories across databases. It is exactly how we recently caught and cleared a handful of advisories on this very site. Resolving deps looks like this now:

Resolving Hex dependencies...
Resolution completed in 0.42s
  mdex 0.11.7 VULNERABLE!
    EEF-CVE-2026-54889 (MEDIUM)
    aka: CVE-2026-54889, GHSA-4383-7xfp-gpph
    Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)
    https://osv.dev/vulnerability/EEF-CVE-2026-54889
    EEF-CVE-2026-53426 (HIGH)
    aka: CVE-2026-53426, GHSA-923r-7vf4-5vw8
    Atom-table exhaustion denial-of-service via JSON parse_document in MDEx
    https://osv.dev/vulnerability/EEF-CVE-2026-53426
Found packages with security advisories

For CI, mix hex.audit inspects your lockfile and exits non-zero if any dependency carries an advisory or has been retired, so a vulnerable release fails the build instead of slipping through:

$ mix hex.audit
Advisories:
  phoenix_live_view 1.2.6 - EEF-CVE-2026-58228 (MEDIUM)
    aka: CVE-2026-58228, GHSA-5cgh-g58j-m9cq
    Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
    https://osv.dev/vulnerability/EEF-CVE-2026-58228

Found packages with security advisories

Bumping phoenix_live_view to a patched release and re-running it prints "No retired or security advisory packages found", and the build is green again. This is all on for every project with nothing to configure.

Release-age cooldown

The cooldown withholds very recently published versions from resolution, giving the community time to catch a bad release before it lands in your deps:

# mix.exs
hex: [cooldown: "7d"]

Durations look like 7d, 2w or 1mo. It never touches already-locked dependencies, and there is an escape hatch when a current version turns out to be unsafe. mix hex.outdated shows which updates are being held and when they become eligible.

Dependency policies

Organisations can publish a signed policy and enforce it across every project that opts in, restricting releases by advisory severity, retirement reason, or release age. mix hex.policy show summarises the active policy, and mix hex.policy why <package> explains, version by version, why something is blocked.

Package authors need do nothing for any of this. Consumers get the advisories and the cooldown for free, which is a rare thing in security: a genuine improvement you pick up just by upgrading.

The advisories Hex surfaces are published by the Erlang Ecosystem Foundation CNA, which has been busy lately. Watch it, run mix hex.audit, and keep your dependencies current: most of these fixes are one mix deps.update away. We rounded up the last month's advisories here.

We'll kick off with an ecosystem update covering the Mythos class Fable 5 launch and what's been happening in the community in 2026, including security updates and new releases, followed by two Ash framework talks.

Thanks to Decidr for hosting us in the CBD. RSVP on Luma to see the venue address.

Got an idea for a talk? Submit a talk proposal or come along and say hi, everyone is welcome, no matter your skill level.

The new site is a small, fast static site built, fittingly, in Elixir with Tableau, the elixir-tools static site generator. The whole thing compiles to plain HTML and is pushed to S3 and served through CloudFront, so it's cheap, fast and has nothing to keep running. Content lives as Markdown and YAML in the repo, and every push to main deploys automatically.

More importantly, it now documents every Elixir Sydney meetup since 2015: more than eighty events and the talks, speakers and recordings that went with them. A lot of that had been scattered across an old site, our Meetup group, GitHub and the Internet Archive, and we've pulled it back together for good.

We've also finally shut down our Meetup.com group (yay!). It served us well for a decade, but it's done, everything now lives here, with RSVPs on Luma.

A few things to explore:

• Events, the full archive, newest first, with talk videos and slides where we have them.
• Speakers, everyone who has ever given a talk, with links to their work. If you spot something wrong, let us know.
• Give a talk, first-time speakers are very welcome, and we're happy to help you shape an idea.

RSVPs now run through Luma, and we hang out in the Elixir community channels linked in the footer.

See you at the next one.

On 9 June, Anthropic released Claude Fable 5 and Mythos 5, pitching Fable 5 as its most capable widely-released model and aiming it squarely at long-horizon agentic work. It went out the same day across the Claude API, AWS Bedrock, Microsoft Foundry and the rest.

Then on Friday 12 June, the US Commerce Department directed Anthropic to block foreign nationals from using both models. Rather than carve the world in two, Anthropic disabled Fable 5 and Mythos 5 globally for everyone the same day. As best anyone can tell, the government believes a way to jailbreak Fable 5 surfaced, and the standoff traces back to Anthropic refusing to hand over full access to Claude.

Worth noting from down here: "foreign nationals" includes us. So even setting the jailbreak drama aside, a Sydney developer poking at Fable 5 over the weekend would have watched it blink out regardless.

It's a strange one to sit with. The most capable model anyone had shipped, public on a Tuesday and pulled by Friday, on government order. If you're building agentic tooling on the BEAM, it's a sharp reminder that the model under your abstraction can disappear out from under you. Plan for the provider, and the politics, not just the API.

The headline is colocated CSS. Where 1.1 let you keep a component's hooks and JS next to its markup, 1.2 lets you do the same with styles, using the CSS @scope rule to stop them leaking into the rest of the page. To make that work the team had to split HEEx compilation into separate tokenization and parsing steps, which is the kind of unglamorous internal change that quietly makes a lot of other things possible.

A few other things worth knowing:

• Phoenix.LiveView.JS commands are now automatically encoded when you send them with push_event, whether you're on Jason or the built-in JSON module.
• Test warnings can be configured by category, so you can tune the checks that run in LiveViewTest.
• Custom formatting for <script> and <style> tags, and module-level HEEx debug annotations.

Worth a look if you're building anything with LiveView. We'll likely touch on it at an upcoming meetup, RSVP on Luma.

The wake-up call: CVE-2025-32433

In April 2025, CVE-2025-32433 landed, an unauthenticated, pre-auth remote code execution flaw in Erlang/OTP's SSH server, scored a maximum CVSS 10.0. A remote attacker could run code before authenticating. It was fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20, and it was a clear reminder to keep the runtime patched.

OTP 29 responds

That focus shows up directly in OTP 29: SSH is now secure-by-default (shell and exec disabled unless you enable them), TLS defaults to a post-quantum key exchange, and the compiler warns about unsafe functions, alongside a new set of secure coding guidelines.

The EEF is now a CVE Numbering Authority

The bigger structural change: the Erlang Ecosystem Foundation is now a CNA (a CVE Numbering Authority). It assigns CVE IDs and publishes advisories for active Hex.pm packages and the elixir-lang, erlang, erlef and gleam-lang GitHub orgs, with records published at cna.erlef.org. It's already coordinating real disclosures, recent 2026 advisories cover Tesla middleware, public_key certificate validation, and the Mint HTTP/2 client, which means coordinated, properly-tracked vulnerability handling for the whole ecosystem.

What to do

• Keep Elixir and OTP patched, most BEAM CVEs are fixed quickly across supported release lines.
• Watch cna.erlef.org and the EEF security advisories.
• Run mix hex.audit for retired packages, and consider mix_audit (mix deps.audit) to scan deps against known advisories in CI.

Elixir 1.20

Released on 3 June 2026, Elixir 1.20 is a landmark for the type system. The compiler now performs type inference and gradual type checking of every Elixir program, with no type annotations required. In practice that means Elixir increasingly flags dead code and guaranteed-to-fail typing violations, with a very low false-positive rate.

Highlights:

• Type narrowing across guards, case/cond/with clauses, and conditionals (occurrence typing), so types are more precise inside each branch.
• Much of the standard library is now typed, including most of the Map module and tuples.
• Faster compilation, especially on many-core machines, the benchmarks now put Mix among the fastest build tools on the BEAM.

Erlang/OTP 29

OTP 29 (13 May 2026) leans hard into security and developer ergonomics:

• Secure-by-default SSH (shell/exec disabled unless you opt in) and a post-quantum x25519mlkem768 default key exchange for TLS.
• New warnings for unsafe and potentially-unsafe functions, plus secure coding guidelines.
• Experimental native records (EEP-79), multi-valued comprehensions, an is_integer/3 guard, and JIT improvements for binary matching.

If you want to play with both, point your version manager at Elixir 1.20.1 on OTP 29.0.2, that's what runs this very site's build pipeline.

We'll cover the ecosystem updates at the next meetup, RSVP on Luma.

So hexdocs.pm/ecto becomes ecto.hexdocs.pm, and hexdocs.pm/ecto_sql becomes ecto-sql.hexdocs.pm (underscores turn into hyphens). Organisation docs move from org.hexdocs.pm/package to org.hexorgs.pm/package.

The reason is security. Until now every public package was served from the same origin, so a malicious or compromised package could, in principle, reach into another package's docs in the browser. Giving each package its own subdomain hands that isolation to the browser's same-origin policy for free. It's a small, sensible piece of the same security push we wrote about across the ecosystem.

Nothing breaks today, old URLs redirect to the new ones. But if you've got HexDocs links in a README, a blog post, or your socials, it's worth updating them to the subdomain form while you're thinking about it.

Read the announcement on hex.pm.

The pitch is simple. The registry shows the real scope of the ecosystem across more than sixteen languages, helps people find companies working with the tech they know, and gives the Foundation something concrete to point funders at. Signing up is quick: one person nominates themselves as the contact, verifies by email, and the company is listed. There's no further commitment, and registered contacts get a quarterly update on what's happening across the ecosystem.

If your company works with Elixir or the BEAM, add it to the registry. It takes a few minutes and it makes the community look as big as it actually is. We'd especially love to see more Sydney and Australian names on the list.

And if you can do more than a free listing: the EEF runs on membership and sponsorship. The security work we wrote about recently, the working groups, the infrastructure, all of it is funded by companies that rely on the BEAM. If that's you, supporting the EEF is a direct way to give back to the runtime your business is built on.

Agenda

• 5:30pm, Welcome, housekeeping & introduction
• 6:00pm, Talks (with a break in between)

Got an idea for an Elixir talk? We’d love to hear it! Whether you’re an experienced developer with deep insights or just starting out and excited to share what you’ve learned, our meetups are a great place to connect, learn, and grow.

Not ready to give a talk? No worries! Come along to meet fellow Elixir enthusiasts, ask questions, and get guidance from more experienced developers. Everyone is welcome, no matter your skill level!

If you’d like to submit a talk idea, just drop us a message, we’re happy to help you shape it into a great presentation!

Josh and Mike

Whether you're a seasoned developer or just curious about Elixir, come along for an evening filled with engaging discussions, insightful talks, and maybe even a few surprises.

Josh and Mike