Elixir 1.16

Apply the Erlang/OTP 26.2.5.21 migration prompt first. The Elixir 1.16 line is still listed for security patches, but its compatible OTP releases are outside current Erlang support, and neither of the two advisories below lists a patched 1.16 release.

Migration and vulnerability controls

• Plan and test an upgrade to an Elixir line that runs on the newest release of an OTP major that still receives security fixes, the target the Erlang/OTP prompt's migration gate describes; Elixir 1.16 supports only OTP 24 through 26, so leaving OTP 26 also means leaving Elixir 1.16. Give the Elixir 1.16/OTP 26 exception an owner and removal deadline.
• Before accepting hostile data, configure Inspect.Opts.default_inspect_fun/1 at application startup to force charlists: :as_lists for default inspection, as prescribed for CVE-2026-75758; preserve this setting in custom :inspect_fun and direct Inspect calls.
• Add max_heap_size containment to processes that may format untrusted terms, but do not treat process death as a substitute for the global inspection workaround or upgrade.
• Do not inspect, log, interpolate, or stringify attacker-controlled lists, and do not call List.to_string/1 or List.to_charlist/1 on them without prior validation.
• Cap total version-string length and numeric-component digits before all Version parsing, matching, requirement, and comparison functions to mitigate CVE-2026-49762.
• Test both advisories explicitly, including a printable list prefix beyond 4,096 elements followed by an invalid code point.

Atom and executable-code boundaries