15 Jun 2026 · Josh Price

A new home for Elixir Sydney

We've given elixir.sydney a complete rebuild, and along the way we dug up our entire history.

The new site is a small, fast static site built, fittingly, in Elixir with Tableau, the elixir-tools static site generator. The whole thing compiles to plain HTML and is pushed to S3 and served through CloudFront, so it's cheap, fast and has nothing to keep running. Content lives as Markdown and YAML in the repo, and every push to main deploys automatically.

More importantly, it now documents every Elixir Sydney meetup since 2015: more than eighty events and the talks, speakers and recordings that went with them. A lot of that had been scattered across an old site, our Meetup group, GitHub and the Internet Archive, and we've pulled it back together for good.

We've also finally shut down our Meetup.com group (yay!). It served us well for a decade, but it's done, everything now lives here, with RSVPs on Luma.

A few things to explore:

• Events, the full archive, newest first, with talk videos and slides where we have them.
• Speakers, everyone who has ever given a talk, with links to their work. If you spot something wrong, let us know.
• Give a talk, first-time speakers are very welcome, and we're happy to help you shape an idea.

RSVPs now run through Luma, and we hang out in the Elixir community channels linked in the footer.

See you at the next one.

13 Jun 2026 · Josh Price

Fable 5 launched, then vanished three days later

We named tonight's meetup "The Mythos/Fable Edition" after Anthropic's big launch. By the time we actually meet, the models are already gone. The whole thing lasted three days.

On 9 June, Anthropic released Claude Fable 5 and Mythos 5, pitching Fable 5 as its most capable widely-released model and aiming it squarely at long-horizon agentic work. It went out the same day across the Claude API, AWS Bedrock, Microsoft Foundry and the rest.

Then on Friday 12 June, the US Commerce Department directed Anthropic to block foreign nationals from using both models. Rather than carve the world in two, Anthropic disabled Fable 5 and Mythos 5 globally for everyone the same day. As best anyone can tell, the government believes a way to jailbreak Fable 5 surfaced, and the standoff traces back to Anthropic refusing to hand over full access to Claude.

Worth noting from down here: "foreign nationals" includes us. So even setting the jailbreak drama aside, a Sydney developer poking at Fable 5 over the weekend would have watched it blink out regardless.

It's a strange one to sit with. The most capable model anyone had shipped, public on a Tuesday and pulled by Friday, on government order. If you're building agentic tooling on the BEAM, it's a sharp reminder that the model under your abstraction can disappear out from under you. Plan for the provider, and the politics, not just the API.

10 Jun 2026 · Josh Price

Phoenix LiveView 1.2 is out

Phoenix LiveView 1.2 shipped on 10 June 2026, and it rounds out the colocation work that started in 1.1.

The headline is colocated CSS. Where 1.1 let you keep a component's hooks and JS next to its markup, 1.2 lets you do the same with styles, using the CSS @scope rule to stop them leaking into the rest of the page. To make that work the team had to split HEEx compilation into separate tokenization and parsing steps, which is the kind of unglamorous internal change that quietly makes a lot of other things possible.

A few other things worth knowing:

• Phoenix.LiveView.JS commands are now automatically encoded when you send them with push_event, whether you're on Jason or the built-in JSON module.
• Test warnings can be configured by category, so you can tune the checks that run in LiveViewTest.
• Custom formatting for <script> and <style> tags, and module-level HEEx debug annotations.

Worth a look if you're building anything with LiveView. We'll likely touch on it at an upcoming meetup, RSVP on Luma.

05 Jun 2026 · Josh Price

Securing the BEAM: the EEF is now a CNA

Security has been front of mind in the BEAM world this year, and there's good news on how the ecosystem is responding.

The wake-up call: CVE-2025-32433

In April 2025, CVE-2025-32433 landed, an unauthenticated, pre-auth remote code execution flaw in Erlang/OTP's SSH server, scored a maximum CVSS 10.0. A remote attacker could run code before authenticating. It was fixed in OTP-27.3.3, 26.2.5.11 and 25.3.2.20, and it was a clear reminder to keep the runtime patched.

OTP 29 responds

That focus shows up directly in OTP 29: SSH is now secure-by-default (shell and exec disabled unless you enable them), TLS defaults to a post-quantum key exchange, and the compiler warns about unsafe functions, alongside a new set of secure coding guidelines.

The EEF is now a CVE Numbering Authority

The bigger structural change: the Erlang Ecosystem Foundation is now a CNA (a CVE Numbering Authority). It assigns CVE IDs and publishes advisories for active Hex.pm packages and the elixir-lang, erlang, erlef and gleam-lang GitHub orgs, with records published at cna.erlef.org. It's already coordinating real disclosures,recent 2026 advisories cover Tesla middleware, public_key certificate validation, and the Mint HTTP/2 client, which means coordinated, properly-tracked vulnerability handling for the whole ecosystem.

What to do

• Keep Elixir and OTP patched, most BEAM CVEs are fixed quickly across supported release lines.
• Watch cna.erlef.org and the EEF security advisories.
• Run mix hex.audit for retired packages, and consider mix_audit (mix deps.audit) to scan deps against known advisories in CI.

04 Jun 2026 · Josh Price

Elixir 1.20 and OTP 29 have landed

It's been a big few weeks for the BEAM. Both Erlang/OTP 29 and Elixir 1.20 have shipped.

Elixir 1.20

Released on 3 June 2026, Elixir 1.20 is a landmark for the type system. The compiler now performs type inference and gradual type checking of every Elixir program, with no type annotations required. In practice that means Elixir increasingly flags dead code and guaranteed-to-fail typing violations, with a very low false-positive rate.

Highlights:

• Type narrowing across guards, case/cond/with clauses, and conditionals (occurrence typing), so types are more precise inside each branch.
• Much of the standard library is now typed, including most of the Map module and tuples.
• Faster compilation, especially on many-core machines, the benchmarks now put Mix among the fastest build tools on the BEAM.

Erlang/OTP 29

OTP 29 (13 May 2026) leans hard into security and developer ergonomics:

• Secure-by-default SSH (shell/exec disabled unless you opt in) and a post-quantum x25519mlkem768 default key exchange for TLS.
• New warnings for unsafe and potentially-unsafe functions, plus secure coding guidelines.
• Experimental native records (EEP-79), multi-valued comprehensions, an is_integer/3 guard, and JIT improvements for binary matching.

If you want to play with both, point your version manager at Elixir 1.20.1 on OTP 29.0.2, that's what runs this very site's build pipeline.

We'll cover the ecosystem updates at the next meetup, RSVP on Luma.

01 Jun 2026 · Josh Price

HexDocs moves to per-package subdomains

HexDocs has changed how it serves documentation: every package now lives on its own subdomain.

So hexdocs.pm/ecto becomes ecto.hexdocs.pm, and hexdocs.pm/ecto_sql becomes ecto-sql.hexdocs.pm (underscores turn into hyphens). Organisation docs move from org.hexdocs.pm/package to org.hexorgs.pm/package.

The reason is security. Until now every public package was served from the same origin, so a malicious or compromised package could, in principle, reach into another package's docs in the browser. Giving each package its own subdomain hands that isolation to the browser's same-origin policy for free. It's a small, sensible piece of the same security push we wrote about across the ecosystem.

Nothing breaks today, old URLs redirect to the new ones. But if you've got HexDocs links in a README, a blog post, or your socials, it's worth updating them to the subdomain form while you're thinking about it.

Read the announcement on hex.pm.

29 May 2026 · Josh Price

Put your company on the EEF registry

The Erlang Ecosystem Foundation has launched registry.erlef.org, a free, central registry of companies that use Erlang, Elixir and the wider BEAM. It exists to answer the question every one of us has been asked: "who actually uses this?"

The pitch is simple. The registry shows the real scope of the ecosystem across more than sixteen languages, helps people find companies working with the tech they know, and gives the Foundation something concrete to point funders at. Signing up is quick: one person nominates themselves as the contact, verifies by email, and the company is listed. There's no further commitment, and registered contacts get a quarterly update on what's happening across the ecosystem.

If your company works with Elixir or the BEAM, add it to the registry. It takes a few minutes and it makes the community look as big as it actually is. We'd especially love to see more Sydney and Australian names on the list.

And if you can do more than a free listing: the EEF runs on membership and sponsorship. The security work we wrote about recently, the working groups, the infrastructure, all of it is funded by companies that rely on the BEAM. If that's you, supporting the EEF is a direct way to give back to the runtime your business is built on.