Skip to content
This repository was archived by the owner on Jul 10, 2026. It is now read-only.

Bump phoenix from 1.7.23 to 1.7.24 - #1195

Merged
kodiakhq[bot] merged 1 commit into
masterfrom
dependabot/hex/phoenix-1.7.24
Jul 7, 2026
Merged

Bump phoenix from 1.7.23 to 1.7.24#1195
kodiakhq[bot] merged 1 commit into
masterfrom
dependabot/hex/phoenix-1.7.24

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 7, 2026

Copy link
Copy Markdown
Contributor

Bumps phoenix from 1.7.23 to 1.7.24.

Changelog

Sourced from phoenix's changelog.

1.7.24 (2026-07-07)

Security fixes

  • CVE-2026-56811: Add a max_channels_per_transport option (defaulting to 100) to prevent a single client from spawning an unbounded number of channels (processes), eventually exhausting the server's memory or process limit.
  • CVE-2026-56812: Prevent presence keys from colliding with Object.prototype properties members, crashing the JS Presence client
  • Enforce longpoll batch size introduced in 1.7.22. This is additional hardening against CVE-2026-32689. If your application sends events with a very high frequency and uses long polling, such that a single longpoll request would exceed 100 events, you should update to 1.7.23 first.
Commits
  • 5447f02 Release v1.7.24
  • b90b225 fix presence keys colliding with object prototype chain
  • a612100 Limit the number of channels a single transport process can join
  • 491f5f1 Enforce longpoll batch size
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [phoenix](https://github.com/phoenixframework/phoenix) from 1.7.23 to 1.7.24.
- [Release notes](https://github.com/phoenixframework/phoenix/releases)
- [Changelog](https://github.com/phoenixframework/phoenix/blob/v1.7.24/CHANGELOG.md)
- [Commits](phoenixframework/phoenix@v1.7.23...v1.7.24)

---
updated-dependencies:
- dependency-name: phoenix
  dependency-version: 1.7.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file elixir Pull requests that update Elixir code labels Jul 7, 2026
@kodiakhq
kodiakhq Bot merged commit 1a2b2fa into master Jul 7, 2026
1 of 4 checks passed
@dependabot
dependabot Bot deleted the dependabot/hex/phoenix-1.7.24 branch July 7, 2026 14:33
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

dependencies Pull requests that update a dependency file elixir Pull requests that update Elixir code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants