https://abulasar.com/debugging-false-positive-hex-advisory-elixir-ci

Learn how a false-positive Hex advisory stopped an Elixir CI pipeline, why the audit failed safely, and how to investigate and remove a temporary exception.

This release is mostly about performance. Compared with protox 2.0.10:

Compared with protobuf 0.17:

So, in these benchmarks, protox uses less CPU time and fewer reductions for both encoding and decoding, and less memory except when decoding. I’m still investigating this difference on memory allocation, but it seems it’s a tradeoff for faster decoding.

The benchmark suite uses a mix of synthetic messages based on the field distribution used by Google’s protobuf benchmarks, along with real-world schemas from OpenTelemetry and Prometheus.

As usual with benchmarks, your mileage may vary :-).

⚠️ One compatibility note: the generator version has changed in 2.1.0, so code generated with previous versions of protox needs to be regenerated.

Full changelog: https://protox.hexdocs.pm/changelog.html#2-1-0

Each job needs its own disposable VM. Does it also need to rebuild the same data?

SmolBox 0.1.5 adds execution from approved idle, offline checkpoints on Linux and macOS. This article compares rebuilding a summary table, loading it from a prepared image, and restoring it already in RAM. Includes Elixir code, measured results, and when a prepared image is enough.

https://hfiguera.github.io/smolbox/blog/prepare-once-run-in-a-fresh-vm/

The Schedule is up and José Valim is joining us with his keynote: Set-Theoretic Types from Scratch + Extended Q&A!

Two days, two tracks, Haarlem and online, 21-22 October 2026. Training day: 20 October.

Keynotes

• Sam Aaron: Notes on the Synthesis of Time, The Phone Orchestra
• José Valim: Set-Theoretic Types from Scratch + Extended Q&A
• Brooklyn Zelenka: Let It Disconnect: A Local-First Future

Speakers

• Aaron Cruz: ClusterFu**tional: Four Years of Distributed Elixir at NetzeBW
• Alejandro Ramallo: Saying What: A New Declarative Language for the BEAM
• Benedikt Reinartz: Rustler News and Road to 1.0
• Björn Gustavsson: Native Records, Update from the OTP Team
• Brujo Benavides: Idiomatic Erlang: Tips for Erlang Beginners
• Cara Superlativo: Exploring Audio, Music, and Erlang
• Chris Beck: ATProto on Elixir: A Spike into AppView’s DataPlane
• Dan Janowski: The Erlang Ecosystem Frontier: Our Work Ahead
• Davide Bettio: Updates from the AtomVM Landscape
• Ellyse Cedeno: Exploring Audio, Music, and Erlang
• Erik Stenman: Structuring Erlang Code with Application-Level Visibility
• Giacomo Cavalieri: Zero to Embedded with Gleam and AtomVM
• Guillaume Heu: Asterism: An OTP Visualizer in Gleam
• Hayleigh Thompson: Ditch Your API with Lustre Server Components and the Store Pattern
• Iryna Kostiuk: When AI Writes the Code, What Matters More: Language or Runtime?
• Jonatan Männchen: Don’t get pwned by AI Attacks
• Kamila Pokój: Reverse Engineering Marketing for Devs
• Kero van Gelder: Understanding Supervision: Killing Your Actors
• Louis Pilfold: Gleam Language Update
• Lucas Sifoni: From Pure Code to Physical Controls: Designing Hardware in Elixir
• Lukas Backström: Exploring Doctests in Erlang
• Matt Swensen: Hooked on Performance: Taming LiveView’s JavaScript Hooks at Scale
• Mauricio Cassola: TUIs Everywhere
• Peter Ullrich: Don’t get pwned by AI Attacks
• Raimo Niskanen: Do the List Shuffle
• Rebecca Reusch: Building Big Lustre Apps
• Riccardo Binetti: Don’t Crash the BEAM: Safe Interop with Ports and C Nodes
• Robert Fiko: Same Runtime, Different Language: Adapting SAFE for Gleam
• Roberto Aloi: Still Typing Erlang? Developer Experience in the Prompt Era
• Spoorthy Sridhara: Self-Healing Systems and When They Fail
• Tobias Pfeiffer: Stories in Open Source
• Travis Fantina: Ruby Crimes in Elixir Codebases

Tutorials, 20 October, 09:00 to 17:00 CEST

• Match the BEA(M)T: Real-Time Generative Music with Elixir: Luca Dei Zotti
• Gnome Village: Understanding the BEAM Through Processes, Flows, and Runtime Behaviour: Erik Stenman, Måns af Klercker
• Building Production AI Harnesses in Elixir: Chris Beck

Join us in Haarlem or online, 21-22 October, to hear José and many others: codebeameurope.com/#register

The recording of the talk I gave at ElixirConf US 2026 a few days ago is already live. It shows the local-first data layer I built for Hologram, starting with a trip planner that keeps working offline and syncs between browsers, then how it works. The data layer isn’t released yet, it’s still on a branch, but the demo app’s code is public on GitHub as bartblast/hologram_offgrid. Watch it here: https://www.youtube.com/watch?v=jdg_UrLp0bU

Hi there!

That’s a wrap on ElixirConf US 2026, and what a two days it was. Some of the talks are already public here, and here’s a quick recap of what you missed:

• Many jokes from the stage — including the room shouting out their country out loud at the end of every day. You had to be there. (Or, you know, watch it back.)
• Even more jokes from Aaron, our track host, who kept the energy high between sessions.
• Roundtable sessions — which turned out to be overpopulated by 300%!
• The Bingo Bard game — a full board of squares we prepared for you to play throughout the event. Shoutout to the one person who completed the entire thing in the first two hours. We know who you are… (No, we don’t. But we’re impressed.)
• And of course, two full days of talks, keynotes, lightning talks, and roundtables from across the Elixir community.

Want to see all of the talks? Grab the video pass

It’s 3 months of access to the recorded sessions after the conference (edited, ready-to-watch session videos).

Grab the video pass for $199 HERE.

Craving more Elixir?

Join us at Code BEAM Europe 2026! Expect 30+ talks from José Valim and many others, across the Erlang, Elixir, and Gleam communities, informal zone sessions, and two days of the same great people, ideas, and energy — this time in Europe, Haarlem, NL, 21–22 October.

Register for it here.

See you at the next ElixirConf (or Code BEAM event :))

The Code Sync Team

Read metadata from Shoutcast & Icecast streams. This is a fork of shoutcast_ex, updated to work with hackney 4.x and a new Req adapter.

Repo: https://github.com/conradfr/icecast_ex

Hex: https://icecast.hexdocs.pm/readme.html

Plotto is a 100% Elixir charting library with no NIFs or external dependencies. In this episode, we’ll use it to add interactive SVG charts to a Phoenix LiveView dashboard.

https://elixircasts.io/charts-with-plotto-206

Doggo is a headless component library for Phoenix LiveView. 0.15.0 adds hooks for 14 components to implement the APG patterns and contains plenty other improvements.

Release notes: https://github.com/woylie/doggo/releases/tag/0.15.0

Hex: https://hex.pm/packages/doggo

This release has a new dependency planner. It searches for a complete plan and backtracks when a choice doesn’t work out, including deciding the order in which commands run.

https://github.com/fuelen/seed_factory/releases/tag/v0.9.0

I built SmolBox, an Elixir library for running programs in disposable microVMs through SmolVM workers, on Linux and macOS Apple Silicon.

This article walks through a Python example, from submitting work to collecting output files and confirming cleanup. It explains how execution continues independently of the submitting process, how stable execution identities work, and why SmolBox doesn’t silently rerun a command when its outcome is unknown.

Python is just the example. The same lifecycle supports JavaScript, TypeScript and other programs when the approved guest image includes the required runtime and dependencies.

I also explain why I chose smolvm and when an embedded interpreter, local process or function platform might fit better.

How are you handling execution, results and cleanup when running code outside the BEAM?

Read the article

Gleam Gathering is happening again on 27th of February 2027 in London, UK. Tickets sales are up and the Call For Talks is open. https://gleamgathering.com/ The first edition held last year in Bristol was great, even if we had to introduce a lot of people to the concept of Bristol. Come and meet the super friendly community, no surprises there coming from the BEAM.

ExIcon is a generic and extensible icon set downloader and Phoenix LiveView icon component generator. It also works with SVGs in local folders, has various options to configure the generated attributes, and it is a dev-only dependency. Version 1.0.0 was recently released.

https://github.com/woylie/ex_icon

This article aims to show you why I hate AI prose. This includes an explanation of why the text LLMs produce is uniquely difficult to read and comprehend, and why it’s a burden and not a boon to human communication. Use LLMs to write code, by all means: but please, don’t use them to write prose.

https://revelry.co/insights/artificial-intelligence/say-no-to-ai-prose/

ReqCircuitBreaker is a new circuit breaker plugin for Req that uses Fuse under the hood.

Hex: https://hex.pm/packages/req_circuit_breaker

GitHub: https://github.com/scoville/req_circuit_breaker

✏️ CI goes red on a test you never touched, so you click re-run and hope. Nobody on the team can say how often that happens or what it costs.

Your GitHub Actions history already knows. I wrote a prompt that reads it, names the confirmed flakes, and puts an annual dollar figure on the re-runs. Plus the usual Elixir causes to look for.

https://mikezornek.com/posts/2026/9/finding-flaky-tests/?utm_source=elixirstatus&utm_campaign=finding-flaky-tests

ReqSSRF is a new package for preventing SSRF vulnerabilities when making requests to user-provided URLs with Req.

Hex: https://hex.pm/packages/req_ssrf

GitHub: https://github.com/scoville/req_ssrf

We just open-sourced SafeRedirect, a new package for validating, resolving, and redirecting to user-provided URIs to prevent open redirect vulnerabilities.

Hex: https://hex.pm/packages/safe_redirect

GitHub: https://github.com/scoville/safe_redirect

Sept 10-11, live from Chicago. Can’t make the trip? Grab a virtual pass and stream the whole thing from wherever you are.

You get every talk live, the conference app, live Q&A, and access to the recordings. José Valim on set-theoretic types, Chris McCord, Zach Daniel, plus 30+ sessions on Phoenix, LiveView, OTP, Nerves and Nx.

10% off for the forum with code FORUMVISITORS: 👉 elixirconf.com/#register

No flight needed. See you on the stream or on-site!

A free MIT library that counts usage on an ETS hot path (no DB on the write path), gates features by plan with an atomic with_quota/4, and renders live usage in LiveView over PubSub, Syncs with Stripe. Discussion on the forum: https://forum.elixirforum.com/t/aurora-meter-real-time-usage-metering-and-plan-entitlements-for-phoenix/76602

Link: https://github.com/liamkillingback/aurora-meter

Website: https://aurorameter.com