Skip to content

Bump phoenix from 1.8.8 to 1.8.9#498

Merged
princemaple merged 1 commit into
mainfrom
dependabot/hex/phoenix-1.8.9
Jul 8, 2026
Merged

Bump phoenix from 1.8.8 to 1.8.9#498
princemaple merged 1 commit into
mainfrom
dependabot/hex/phoenix-1.8.9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 8, 2026

Copy link
Copy Markdown
Contributor

Bumps phoenix from 1.8.8 to 1.8.9.

Changelog

Sourced from phoenix's changelog.

1.8.9 (2026-07-07)

Security fixes

  • CVE-2026-56811: Add a max_channels_per_transport option (defaulting to 100) to prevent a single client from spawning an unbounded number of channels (processes), eventually exhausting the server's memory or process limit.
  • CVE-2026-56812: Prevent presence keys from colliding with Object.prototype properties members, crashing the JS Presence client
  • Enforce longpoll batch size introduced in 1.8.6. This is additional hardening against CVE-2026-32689. If your application sends events with a very high frequency and uses long polling, such that a single longpoll request would exceed 100 events, you should update to 1.8.7 first.
Commits
  • 734c8d1 Release v1.8.9
  • beffc4d fix presence keys colliding with object prototype chain
  • 16e295d Limit the number of channels a single transport process can join
  • 211ff62 Allow authToken to be a function (#6751)
  • 6cb2a83 Enforce longpoll batch size
  • 5bf1ce6 Add missing test file
  • 046accc Normalize route verb while grouping
  • 21d1462 Group routes by verb during compilation (#6739)
  • 9d3f1f6 phx.gen.release: Document new Bob Web UI (#6721)
  • afcac09 Bump undici from 7.25.0 to 7.28.0 (#6736)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies elixir Pull requests that update elixir code labels Jul 8, 2026
Bumps [phoenix](https://github.com/phoenixframework/phoenix) from 1.8.8 to 1.8.9.
- [Release notes](https://github.com/phoenixframework/phoenix/releases)
- [Changelog](https://github.com/phoenixframework/phoenix/blob/v1.8.9/CHANGELOG.md)
- [Commits](phoenixframework/phoenix@v1.8.8...v1.8.9)

---
updated-dependencies:
- dependency-name: phoenix
  dependency-version: 1.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/hex/phoenix-1.8.9 branch from b158cbd to e9ffa57 Compare July 8, 2026 15:26
@princemaple
princemaple merged commit fb2f3a1 into main Jul 8, 2026
16 checks passed
@dependabot
dependabot Bot deleted the dependabot/hex/phoenix-1.8.9 branch July 8, 2026 15:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies elixir Pull requests that update elixir code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant