Macro Mayhem, the podcast that picked up where Thinking Elixir left off, is three episodes in and showing no signs of slowing down. Episode 003 landed this week, and it surfaced enough good ecosystem news that it deserves a written round-up of its own.
Phoenix and Bandit, by the numbers
Praia Labs published two posts putting actual numbers on things we usually only have vibes for. Their Phoenix version adoption analysis of Hex download data has Phoenix 1.8.x at roughly 64% of monthly downloads by mid-2026 (it crossed the 50% line back in March), with 1.7.x still above 28%. The companion Bandit adoption post is the fun one: Bandit reached download parity with Cowboy in July, up from about 2% in late 2023, with the big jump coming when it became the Phoenix default. Bandit users also patch faster: 38% were on a new security release within three days, versus 28% for Cowboy. The usual caveat applies, downloads are a proxy rather than a census, but the trend lines are hard to argue with.
Sobelow 0.15
The Phoenix security scanner Sobelow shipped
0.15.0, its first
release since October 2025, from its new home at sobelow/sobelow. The
headline: a --no-router flag so plain Elixir projects can be scanned, not
just Phoenix apps. It also gains Elixir 1.20 support, a usage-rules.md so AI
coding assistants use it properly, and an end-to-end test harness that lifted
coverage from 29% to 67%. Given last month's CVE volume,
having the scanner actively maintained again is very welcome.
De-slopping AI-generated code
A whole cottage industry of Credo plugins has sprung up to catch the smells
LLMs leave behind. ExSlop is the most
developed: 40 checks for things like blanket rescues, narrator comments and
anti-idiomatic Enum usage. Llamex
targets LLM-refactor smells and cheerfully admits to being largely vibe-coded
itself, and Jump's credo_checks
includes checks aimed squarely at vacuous LLM-generated tests.
Related, and worth sitting with: the Syntax podcast's Vibe Health survey of 1,252 developers found 59% feel their coding skills are diminishing with heavy AI use, 54% report less enjoyment or flow, and 65% feel pressure to produce more. Tools that keep the slop out of your codebase are good; keeping your own skills sharp is better. Come practise both at our September Hack Night.
Elixir for Finance
Elixir for Finance is a new book from Dr. Dimitrios Koutmos and Alexander Koutmos, edited by Hugo Baraúna: market analysis with Livebook, Explorer, Scholar and Nx, from pulling FRED and Yahoo Finance data through portfolio risk and backtesting. It's in beta with five chapters so far, and every chapter ships as runnable Livebook notebooks.
Quick hits
Tidewave Connect lets the coding agent you already run in a terminal or editor (Claude Code, Cursor and friends) plug into your running Phoenix app: click an element in the browser and your prompt is enriched with framework traces, while the agent can query the database, read logs and run code in the live app. Dokploy v0.30.0 is out for the self-hosters deploying Phoenix with it, adding external secrets managers and Cloudflare/Route53 DNS automation. And if you want the wider AI security context, the Black Hat USA debrief on the OpenAI and Hugging Face incident is worth an hour, with a good written timeline from Simon Willison.