304: Types, CVEs, and Hot Reloads

News includes a major milestone for Elixir's set-theoretic types as inference of all language constructs is completed and merged with Elixir v1.20.0-rc.5 hot on its heels, OTP 29.0 drops as a major release with secure-by-default SSH, post-quantum SSL key exchange, Erlang doctests, and more, a wave of high-severity CVEs hits the Elixir and Phoenix stack prompting the EEF CNA to take on a larger work load as AI-driven vulnerability reports surge, string processing in Elixir gets a serious speed boost via SWAR (SIMD Within A Register) optimizations with 1.5–5x improvements across Base and String operations, and a handy tip for enabling state-preserving hot reloads in Phoenix LiveView with just a small dev.exs config tweak, and more!

Show Notes online - http://podcast.thinkingelixir.com/304

Elixir Community News

https://paraxial.io/ – Paraxial.io is sponsoring today's show! Sign up for a free trial of Paraxial.io today and mention Thinking Elixir when you schedule a demo for a special offer.

https://x.com/josevalim/status/2054202778990383152 – José Valim announces that "inference of all language constructs" for Elixir's set-theoretic types has been completed and merged.

https://github.com/elixir-lang/elixir/issues/14558 – The meta-issue tracking set-theoretic type inference of all Elixir constructs, now wrapped up. Includes occurrence typing for high-degree precision. A new RC is expected soon on the way to Elixir v1.20.

https://x.com/josevalim/status/2054631923893313662 – José Valim announces the release of Elixir v1.20.0-rc.5 with the latest batch of typing and performance improvements.

https://github.com/elixir-lang/elixir/releases/tag/v1.20.0-rc.5 – Release notes for Elixir v1.20.0-rc.5. The team says they are very close to the final release and encourages users to try it and report issues.

https://cna.erlef.org/ – The EEF CNA (CVE Numbering Authority) has seen a large increase in volume of CVEs, largely driven by AI tools. They are considering a funding campaign to cover the increased costs of fixing and administering CVEs.

https://bsky.app/profile/tylerayoung.com/post/3mlsxbdmrw22e – Tyler Young highlights a heap of recent high-severity CVEs published against the typical Elixir + Phoenix web stack. Packages to check include cowboy < 2.15.0, cowlib < 2.16.1, plug < 1.19.2, bandit < 1.11.1, and decimal < 3.0.0.

https://cna.erlef.org/cves/ – Full list of CVEs issued by the EEF CNA.

https://hex.pm/packages/mix_audit – The mix_audit package can be installed and run via mix deps.audit to check your app against up-to-date published CVEs. Recommended to make it part of your CI pipeline.