{ "id": "liveview", "name": "Phoenix LiveView", "url": "https://dev-news.anonyfox.com/liveview/", "site": "https://github.com/phoenixframework/phoenix_live_view", "ecosystem": "beam", "title": "Phoenix LiveView release history: three lines patched, one kind of bug", "description": "Every Phoenix LiveView release since 2024 from Hex, the support window of each minor line, and the two 2026 advisories where a URL check missed bytes the browser throws away.", "lede": { "date": "2026-10-24", "paragraphs": [ "Phoenix LiveView 1.2.13 went out on 20 October 2026 with eleven bug fixes, most of them in file uploads and form recovery. It is the 14th 1.2 release since 1.2.0 on 10 June. The older lines are still maintained: on 10 August, 1.2.9, 1.1.33 and 1.0.19 went out within four minutes of each other, the first 1.0 release in almost a year.", "Both of this year's advisories come down to the same mistake: a URL check that ignores bytes the browser throws away. In July, 1.2.7 fixed a regression from 1.2.2, where a leading control or space byte let a javascript: URL past the check on <.link href>. In August, the guard behind redirect/2, push_navigate/2 and push_patch/2 turned out to miss tab, line feed and carriage return, in every version since 0.5.0." ] }, "latest": { "version": "1.2.13", "date": "2026-10-20", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.13", "summary": "Handle file reader upload error" }, "stable_releases_since_2024": 83, "prereleases_since_2024": 19, "releases": [ { "version": "1.2.13", "date": "2026-10-20", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.13", "summary": "Handle file reader upload error" }, { "version": "1.2.12", "date": "2026-09-16", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.12", "summary": "Prevent a hook's disconnected method from being called again when already disconnected" }, { "version": "1.2.11", "date": "2026-08-27", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.11", "summary": "Ensure stale diffs are discarded when view rejoins before the initial join succeeds" }, { "version": "1.2.10", "date": "2026-08-20", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.10", "summary": "Preserve onReply exceptions in hook pushEvent / pushEventTo" }, { "version": "1.0.19", "date": "2026-08-10", "url": "https://hex.pm/packages/phoenix_live_view/1.0.19", "summary": null }, { "version": "1.1.33", "date": "2026-08-10", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.1.33", "summary": "CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR" }, { "version": "1.2.9", "date": "2026-08-10", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.9", "summary": "CVE-2026-64941: Fix open redirect in redirect/2 via ASCII tab, LF and CR" }, { "version": "1.2.8", "date": "2026-07-27", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.8", "summary": "Allow cancelling client-side navigation" }, { "version": "1.2.7", "date": "2026-07-13", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.7", "summary": "CVE-2026-58228: Fix scheme validation bypass in Phoenix.LiveView.Utils" }, { "version": "1.2.6", "date": "2026-07-07", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.6", "summary": "Fix HTMLFormatter inserting extra characters in template with multi-codepoint emojis" }, { "version": "1.2.5", "date": "2026-06-30", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.5", "summary": "Ensure Phoenix.LiveView.TagEngine's EEx.Engine deprecation warning includes file and line information" }, { "version": "1.2.4", "date": "2026-06-29", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.4", "summary": "Only warn about missing form ID when recovery actually applies" }, { "version": "1.2.3", "date": "2026-06-16", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.3", "summary": null }, { "version": "1.2.2", "date": "2026-06-16", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.2", "summary": null }, { "version": "1.1.32", "date": "2026-06-12", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.1.32", "summary": "Fix stale events from the previous LiveView being sent to the new LiveView after a live redirect" }, { "version": "1.2.1", "date": "2026-06-12", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.1", "summary": "Fix stale events from the previous LiveView being sent to the new LiveView after a live redirect" }, { "version": "1.2.0", "date": "2026-06-10", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.2.0", "summary": "Support events pushed when connected mount redirects" }, { "version": "1.1.31", "date": "2026-05-29", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.1.31", "summary": "Validate URL scheme in pushpatch / pushnavigate, JS.patch / JS.navigate, and clientside js().patch / js().navigate" }, { "version": "1.1.30", "date": "2026-05-05", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.1.30", "summary": "Ensure internal phx-viewport hook does not crash on update if no scroll container is used , introduced in v1.1.29." }, { "version": "1.1.29", "date": "2026-05-04", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.1.29", "summary": "Prevent JS crash when hook has a duplicate ID" }, { "version": "1.1.28", "date": "2026-03-27", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.1.28", "summary": "Fix race condition that could lead to a JS exception when nested LiveView is removed while it is joining" }, { "version": "1.1.27", "date": "2026-03-10", "url": "https://github.com/phoenixframework/phoenix_live_view/releases/tag/v1.1.27", "summary": "Workaround Chrome bug when patching