Phoenix 1.6

Last reviewed Sep 20, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. Erlang/OTP 27119 lines · 3.4K tokens
  2. Elixir 1.1859 lines · 1.9K tokens
  3. Phoenix 1.677 lines · 3.5K tokens
Total255 lines · 8.8K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 95
  • 117
  • 201
  • 204
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 297
  • 306
  • 307
  • 311
  • 312
  • 319
  • 338
  • 347
  • 352
  • 362
  • 367
  • 384
  • 400
  • 407
  • 434
  • 444
  • 470
  • 494
  • 502
  • 522
  • 532
  • 552
  • 601
  • 611
  • 613
  • 614
  • 639
  • 674
  • 732
  • 755
  • 770
  • 772
  • 789
  • 799
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 940
  • 1004
  • 1021
  • 1275
  • 1287
  • 1395

Prompt Preview

Apply the Elixir 1.18 and Erlang/OTP 27 prompts first. These rules cover Phoenix 1.6, its Phoenix.View rendering stack, generated controller authentication, and socket transports. Phoenix 1.6 receives security patches only. When the application uses Ecto, also apply the Ecto prompt for its installed version, and review LiveView against its exact installed version separately.

Patch scope and generated code

  • Run the newest Phoenix 1.6 release and deploy the server together with the JavaScript client built from that same release, because updating the Hex dependency doesn't replace browser assets that were already built. Phoenix ships security patches as new patch releases on its four newest minor branches and fixes bugs only on the newest.
  • Check the Plug release that mix.lock resolves rather than Phoenix's ~> 1.10 requirement, which admits Plug releases with known multipart, parameter-decoding, and cookie-attribute flaws. Plug ships security fixes as patches on each minor branch its support policy lists, so take the newest patch of one of those branches; a newer minor at an older patch can still be vulnerable.
  • With the Cowboy adapter, check plug_cowboy in mix.lock as well. On plug_cowboy 2.0.0 through 2.8.0, which predate the 2.8.1 fix, a client that reaches a Plug.Cowboy HTTPS listener over HTTP/2 can exhaust the atom table and crash the VM, so on those releases terminate HTTP/2 at a proxy that forwards HTTP/1.1 to Phoenix.
  • Keep dependency resolution within Phoenix's declared plug ~> 1.10 and plug_crypto ~> 1.2 constraints; do not force