Phoenix 1.8.9

🔒 Channel Capers — Limits, Locked Down

Phoenix 1.8.9 is a patch release with a security-first posture. The headline moves: a single transport process can now only join a bounded number of channels, longpoll batch sizes are enforced, and the official docs picked up security notes for Channel join and handle_in payloads.

• Channel cap — Limits the number of channels a single transport process can join
• Longpoll limits — Batch size is now strictly enforced on longpoll connections
• Security notes — New guidance for Channel join and handle_in payloads
• authToken as function — Socket auth tokens can now be resolved lazily via a function

🗂️ Route Rework — Grouped by Verb

Routes are now grouped by HTTP verb during compilation, with verb normalization cleaned up along the way. It's an internal change, but it makes the router's compiled output easier to reason about and sets up nicer error messages down the line.

🐛 Bug Bashes & Housekeeping

31 commits landed since v1.8.8. Standouts: presence keys can no longer collide with the object prototype chain, phx.gen.release now suggests npm ci over npm install, the installer manages daisyui through mix.exs, and ColocatedCSS explicitly requires Tailwind >= 0.5.

Docs got a refresh too — ExDoc admonitions for requirement blocks, .md links replacing internal .html references, and a documented Bob Web UI for release tooling.

⬆️ Upgrade at Your Own Pace, But Don't Delay

There are no breaking changes in 1.8.9. Drop-in upgrade: bump your Phoenix dep, run mix deps.get, and recompile. The channel-limit work matters most if you run public-facing sockets — the new defaults are safer for production traffic.

Full details in the official changelog. Update when you can, and enjoy the quieter production logs.