News includes a major milestone for Elixir's set-theoretic types as inference of all language constructs is completed and merged with Elixir v1.20.0-rc.5 hot on its heels, OTP 29.0 drops as a major release with secure-by-default SSH, post-quantum SSL key exchange, Erlang doctests, and more, a wave of high-severity CVEs hits the Elixir and Phoenix stack prompting the EEF CNA to take on a larger work load as AI-driven vulnerability reports surge, string processing in Elixir gets a serious speed boost via SWAR (SIMD Within A Register) optimizations with 1.5–5x improvements across Base and String operations, and a handy tip for enabling state-preserving hot reloads in Phoenix LiveView with just a small dev.exs config tweak, and more!

*Elixir Community News*

- Paraxial.io is sponsoring today's show! Sign up for a free trial of Paraxial.io today and mention Thinking Elixir when you schedule a demo for a special offer. – https://paraxial.io/?utm_source=thinkingelixir&utm_campaign=thinkingelixir-oct2025
- José Valim announces that "inference of all language constructs" for Elixir's set-theoretic types has been completed and merged. – https://x.com/josevalim/status/2054202778990383152
- The meta-issue tracking set-theoretic type inference of all Elixir constructs, now wrapped up. Includes occurrence typing for high-degree precision. A new RC is expected soon on the way to Elixir v1.20. – https://github.com/elixir-lang/elixir/issues/14558
- José Valim announces the release of Elixir v1.20.0-rc.5 with the latest batch of typing and performance improvements. – https://x.com/josevalim/status/2054631923893313662
- Release notes for Elixir v1.20.0-rc.5. The team says they are very close to the final release and encourages users to try it and report issues. – https://github.com/elixir-lang/elixir/releases/tag/v1.20.0-rc.5
- The EEF CNA (CVE Numbering Authority) has seen a large increase in volume of CVEs, largely driven by AI tools. They are considering a funding campaign to cover the increased costs of fixing and administering CVEs. – https://cna.erlef.org/
- Tyler Young highlights a heap of recent high-severity CVEs published against the typical Elixir + Phoenix web stack. Packages to check include cowboy, cowlib, plug, bandit, and decimal – https://bsky.app/profile/tylerayoung.com/post/3mlsxbdmrw22e
- Full list of CVEs issued by the EEF CNA. – https://cna.erlef.org/cves/
- The mix_audit package can be installed and run via `mix deps.audit` to check your app against up-to-date published CVEs. Recommended to make it part of your CI pipeline. – https://hex.pm/packages/mix_audit
- OTP 29.0 released as a new major version. Highlights include unsafe function warnings, SSH daemon now defaults to disabled shell/exec services, SFTP no longer enabled by default, post-quantum hybrid key exchange as default in SSL, ANSI terminal support, Erlang doctest support, and xref now handles ignore_xref natively. Note that 32-bit Windows builds are no longer available. – https://www.erlang.org/news/188
- Peter Ullrich highlights performance improvements landing in Elixir — Base.valid(16|32|64)? is now 1.5-2.8x faster thanks to SWAR (SIMD Within A Register) optimizations. – https://bsky.app/profile/peterullrich.com/post/3mlmb7kwgoc2w
- PR adding SWAR (SIMD Within A Register) versions of Base validations to Elixir. SWAR treats a CPU register like a small vector to check multiple bytes at once instead of one by one. – https://github.com/elixir-lang/elixir/pull/15357
- PR applying SWAR optimization to ASCII fast paths in String.length/1 and String.slice, yielding 2-5x improvements for pure-ASCII strings. – https://github.com/elixir-lang/elixir/pull/15255
- The SWAR technique was also applied to Erlang itself, accelerating binary ASCII traversal using 56-bit SWAR. Improvements range from 0x to 2x depending on the operation. – https://github.com/erlang/otp/pull/10948
- The creator of the live_vue project shares a tip for enabling state-preserving hot reloads in Phoenix LiveView. – https://www.linkedin.com/posts/jskalec_phoenix-liveview-has-one-massive-dx-feature-share-7459520758126473216-glO8

Podcast Episode - http://podcast.thinkingelixir.com/304

*Find us online*
- Message on Bluesky - https://bsky.app/profile/thinkingelixir.com
- Message on Twitter/X - https://x.com/ThinkingElixir
- Email the show - show@thinkingelixir.com
- Mark Ericksen on Twitter/X - https://x.com/brainlid
- Mark Ericksen on Bluesky - https://bsky.app/profile/brainlid.bsky.social
- David Bernheisel on Bluesky - https://bsky.app/profile/david.bernheisel.com

*Like, Subscribe, and Share!* 👍
Subscribe to stay updated with our latest episodes. Hit the bell icon to get notified. If you found this helpful, please give it a thumbs up and share it with your friends!

ElixirStatus offers insights into Elixir programming language, OTP framework, and functional programming principles, providing articles, tutorials, and community updates for Elixir enthusiasts. By exploring ElixirStatus's curated content, developers can learn about concurrency primitives, fault-tolerance mechanisms, and metaprogramming techniques for building scalable and fault-tolerant distributed systems. Whether you're a backend developer, system architect, or Erlang/Elixir enthusiast, ElixirStatus offers resources to deepen your understanding of Elixir and Erlang ecosystem and contribute to the vibrant community of Elixir developers.

ElixirStatus

Episode 304 of the Thinking Elixir podcast covers several Elixir and Erlang ecosystem updates. Elixir 1.20 RC5 has been released, completing inference of all language constructs for set theoretic types and including SWAR-based string performance optimizations (2-5x faster for ASCII strings). OTP 29.0 is out with notable changes: SSH daemon now disabled by default, SFTP no longer auto-started, post-quantum hybrid key exchange as default, Erlang doc test support, and dropped 32-bit Windows builds. The Erlang Ecosystem Foundation's CNA is seeing a surge in CVE reports (partly AI-driven), with critical Elixir libraries like Cowboy, Cowlib, Plug, Bandit, and Decimal needing updates — the mix_audit tool can automate CVE scanning in CI. Finally, a three-line config change in dev.exs enables state-preserving hot reloads in Phoenix LiveView instead of full page refreshes.

Thinking Elixir Podcast 304: Types, CVEs, and Hot Reloads