Welcome to GigaElixir Gazette, your 5-minute digest of Elixir ecosystem news that actually matters.
This week in Elixir: Filament brings React-style hooks and observable GenServers to Phoenix LiveView, Lockstep surfaces race conditions in your OTP code with exact replay schedules, and a Decimal library security advisory affects every project on decimal < 3.0.0.
Also: a podcast maps where Rust actually earns its NIF slot in BEAM systems, and Bird Meadow v2 closes a silent learning bug that was breaking Active Inference without any test failure.
. WEEKLY PICKS .
🔥 Filament Gives LiveView React Hooks Without JavaScript
Filament lands a component and state-management layer for Phoenix LiveView that eliminates PubSub wiring boilerplate and scattered socket assigns. Each component gets its own fiber with isolated hook state - use_state/1 re-renders only that fiber, never the whole LiveView. Observable GenServers push updates automatically; a projection function extracts only the slice a component needs, and unchanged projections suppress re-renders entirely. Props are typed and validated through defcomponent. No JavaScript required.
🛡️ CVE-2026-32686: Decimal Under 3.0.0 Crashes Your BEAM Node
Very large exponents in decimal < 3.0.0 cause excessive memory allocation and crash the BEAM VM. The fix is decimal 3.0.0 - upgrade immediately. If a transitive dependency pins an older version, override it explicitly: {:decimal, "~> 3.0", override: true}. The update is technically a breaking change but most applications require no code changes beyond the version bump. Filed as GHSA-rhv4-8758-jx7v.
⚡ BEAM There Done That: When Rust Actually Earns Its NIF Slot
A new episode of BEAM There Done That brings in Florian Gilcher from Ferrous Systems and Leandro Pereira - author of MDEx and BeaconCMS - to map where Rust genuinely improves Elixir systems versus where it adds complexity without payoff. The discussion covers NIFs, ports, CPU-bound versus distributed workloads, and hybrid architectures. If your team is debating the next performance bottleneck, this episode cuts through the hype with specific decision criteria.
📊 Bird Meadow v2 Fixes a Silent Learning Bug, Refuses Nx Shortcut
The second Bird Meadow release closes a critical silent bug: DirichletUpdateA was reading from the bundle map instead of agent state - Map.get fell back to uniform distribution on every call, making online learning completely broken with no test failure. One pattern match clause fixed it. The team then ran a formal Nx equivalence proof, confirmed accuracy to 1e-9, measured a 5x performance regression from dispatch overhead, and reverted the Nx port. Accurate result over faster one.
🚀 TelegramEx Covers Telegram Bots with Macro-Based FSM Routing
TelegramEx ships a macro-driven library for Telegram bots in Elixir that handles the message routing boilerplate. The library covers text, photos, documents, stickers, and video alongside inline and reply keyboards. The standout is a stateful FSM with router support - conversations move through states without accumulating if-else trees in a single handler. If you build chatbots, notification pipelines, or internal tools on Telegram, this is the library to evaluate.

💡 Pro Tip
Your Tests Pass and Your Concurrency Bugs Are Still There
ExUnit doesn't control thread scheduling - it runs tests in a single process and hopes the operation order doesn't surface races.
Concurrency bugs in OTP code live in the gaps: between a GenServer cast and its handle_cast, between an ETS write and the read that depends on it. They vanish on retry, appear at 3x load, and never reproduce in CI.
Lockstep is a concurrency test runner for the BEAM that changes this. Write what looks like an ExUnit test; Lockstep runs it under five scheduling strategies with controlled process interleaving. When it finds a race, it returns the exact schedule that reproduced the failure - deterministic replay, counterexample shrinking included.
The runner has already surfaced real bugs in production libraries. Phoenix.Tracker had one before commit fc5686f, NimblePool before e18f45f, and Hammer's Atomic.FixWindow.inc/4 was exposed.
Drop-in OTP wrappers cover GenServer, Task, Registry, Supervisor, ETS, and Atomics - swap the Lockstep versions in and your existing code runs under instrumented scheduling with no rewrites.
AST rewriters handle both Elixir and Erlang source, so it works on unmodified upstream dependencies. Multi-node support covers partition and heal for distributed systems. There is an optional Claude integration that reads a failing trace and explains what went wrong in plain language.
Remember, for concurrency testing on the BEAM:
ExUnit testing misses process interleaving - Sequential test execution cannot expose races between a GenServer cast and its handle_cast; only controlled scheduling finds those gaps
Five strategies find different race classes - Run sequential, randomized, exhaustive, and stress modes; no single mode surfaces all categories of bugs
Drop-in OTP wrappers need zero rewrites - Swap GenServer, ETS, Registry, and Atomics for Lockstep versions; your application code stays unchanged
Deterministic replay beats random retrying - The exact schedule that triggered a race replays on demand, so you debug the cause instead of chasing a flaky test
. TIRED OF DEVOPS HEADACHES? .
Deploy your next Elixir app hassle-free with Gigalixir and focus more on coding, less on ops.
We're specifically designed to support all the features that make Elixir special, so you can keep building amazing things without becoming a DevOps expert.
See you next week,
Michael
P.S. Forward this to a friend who loves Elixir as much as you do 💜

