Ash Chronicle: Issue #13

This is a super quick, informal update about the goings on in and around Ash Framework. If you find something interesting and think it should make it on this newsletter, drop a message in the #ash-weekly channel in our Discord server.

• Buy the book!

• Check out Ash Premium Support from Alembic.

• Sponsor me if you like what I do.

I got mega busy last week and didn’t get a chance to post Ash Weekly. I’m not planning on changing the weekly schedule of the newsletter, but it might happen again at some point, especially with all the conferences coming up 😁

We’ve got a training coming up at GigCity Elixir, and I’ll be speaking there as well as ElixirConf EU and Goatmire later this year. I’ve also just gotten confirmation that I’ll be speaking at Scenic City Summit (also in Chattanooga) this year, delivering the first rendition (I intend to give this talk in a few different venues) of “Building On Bedrock: Elixir’s Fundamental Design Advantage”. Look forward to seeing old friends and making new ones!

We’ll be announcing something fun at ElixirConf EU! I look forward to seeing you all there and can’t wait to see what you do with our next big extension.

Our new not-so-secret project being launched needs really good JsonSchema support, so our OpenApi generation has gotten *considerably* better in recent versions. More support for descriptions coming from the resource’s descriptions directly, more supported core types, stricter usage of things like `additionalProperties: false`, and cleaner generated forms of `anyOf`.

We had a low severity (well, technically its medium, but the calculation for that is not really that informative) security advisory and CVE published. It doesn’t provide a way for existing user’s data to be compromised, but there is a way for a new account to become “confirmed” despite not having access to the email that they registered with. It is not a likely occurrence, but it is possible. See the CVE for instructions on upgrading and more information: https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-3988-q8q7-p787

• Allow update action types to be used in `Ash.Generator.changeset_generator`

• Add `:__skip__` value for telling seed generators to not generate a value for a given field.

• Add tools for adding calculations to resources in `Ash.Resource.Igniter`

• Support a `load` option when building changesets (`Ash.Changeset.for_*`)

• More mix tasks for generating Ash custom modules

• Set a unique `run_id` for every reactor run

• Allow additional telemetry metadata to be provided via Reactor context.

• Support installing private packages from hexpm

• Validate DSL sections at the very end, making it easier to use `Spark.Dsl.Fragment` to split up large DSL modules (i.e `Ash.Resource`), because each section doesn’t need to be fully valid in the fragment.

• Remove `eval` from `spark_dsl_config` (it was just noise)

• Allow :logger handlers to see the original exception before we handle it

• Use bearer auth by default in open api spec, to make the defaults work well with AshAuthentication

• remove the need for `Module.concat` when defining routers

• Add `before_dispatch` option to `AshJsonApi.Router`, allowing you to hook into the conn before all requests are handled. The initial use case for this was setting some Appsignal metadata about the request.

• Support new verified routes behavior in phx 1.8. In Phoenix 1.8 AshJsonApi routes *automatically* show in `mix phx.routes`, and are also fully verified when using verified routes 🎉. Related Phoenix PR: https://github.com/phoenixframework/phoenix/pull/6122

• Support UUIDv7, and Time types in open api specification

• Preserve descriptions with “anyOf” types.

• Set descriptions of attributes in the write attributes (inputs to actions etc.)

• Add `require_interaction?` option for confirmation strategies. Mitigates CVE https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-3988-q8q7-p787

• Generate `created_at` timestamp on the token resource when installing.

• Adds the UI and routes required for the `require_interaction?` option. Part of mitigation for CVE https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-3988-q8q7-p787

• Support tailwind4 config when installing

• Add `ex_money_opts` constraint to `AshMoney.Types.Money` to customize its behavior

• Add `AshOban.Igniter` with tools to add triggers to resources.

• Add `actor_persister` option to individual triggers, and support `:none` option to allow overriding a set default.

• Set the `default_initial_state` from `initial_states` when there is only one

• Add an igniter installer

• Support a `skip_version_when_unchanged?` in the action context, to bypass the new `only_when_changed? false` situationally.

• Add igniter installer

• Allow configuring positional arguments for form code interfaces using the `forms` DSL

• Add subdomain hook for LiveView