Post

Steffen Deusch
@steffend.me

There are no major CVEs for latest Phoenix 1.5+. We provide security patches for the last 4 minor versions, which include 1.5, 1.6, 1.7 and 1.8 at the moment. Apps using old Phoenix should still update, for sure, but not necessarily for security reasons. See github.com/phoenixframe....

Steffen Deusch
@steffend.me

As a general note: a common misconception is also that people think they have to copy whatever changes we did to the generators. That's not the case. You can of course do that, but it's in no way a requirement to update to later Phoenix versions. It's 1.x, so updates are generally non-breaking.

0 reposts2 likes

Steffen Deusch
@steffend.me

I know I’m late to hear the latest episode, but since it looks like that last post was not fully clear: what I’m trying to say is that I’ve seen people saying something similar to “oh we’re still on 1.6 because we use Phoenix.View and didn’t have time to update to Phoenix.Component“ or similar.

Steffen Deusch
@steffend.me

But that’s not a reason not to update, since generally old patterns are at most deprecated and your existing code will still work (just add phoenix_view as a dependency for that example). So people sometimes feel like they need to update to the latest and greatest idioms to use latest Phoenix.

Steffen Deusch
@steffend.me

But the existing code is still completely fine even on latest 1.8. There is one very good reason to always update to latest, even while older versions still get security patches: they don’t get bug fixes. So you might run into known issues on older versions that won’t get fixed.

Gus Workman
@gworkman.bsky.social

Thanks for the clarification on that! We’ll include a mention in next episode :) Super thanks to your efforts on Phoenix maintenance, I hadn’t realized that versions all the way back to 1.5 are getting patches 💜