{"package":"phoenix","ecosystem":"hex","latest_version":"1.8.14","description":"Peace of mind from prototype to production","license":"MIT","license_risk":"permissive","commercial_use_notes":"Permissive: commercial closed-source use OK; preserve the copyright notice.","homepage":"https://phoenix.hexdocs.pm/changelog.html","repository":"https://github.com/phoenixframework/phoenix","downloads_weekly":433170,"health":{"score":60,"risk":"moderate","breakdown":{"maintenance":25,"popularity":14,"security":13,"maturity":15,"community":13,"popularity_floor":0},"deprecated":false,"max_score":100},"vulnerabilities":{"count":3,"critical":0,"high":2,"medium":1,"low":0,"details":[{"vuln_id":"CVE-2026-32689","severity":"high","summary":"Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix","affected_versions":">=1.7.0,<1.7.22|>=1.8.0,<1.8.6|>=2674c6ea30634667f9b09966b90269393b445953,<912ea181fd247c21dbcc49fb97d0053b947d81bf|=1.7.0|=1.7.1|=1.7.10|=1.7.11|=1.7.12|=1.7.13|=1.7.14|=1.7.15|=1.7.16|=1.7.17|=1.7.18|=1.7.19|=1.7.2|=1.7.20|=1.7.21|=1.7.3|=1.7.4|=1.7.5|=1.7.6|=1.7.7|=1.7.8|=1.7.9|=1.8.0|=1.8.1|=1.8.2|=1.8.3|=1.8.4|=1.8.5|=v1.8.5|=v1.8.4|=v1.8.3|=v1.8.2|=v1.8.1|=v1.8.0|=v1.8.0-rc.4|=v1.8.0-rc.3|=v1.8.0-rc.2|=v1.8.0-rc.1|=v1.8.0-rc.0|=v1.7.20|=v1.7.19|=v1.7.18|=v1.7.16|=v1.7.15|=v1.7.14|=v1.7.13|=v1.7.12|=v1.7.11|=v1.7.10|=v1.7.9|=v1.7.8|=v1.7.7|=v1.7.6|=v1.7.5|=v1.7.4|=v1.7.3|=v1.7.2|=v1.7.1|=v1.7.0","fixed_version":"912ea181fd247c21dbcc49fb97d0053b947d81bf","source":"osv","published_at":"2026-05-05T15:17:30.664Z","in_kev":false,"epss_prob":0.00469,"epss_percentile":0.39228,"threat_tier":"theoretical"},{"vuln_id":"CVE-2026-56811","severity":"high","summary":"Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service","affected_versions":">=0.11.0,<1.5.15|>=1.6.0-rc.0,<1.6.17|>=1.7.0-rc.0,<1.7.24|>=1.8.0-rc.0,<1.8.9|>=14a297e88023cb280a577962a49a0bbdeef9f4eb,<16e295d2fccab185d1292322e2bee5d46c725c8a|=0.11.0|=0.12.0|=0.13.0|=0.13.1|=0.14.0|=0.15.0|=0.16.0|=0.16.1|=0.17.0|=0.17.1|=1.0.0|=1.0.1|=1.0.2|=1.0.3|=1.0.4|=1.0.5|=1.0.6|=1.1.0|=1.1.1|=1.1.2|=1.1.3|=1.1.4|=1.1.5|=1.1.6|=1.1.7|=1.1.8|=1.1.9|=1.2.0|=1.2.0-rc.0|=1.2.0-rc.1|=1.2.1|=1.2.2|=1.2.3|=1.2.4|=1.2.5|=1.3.0|=1.3.0-rc.0|=1.3.0-rc.1|=1.3.0-rc.2|=1.3.0-rc.3|=1.3.1|=1.3.2|=1.3.3|=1.3.4|=1.3.5|=1.4.0|=1.4.0-rc.0|=1.4.0-rc.1|=1.4.0-rc.2|=1.4.0-rc.3|=1.4.1|=1.4.10|=1.4.11|=1.4.12|=1.4.13|=1.4.14|=1.4.15|=1.4.16|=1.4.17|=1.4.18|=1.4.2|=1.4.3|=1.4.4|=1.4.5|=1.4.6|=1.4.7|=1.4.8|=1.4.9|=1.5.0|=1.5.0-rc.0|=1.5.1|=1.5.10|=1.5.11|=1.5.12|=1.5.13|=1.5.14|=1.5.2|=1.5.3|=1.5.4|=1.5.5|=1.5.6|=1.5.7|=1.5.8|=1.5.9|=1.6.0|=1.6.0-rc.0|=1.6.0-rc.1|=1.6.1|=1.6.10|=1.6.11|=1.6.12|=1.6.13|=1.6.14|=1.6.15|=1.6.16|=1.6.2|=1.6.3|=1.6.4|=1.6.5|=1.6.6|=1.6.7|=1.6.8|=1.6.9|=1.7.0|=1.7.0-rc.0|=1.7.0-rc.1|=1.7.0-rc.2|=1.7.0-rc.3|=1.7.1|=1.7.10|=1.7.11|=1.7.12|=1.7.13|=1.7.14|=1.7.15|=1.7.16|=1.7.17|=1.7.18|=1.7.19|=1.7.2|=1.7.20|=1.7.21|=1.7.22|=1.7.23|=1.7.3|=1.7.4|=1.7.5|=1.7.6|=1.7.7|=1.7.8|=1.7.9|=1.8.0|=1.8.0-rc.0|=1.8.0-rc.1|=1.8.0-rc.2|=1.8.0-rc.3|=1.8.0-rc.4|=1.8.1|=1.8.2|=1.8.3|=1.8.4|=1.8.5|=1.8.6|=1.8.7|=1.8.8","fixed_version":"16e295d2fccab185d1292322e2bee5d46c725c8a","source":"osv","published_at":"2026-07-07T15:09:57.581Z","in_kev":false,"epss_prob":0.00757,"epss_percentile":0.53187,"threat_tier":"theoretical"},{"vuln_id":"CVE-2026-56812","severity":"medium","summary":"Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff","affected_versions":">=1.2.0-rc.0,<1.5.15|>=1.6.0-rc.0,<1.6.17|>=1.7.0-rc.0,<1.7.24|>=1.8.0-rc.0,<1.8.9|>=1.2.0-rc.0,<1.5.15|>=1.6.0-rc.0,<1.6.17|>=1.7.0-rc.0,<1.7.24|>=1.8.0-rc.0,<1.8.9|>=2270aaf21bd02c6a6a1022820564efb605a97655,<beffc4da1e787e572121f68902c63daf4fe7d9c2|=1.2.0|=1.2.0-rc.0|=1.2.0-rc.1|=1.2.1|=1.2.2|=1.2.3|=1.2.4|=1.2.5|=1.3.0|=1.3.0-rc.0|=1.3.0-rc.1|=1.3.0-rc.2|=1.3.0-rc.3|=1.3.1|=1.3.2|=1.3.3|=1.3.4|=1.3.5|=1.4.0|=1.4.0-rc.0|=1.4.0-rc.1|=1.4.0-rc.2|=1.4.0-rc.3|=1.4.1|=1.4.10|=1.4.11|=1.4.12|=1.4.13|=1.4.14|=1.4.15|=1.4.16|=1.4.17|=1.4.18|=1.4.2|=1.4.3|=1.4.4|=1.4.5|=1.4.6|=1.4.7|=1.4.8|=1.4.9|=1.5.0|=1.5.0-rc.0|=1.5.1|=1.5.10|=1.5.11|=1.5.12|=1.5.13|=1.5.14|=1.5.2|=1.5.3|=1.5.4|=1.5.5|=1.5.6|=1.5.7|=1.5.8|=1.5.9|=1.6.0|=1.6.0-rc.0|=1.6.0-rc.1|=1.6.1|=1.6.10|=1.6.11|=1.6.12|=1.6.13|=1.6.14|=1.6.15|=1.6.16|=1.6.2|=1.6.3|=1.6.4|=1.6.5|=1.6.6|=1.6.7|=1.6.8|=1.6.9|=1.7.0|=1.7.0-rc.0|=1.7.0-rc.1|=1.7.0-rc.2|=1.7.0-rc.3|=1.7.1|=1.7.10|=1.7.11|=1.7.12|=1.7.13|=1.7.14|=1.7.15|=1.7.16|=1.7.17|=1.7.18|=1.7.19|=1.7.2|=1.7.20|=1.7.21|=1.7.22|=1.7.23|=1.7.3|=1.7.4|=1.7.5|=1.7.6|=1.7.7|=1.7.8|=1.7.9|=1.8.0|=1.8.0-rc.0|=1.8.0-rc.1|=1.8.0-rc.2|=1.8.0-rc.3|=1.8.0-rc.4|=1.8.1|=1.8.2|=1.8.3|=1.8.4|=1.8.5|=1.8.6|=1.8.7|=1.8.8|=v1.5.13|=v1.6.16|=v1.7.23|=v1.8.8|=v1.8.7|=v1.8.6|=v1.7.22|=v1.8.5|=v1.8.4|=v1.8.3|=v1.8.2|=v1.8.1|=v1.8.0|=v1.8.0-rc.4|=v1.8.0-rc.3|=v1.8.0-rc.2|=v1.8.0-rc.1|=v1.8.0-rc.0|=v1.7.20|=v1.7.19|=v1.7.18|=v1.7.16|=v1.7.15|=v1.7.14|=v1.7.13|=v1.7.12|=v1.7.11|=v1.7.10|=v1.7.9|=v1.7.8|=v1.7.7|=v1.7.6|=v1.7.5|=v1.7.4|=v1.7.3|=v1.7.2|=v1.7.1|=v1.7.0|=v1.7.0-rc.3|=v1.7.0-rc.2|=v1.7.0-rc.1|=v1.7.0-rc.0|=v1.6.15|=v1.6.14|=v1.6.13|=v1.6.12|=v1.6.11|=v1.6.10|=v1.6.7|=v1.6.6|=v1.6.5|=v1.6.4|=v1.6.3|=v1.6.2|=v1.6.1|=v1.6.0|=v1.6.0-rc.1|=v1.6.0-rc.0|=v1.5.12|=v1.5.11|=v1.5.10|=v1.5.9|=v1.5.8|=v1.5.7|=v1.5.6|=v1.5.5|=v1.5.4|=v1.5.3|=v1.5.2|=v1.5.1|=v1.5.0|=v1.5.0-rc.0|=v1.4.0|=v1.4.0-rc.3|=v1.4.0-rc.2|=v1.4.0-rc.1|=v1.4.0-rc.0|=v1.3.0|=v1.3.0-rc.3|=v1.3.0-rc.2|=v1.3.0-rc.1|=v1.3.0-rc.0|=v1.2.0|=v1.2.0-rc.1|=v1.2.0-rc.0","fixed_version":"beffc4da1e787e572121f68902c63daf4fe7d9c2","source":"osv","published_at":"2026-07-07T15:22:46.933Z","in_kev":false,"epss_prob":0.00507,"epss_percentile":0.41753,"threat_tier":"theoretical"}],"actively_exploited_count":0,"likely_exploited_count":0},"versions":{"latest":"1.8.14","total_count":181,"recent":["1.8.14","1.8.13","1.8.12","1.8.11","1.8.10","1.8.9","1.8.8","1.8.7","1.8.6","1.8.5","1.8.4","1.8.3","1.8.2","1.8.1","1.8.0","1.8.0-rc.4","1.8.0-rc.3","1.8.0-rc.2","1.8.0-rc.1","1.8.0-rc.0"]},"metadata":{"deprecated":false,"deprecated_message":null,"maintainers_count":5,"first_published":"2014-04-21T22:38:32.000000Z","last_published":"2026-09-14T09:39:55.338525Z","dependencies_count":0,"dependencies":[]},"github_stats":{"stars":22990,"forks":3055,"open_issues":50,"is_archived":false,"pushed_at":"2026-05-05T15:06:27+00:00"},"bundle":null,"typescript":null,"known_issues":{"bugs_count":0,"bugs_severity":{},"status_breakdown":{},"link":null,"scope":"none"},"historical_compromise":null,"recommendation":{"action":"update_required","issues":["Moderate health score (60/100) — verify manually","2 high severity vulnerabilities"],"use_version":"1.8.14","version_hint":"Update to >= beffc4da1e787e572121f68902c63daf4fe7d9c2 to fix known vulnerabilities","summary":"phoenix@1.8.14 has vulnerabilities — update to latest"},"version_scoped":null,"_meta":{"endpoint":"check","tier":"full","philosophy":"DepScope is free. Use the cheapest endpoint that answers your real question.","cheaper_alternatives":[{"endpoint":"/api/exists/hex/phoenix","tokens_estimated":12,"use_when":"you only need to know if the package exists (hallucination guard)"},{"endpoint":"/api/health/hex/phoenix","tokens_estimated":80,"use_when":"you only need a 0-100 score for go/no-go (>=70 = safe)"},{"endpoint":"/api/prompt/hex/phoenix","tokens_estimated":280,"use_when":"you want a plain-text LLM-friendly brief instead of JSON"},{"endpoint":"POST /api/check_bulk","tokens_estimated":60,"use_when":"you have 5+ packages to check; sends one round-trip instead of N"}],"docs":"https://depscope.dev/integrate","hint_bulk":"You've called /api/check 263 times in 60s. Save bandwidth + tokens with POST /api/check_bulk (1 round-trip for N pkgs)."},"requested_version":null,"_cache":"hit","_response_ms":0,"_powered_by":"depscope.dev — free package intelligence for AI agents","typosquat":{"is_suspected":false},"maintainer_trust":{"available":true,"bus_factor_3m":19,"active_contributors_12m":32,"primary_author_ratio":0.26,"owner_account_age_days":4472,"is_archived":false,"stars":22977,"alerts":[]},"malicious":{"is_malicious":false},"scorecard":{"available":true,"score":6.2,"tier":"moderate"},"quality":{"available":false},"co_used_with":[{"package":"action-docs","occurrences":8},{"package":"pandas","occurrences":8},{"package":"typescript","occurrences":8},{"package":"cmake","occurrences":3},{"package":"asn1ex","occurrences":2}],"version_history_summary":{"total_versions":20,"first_release_age_days":4530,"last_release_days_ago":1,"avg_days_between_releases":238,"release_velocity":"active"}}