Elixir 1.17

Apply the Erlang/OTP 27 prompt first. Elixir 1.17 receives security patches only, but no 1.17 release fixes two disclosed vulnerabilities, so every 1.17 deployment needs the controls below until it moves to a later branch.

Required advisory containment

• Plan the move off Elixir 1.17. No 1.17 release fixes CVE-2026-75758 or CVE-2026-49762: Elixir's security policy still listed the 1.17 branch when both were published, but neither fix was released for it. Move to the newest release of a later branch that both advisories list as fixed and that supports your OTP major, and until then install the official application-start workaround with Inspect.Opts.default_inspect_fun/1 forcing charlists: :as_lists before processing untrusted input.
• Put a max_heap_size limit on processes that may inspect hostile terms as defense in depth; the limit kills an affected process and does not itself fix CVE-2026-75758.
• Never log, inspect, interpolate, stringify, or pass attacker-influenced lists to List.to_string/1 or List.to_charlist/1 before the global workaround is active.
• Bound user-supplied version and requirement strings and each numeric component before Version.parse/1, parse!/1, parse_requirement/1, parse_requirement!/1, match?/3, or compare/2; every 1.17 release is also affected by CVE-2026-49762.
• Add regression tests for a list with more than 4,096 printable code points followed by an invalid element and for excessively long numeric version components.

Atoms, code, and dispatch

• Replace String.to_atom/1 and List.to_atom/1 on external text