Phoenix 1.5

Apply the Elixir 1.18 and Erlang/OTP 27 prompts first. These rules cover Phoenix 1.5, its Phoenix.View/EEx application structure, and its HTTP and channel transports. When the application uses Ecto, also apply the Ecto prompt for its installed version. Review an optional LiveView dependency for its actual locked version; the generator uses LiveView 0.15, whose APIs and protections differ from newer LiveView releases.

Version and dependency boundaries

• Run the newest Phoenix 1.5 release and rebuild and deploy the JavaScript client from that same release, because updating the Hex dependency doesn't replace browser assets that were already built, and the Presence fix for CVE-2026-56812 lives in the client. Phoenix ships security patches as new patch releases on its four newest minor branches and fixes bugs only on the newest, and 1.5 is the oldest branch in that window, so it stops getting security patches once Phoenix's next minor ships.
• Check the Plug release that mix.lock resolves rather than Phoenix's ~> 1.10 requirement, which admits Plug releases with known multipart, parameter-decoding, and cookie-attribute flaws. Plug ships security fixes as patches on each minor branch its support policy lists, so take the newest patch of one of those branches; a newer minor at an older patch can still be vulnerable.
• Use the newest plug_crypto 1.2 release within Phoenix's declared dependency constraints. The permitted 1.1.2 line lacks the 1.2.0 rejection of nil key bases and salts; do not force crypto 2.x through an override and assume compatibility.
• Use the Cowboy