Skip to content

PR: Update Tutorial to Phoenix v.1.8.9 #330 - #331

Closed
nelsonic wants to merge 14 commits into
mainfrom
phx-1.8-issue#330
Closed

nelsonic wants to merge 14 commits into
mainfrom
phx-1.8-issue#330

Conversation

@nelsonic

@nelsonic nelsonic commented Apr 14, 2026 •

Copy link
Copy Markdown
Member

This PR updates the project to latest Phoenix (v1.8.9)

  • delete old project files ✂️
  • Update docs while reading them 📝
  • re-create project 🪄

Note: Applied T2h to this PR (and corresponding issue) because that's how I long I expect it to take.
But in no way do I have a T2h block of uninterrupted time for this right now ...
Going to chip away at it for the next few days (weeks? 😬 ) until it's done.
Wish me luck! 🍀 🤞

@nelsonic nelsonic added enhancement New feature or request in-progress technical T2h elixir Pull requests that update elixir code labels Apr 14, 2026
@nelsonic

Copy link
Copy Markdown
Member Author

Sadly, I have higher priority tasks that I need to be focussed on than this right now ... 🙃
So pausing until the weekend. ⏸️ ⏳

@nelsonic nelsonic changed the title PR: Update Tutorial to Phoenix v.1.8.5 #330 PR: Update Tutorial to Phoenix v.1.8.8 #330 Jun 14, 2026
@nelsonic

Copy link
Copy Markdown
Member Author

@nelsonic nelsonic changed the title PR: Update Tutorial to Phoenix v.1.8.8 #330 PR: Update Tutorial to Phoenix v.1.8.9 #330 Jul 30, 2026
@nelsonic

Copy link
Copy Markdown
Member Author

Will pick this up on my laptop 💻 as soon as my other work is done. 🤞

@nelsonic nelsonic self-assigned this Jul 30, 2026
@github-project-automation github-project-automation Bot moved this to More ToDo ThanCanEver Be Done in Nelson's List Jul 30, 2026
@nelsonic nelsonic moved this from More ToDo ThanCanEver Be Done to In progress in Nelson's List Jul 30, 2026
@nelsonic

Copy link
Copy Markdown
Member Author
image

@nelsonic

Copy link
Copy Markdown
Member Author

Just pulled this down to try and continue.
Ran:

mix deps.get

Got:

Found packages with security advisories, see above for details
lazy_html 0.1.12 VULNERABLE!
    EEF-CVE-2026-92106 (LOW)
    aka: CVE-2026-92106, GHSA-8rqp-v692-v82q
    lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
    https://osv.dev/vulnerability/EEF-CVE-2026-92106
  phoenix_html 4.3.0 VULNERABLE!
    EEF-CVE-2026-117645 (MEDIUM)
    aka: CVE-2026-117645
    Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
    https://osv.dev/vulnerability/EEF-CVE-2026-117645
  plug_crypto 2.2.0 VULNERABLE!
    EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963
  ssl_verify_fun 1.1.7 VULNERABLE!
    EEF-CVE-2026-117666 (CRITICAL)
    aka: CVE-2026-117666, GHSA-7gw2-hphm-c5px
    ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
    https://osv.dev/vulnerability/EEF-CVE-2026-117666
...

Not Gucci ... 🙃

Ran:

mix hex.audit
Found packages with security advisories, see above for details
You have added/upgraded packages you could sponsor, run `mix hex.sponsor` to learn more
a@mbp16 phoenix-chat-example % mix hex.audit
Advisories:
  ecto 3.14.2 - EEF-CVE-2026-118391 (HIGH)
    aka: CVE-2026-118391, GHSA-cxjx-vmm2-qr8r
    Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto
    https://osv.dev/vulnerability/EEF-CVE-2026-118391

  plug_crypto 2.2.0 - EEF-CVE-2026-105963 (MEDIUM)
    aka: CVE-2026-105963, GHSA-ffw9-w85g-f2vh
    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
    https://osv.dev/vulnerability/EEF-CVE-2026-105963

  hackney 4.7.4 - EEF-CVE-2026-112880 (LOW)
    aka: CVE-2026-112880
    CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
    https://osv.dev/vulnerability/EEF-CVE-2026-112880

  hackney 4.7.4 - EEF-CVE-2026-97200 (HIGH)
    aka: CVE-2026-97200
    Unbounded response body buffering and decompression in hackney
    https://osv.dev/vulnerability/EEF-CVE-2026-97200

  hackney 4.7.4 - EEF-CVE-2026-115700 (MEDIUM)
    aka: CVE-2026-115700
    SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
    https://osv.dev/vulnerability/EEF-CVE-2026-115700

  hackney 4.7.4 - EEF-CVE-2026-115693 (CRITICAL)
    aka: CVE-2026-115693
    Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
    https://osv.dev/vulnerability/EEF-CVE-2026-115693

  hackney 4.7.4 - EEF-CVE-2026-113440 (MEDIUM)
    aka: CVE-2026-113440
    HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
    https://osv.dev/vulnerability/EEF-CVE-2026-113440

  jose 1.11.12 - EEF-CVE-2026-65625 (MEDIUM)
    aka: CVE-2026-65625, GHSA-6gxw-6f7r-cjr6
    Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose
    https://osv.dev/vulnerability/EEF-CVE-2026-65625

  jose 1.11.12 - EEF-CVE-2026-65626 (MEDIUM)
    aka: CVE-2026-65626, GHSA-vwvr-f994-6j9j
    Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose
    https://osv.dev/vulnerability/EEF-CVE-2026-65626

  jose 1.11.12 - EEF-CVE-2026-65627 (MEDIUM)
    aka: CVE-2026-65627, GHSA-wfpv-qxp8-x5gm
    Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
    https://osv.dev/vulnerability/EEF-CVE-2026-65627

  jose 1.11.12 - EEF-CVE-2026-65628 (MEDIUM)
    aka: CVE-2026-65628, GHSA-fpj2-9h59-32pp
    Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
    https://osv.dev/vulnerability/EEF-CVE-2026-65628

  jose 1.11.12 - EEF-CVE-2026-65629 (HIGH)
    aka: CVE-2026-65629, GHSA-h4gx-8jq2-mfhc
    Weak PBKDF2 parameters for password-encrypted private-key export in jose
    https://osv.dev/vulnerability/EEF-CVE-2026-65629

  jose 1.11.12 - EEF-CVE-2026-65630 (MEDIUM)
    aka: CVE-2026-65630, GHSA-xvr2-gggj-h2pp
    Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
    https://osv.dev/vulnerability/EEF-CVE-2026-65630

  jose 1.11.12 - EEF-CVE-2026-65631 (MEDIUM)
    aka: CVE-2026-65631, GHSA-3m45-vrpj-xmrq
    erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service
    https://osv.dev/vulnerability/EEF-CVE-2026-65631

  jose 1.11.12 - EEF-CVE-2026-65632 (MEDIUM)
    aka: CVE-2026-65632, GHSA-44hw-rpw9-mwg4
    ECDSA signature length is not validated in jose, allowing signature malleability
    https://osv.dev/vulnerability/EEF-CVE-2026-65632

  phoenix_html 4.3.0 - EEF-CVE-2026-117645 (MEDIUM)
    aka: CVE-2026-117645
    Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
    https://osv.dev/vulnerability/EEF-CVE-2026-117645

  bandit 1.12.5 - EEF-CVE-2026-114216 (MEDIUM)
    aka: CVE-2026-114216, GHSA-w5wc-g2hc-g7m2
    Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-114216

  bandit 1.12.5 - EEF-CVE-2026-108525 (HIGH)
    aka: CVE-2026-108525, GHSA-c3g7-2pg5-qvwh
    HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-108525

  bandit 1.12.5 - EEF-CVE-2026-105659 (HIGH)
    aka: CVE-2026-105659, GHSA-69m6-wcv4-rwcf
    HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-105659

  bandit 1.12.5 - EEF-CVE-2026-105660 (MEDIUM)
    aka: CVE-2026-105660, GHSA-v53v-9hvg-37jf
    Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-105660

  bandit 1.12.5 - EEF-CVE-2026-116078 (HIGH)
    aka: CVE-2026-116078, GHSA-pxjf-g536-7r93
    HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-116078

  bandit 1.12.5 - EEF-CVE-2026-109584 (HIGH)
    aka: CVE-2026-109584, GHSA-7gfj-7gvq-3xqj
    HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-109584

  bandit 1.12.5 - EEF-CVE-2026-108529 (HIGH)
    aka: CVE-2026-108529, GHSA-j363-h72p-296m
    SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-108529

  bandit 1.12.5 - EEF-CVE-2026-110314 (MEDIUM)
    aka: CVE-2026-110314, GHSA-2v5v-8f9v-xh85
    WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-110314

  bandit 1.12.5 - EEF-CVE-2026-110499 (HIGH)
    aka: CVE-2026-110499, GHSA-47x4-3fxf-82fr
    Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-110499

  bandit 1.12.5 - EEF-CVE-2026-111101 (HIGH)
    aka: CVE-2026-111101, GHSA-jwh3-j29h-qfmw
    HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-111101

  bandit 1.12.5 - EEF-CVE-2026-111103 (HIGH)
    aka: CVE-2026-111103, GHSA-2238-pgfc-w82m
    HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-111103

  bandit 1.12.5 - EEF-CVE-2026-113436 (HIGH)
    aka: CVE-2026-113436, GHSA-29cr-8477-rg6r
    Quadratic bignum parsing of Content-Length and Host port values in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-113436

  bandit 1.12.5 - EEF-CVE-2026-114213 (HIGH)
    aka: CVE-2026-114213, GHSA-cpx7-qf6w-jc63
    WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-114213

  bandit 1.12.5 - EEF-CVE-2026-115269 (HIGH)
    aka: CVE-2026-115269, GHSA-p2qv-vx88-385x
    HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
    https://osv.dev/vulnerability/EEF-CVE-2026-115269

  lazy_html 0.1.12 - EEF-CVE-2026-92106 (LOW)
    aka: CVE-2026-92106, GHSA-8rqp-v692-v82q
    lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
    https://osv.dev/vulnerability/EEF-CVE-2026-92106

  ssl_verify_fun 1.1.7 - EEF-CVE-2026-117666 (CRITICAL)
    aka: CVE-2026-117666, GHSA-7gw2-hphm-c5px
    ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
    https://osv.dev/vulnerability/EEF-CVE-2026-117666

  decimal 3.1.1 - EEF-CVE-2026-97853 (MEDIUM)
    aka: CVE-2026-97853, GHSA-6c27-994x-c52f
    Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS
    https://osv.dev/vulnerability/EEF-CVE-2026-97853

Found packages with security advisories

This is a lot of advisories for a "stock" Phoenix project. 😫

mix deps.update --all

Ref: https://hexdocs.pm/mix/Mix.Tasks.Deps.Update.html
Good read: https://paraxial.io/blog/hex-security

@nelsonic

Copy link
Copy Markdown
Member Author
mix c
Running ExUnit with seed: 170685, max_cases: 20

.....
Finished in 0.07 seconds (0.01s async, 0.06s sync)

Result: 5 passed
----------------
COV    FILE                                        LINES RELEVANT   MISSED
  0.0% lib/chat.ex                                     9        0        0
  0.0% lib/chat/repo.ex                                5        0        0
 71.4% lib/chat_web/components/layouts.ex            160       21        6
100.0% lib/chat_web/controllers/error_html.ex         24        1        0
100.0% lib/chat_web/controllers/error_json.ex         21        1        0
100.0% lib/chat_web/controllers/page_controller        7        1        0
  0.0% lib/chat_web/controllers/page_html.ex          10        0        0
  0.0% lib/chat_web/endpoint.ex                       51        0        0
100.0% lib/chat_web/router.ex                         23        2        0
[TOTAL]  76.9%
----------------
Generating report...
Saved to: cover/
FAILED: Expected minimum coverage of 100%, got 76.9%.

The offending file is: lib/chat_web/components/layouts.ex checking it now.

@nelsonic

Copy link
Copy Markdown
Member Author
Error: ENOENT: no such file or directory, scandir '/phoenix-chat-example/deps/heroicons/optimized/24/outline'
** (Mix) `mix tailwind chat` exited with 1
Error: ENOENT: no such file or directory, scandir deps/heroicons/optimized/24/outline 

Read phoenixframework/tailwind#119 but sadly not helpful. 🙃

@nelsonic

Copy link
Copy Markdown
Member Author

Ran:

mix phx.server

See the following in terminal:

[info] GET /assets/css/app.css
[debug] ** (Phoenix.Router.NoRouteError) no route found for GET /assets/css/app.css (ChatWeb.Router)
    (chat 1.8.16) deps/phoenix/lib/phoenix/router.ex:477: ChatWeb.Router.call/2
    (chat 1.8.16) lib/chat_web/endpoint.ex:1: ChatWeb.Endpoint.plug_builder_call/2
    (chat 1.8.16) deps/plug/lib/plug/debugger.ex:155: ChatWeb.Endpoint."call (overridable 3)"/2
    (chat 1.8.16) lib/chat_web/endpoint.ex:1: ChatWeb.Endpoint.call/2
    (phoenix 1.8.16) lib/phoenix/endpoint/sync_code_reload_plug.ex:22: Phoenix.Endpoint.SyncCodeReloadPlug.do_call/4
    (bandit 1.14.1) lib/bandit/pipeline.ex:168: Bandit.Pipeline.call_plug!/2
    (bandit 1.14.1) lib/bandit/pipeline.ex:44: Bandit.Pipeline.run/5
    (bandit 1.14.1) lib/bandit/http1/handler.ex:23: Bandit.HTTP1.Handler.handle_data/3
    (bandit 1.14.1) lib/bandit/delegating_handler.ex:18: Bandit.DelegatingHandler.handle_data/3
    (thousand_island 1.6.0) lib/thousand_island/handler.ex:636: ThousandIsland.Handler.invoke_callback/2
    (bandit 1.14.1) lib/bandit/delegating_handler.ex:8: Bandit.DelegatingHandler.handle_info/2
    (stdlib 8.1.1) gen_server.erl:2434: :gen_server.try_handle_info/3
    (stdlib 8.1.1) gen_server.erl:2420: :gen_server.handle_msg/3
    (stdlib 8.1.1) proc_lib.erl:333: :proc_lib.init_p_do_apply/3

🤷‍♂️

@nelsonic

Copy link
Copy Markdown
Member Author

mix.exs:

defmodule Chat.MixProject do
  use Mix.Project

  def project do
    [
      app: :chat,
      version: "1.8.16",
      elixir: "~> 1.17",
      elixirc_paths: elixirc_paths(Mix.env()),
      start_permanent: Mix.env() == :prod,
      aliases: aliases(),
      deps: deps(),
      compilers: [:phoenix_live_view] ++ Mix.compilers(),
      listeners: [Phoenix.CodeReloader],
      test_coverage: [tool: ExCoveralls]
    ]
  end

  # Configuration for the OTP application.
  #
  # Type `mix help compile.app` for more information.
  def application do
    [
      mod: {Chat.Application, []},
      extra_applications: [:logger, :runtime_tools]
    ]
  end

  def cli do
    [
      preferred_envs: [
        c: :test,
        ci: :test,
        coveralls: :test,
        "coveralls.detail": :test,
        "coveralls.json": :test,
        "coveralls.post": :test,
        "coveralls.html": :test,
        precommit: :test,
        t: :test
      ]
    ]
  end

  # Specifies which paths to compile per environment.
  defp elixirc_paths(:test), do: ["lib", "test/support"]
  defp elixirc_paths(_), do: ["lib"]

  # Specifies your project dependencies.
  #
  # Type `mix help deps` for examples and options.
  defp deps do
    [
      {:phoenix, "~> 1.8.16"},
      {:phoenix_ecto, "~> 4.5"},
      {:ecto_sql, "~> 3.13"},
      {:postgrex, ">= 0.0.0"},
      {:phoenix_html, "~> 4.1"},
      {:phoenix_live_reload, "~> 1.2", only: :dev},
      {:phoenix_live_view, "~> 1.2.1"},
      {:lazy_html, ">= 0.1.0", only: :test},
      {:esbuild, "~> 0.10", runtime: Mix.env() == :dev},
      {:tailwind, "~> 0.5", runtime: Mix.env() == :dev},
      {:heroicons, "~> 0.5.5"},
      {
        :daisyui,
        github: "saadeghi/daisyui",
        tag: "v5.7.50",
        sparse: "packages/bundle",
        app: false,
        compile: false,
        depth: 1
      },
      {:floki, ">= 0.30.0", only: :test},
      {:telemetry_metrics, "~> 1.0"},
      {:telemetry_poller, "~> 1.0"},
      {:jason, "~> 1.2"},
      {:dns_cluster, "~> 0.2.0"},
      {:bandit, "~> 1.5"},

      # Test coverage: github.com/parroty/excoveralls
      {:excoveralls, "~> 0.18.0", only: [:test, :dev]},
      # Tidy Code: credo.hexdocs.pm
      {:credo, "~> 1.7", only: [:dev, :test], runtime: false},
      # Auth: github.com/dwyl/auth_plug
      {:auth_plug, "~> 1.6"}
    ]
  end

  # Aliases are shortcuts or tasks specific to the current project.
  # For example, to install project dependencies and perform other setup tasks, run:
  #
  #     $ mix setup
  #
  # See the documentation for `Mix` for more info on aliases.
  defp aliases do
    [
      setup: ["deps.get", "ecto.setup", "assets.setup", "assets.build"],
      "ecto.setup": ["ecto.create", "ecto.migrate", "run priv/repo/seeds.exs"],
      "ecto.reset": ["ecto.drop", "ecto.setup"],
      test: ["ecto.create --quiet", "ecto.migrate --quiet", "test"],
      "assets.setup": ["tailwind.install --if-missing", "esbuild.install --if-missing"],
      "assets.build": ["compile", "tailwind chat", "esbuild chat"],
      "assets.deploy": [
        "tailwind chat --minify",
        "esbuild chat --minify",
        "phx.digest"
      ],
      precommit: ["compile --warnings-as-errors", "deps.unlock --unused", "format", "test"],
      c: ["coveralls.html"],
      ci: ["coveralls.json"],
      s: ["phx.server"],
      t: ["test"]
    ]
  end
end

@nelsonic

Copy link
Copy Markdown
Member Author

@nelsonic

Copy link
Copy Markdown
Member Author

Superseded by: #352

@nelsonic nelsonic closed this Nov 12, 2026
@github-project-automation github-project-automation Bot moved this from In progress to Done in Nelson's List Nov 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

elixir Pull requests that update elixir code enhancement New feature or request in-progress T2h technical

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

1 participant