Lowering the Drawbridge

Stop mounting your LiveView twice

Phoenix LiveView mounts twice on first page load — once for the static HTTP dead render and again when the WebSocket connects. The common fix of guarding data loads with connected?/1 avoids double queries but breaks SEO, link previews, and no-JS fallback by leaving the dead render empty. This post explains why the double mount exists, what connected?/1 actually costs, and introduces an experimental fork that parks the dead-render socket in a short-lived GenServer and redeems it on WebSocket connect — skipping the second mount entirely. The fork adds an on_connect/1 callback for connection-only side effects (subscriptions, timers, presence) and provides migration patterns for data loads, connect params, and real-time data. The upstream Phoenix team is working on a more complete 'adoptable LiveViews' solution (issue #3551), but this fork serves as an interim stopgap.

Clojurists Together Update: May and June 2026

Báo cáo tiến độ hai tháng 5-6/2026 của Bozhidar Batsov về dự án nREPL/CIDER (được tài trợ bởi Clojurists Together) ghi nhận sự kiện CIDER 1.22 ra mắt (kết thúc phiên bản 1.x) và CIDER 2.0 sắp hoàn thiện với các tính năng mới như transient menus, inline macroexpansion, trình duyệt đồ thị cuộc gọi, cùng khả năng hiển thị nội dung REPL giàu có. Debugger Sayid cũng được hồi sinh sau nhiều năm ngừng phát triển. Hai dự án mới là 'port' (môi trường Clojure tối giản dựa trên prepl cho Emacs) và 'neat' (client nREPL đa ngôn ngữ cho Emacs) đã ra mắt. Cải tiến tooling ClojureScript thông qua các bản cập nhật Piggieback 0.7.0 và Weasel 0.8.0, cùng nhiều bản phát hành mới cho cider-nrepl, Orchard, và refactor-nrepl. Tác giả cũng đề cập đến sự suy giảm tài trợ cho các dự án nguồn mở trong 4 năm qua.

Lập trình viên Clojure nên đọc bài này để cập nhật những tiến bộ mới nhất trong hệ sinh thái nREPL/CIDER, từ các tính năng nâng cao như debug Sayid, giao diện menu tạm thời và đồ họa gọi hàm cho đến các công cụ mới như port và neat, giúp tối ưu hóa hiệu suất và trải nghiệm phát triển trong môi trường Emacs.

MrAnderson 0.6

MrAnderson 0.6 is released, a Clojure dependency inlining tool used by cider-nrepl to bundle private copies of dependencies that can't clash with user project dependencies. The release fixes several long-standing bugs including incorrect handling of records vs. namespace references (dash vs. underscore munging), over-eager import rewriting, mixed imports of deftype-generated and real Java classes, skipped import rewrites, broken load statement path rewriting, and a critical bug that could delete project sources. The release also adds a Leiningen-free entry point (mranderson.core/inline-deps) enabling use with tools.build, and improves test coverage for the Java class repackaging subsystem.

RCE via Gemini Live AI Voice Session Misconfiguration. Injecting Client-Controlled Setup Frames Through Unconstrained Ephemeral Tokens

A security researcher discovered that Google's Gemini Live API ephemeral token system allows remote code execution when backends issue tokens without populating the live_connect_constraints field. The BidiGenerateContentConstrained WebSocket endpoint is only constrained if the backend explicitly locks session parameters in the token — without this, any authenticated client can inject arbitrary setup frames including system instructions and tools like Python code execution. The vulnerability stems from Google's official reference implementation omitting the constraint configuration, meaning any team following the example ships the same misconfiguration. The fix is adding bidi_generate_content_setup to the token creation call. The sandbox used is gVisor, which limits impact but still allows arbitrary Python execution and compute abuse. The researcher provides a nonce-based proof protocol to distinguish real sandbox execution from model inference.

Sayid Redux

Sayid 0.4 is a revived release of the long-neglected omniscient debugger for Clojure. Rather than using breakpoints, Sayid records every function call's arguments, return values, timing, and call tree so developers can inspect execution history after the fact. The release brings new artifact coordinates (mx.cider/sayid), renamed namespaces, a reworked nREPL API that returns structured data instead of pre-rendered text, and a rebuilt Emacs UI with foldable trees, source jumping, and CIDER inspector integration. The motivation came from CIDER 2.0 work, where the author realized Sayid's approach was superior to anything he could build into the built-in tracer. Breaking changes were made deliberately since the bundled Emacs client was effectively the only consumer.

nREPL and ClojureScript: Demystifying Piggieback

A deep-dive into Piggieback, the nREPL middleware that enables ClojureScript evaluation over a standard nREPL server. The author explains how Piggieback hijacks nREPL sessions to reroute eval messages to a JavaScript runtime (Node, browser, etc.) via ClojureScript's IJavaScriptEnv protocol, without requiring any client-side changes. Key internals covered include session-based dispatch, the DelegatingReplEnv trick to prevent premature teardown, how the compiler environment is stashed for use by tools like cider-nrepl, and the two distinct code paths for REPL setup vs. steady-state evaluation. The post also covers known limitations (one Node REPL per JVM, no interrupt support, multi-form eval), contrasts Piggieback's approach with shadow-cljs, and summarizes recent 0.6.x/0.7.0 bug fixes and refactoring work done as part of the CIDER 2.0 effort.

CIDER 2.0 is Brewing...

CIDER, the Clojure interactive development environment for Emacs, is getting a major version bump to 2.0. Key additions include transient-based discoverable keymaps, a unified foldable tree-view widget across all browsers, built-in cross-reference/call-graph functionality (reducing need for clj-refactor.el or clojure-lsp), a revamped debugging toolbox with inline macro stepping and a dedicated trace buffer, ClojureScript test and macroexpansion fixes, async Eldoc, and numerous quality-of-life improvements. The snapshot is available on MELPA now, with the official release expected in a week or two. The author credits AI agents for helping prototype ideas faster, while noting design decisions remain his own.