Elixir 1.18

Apply the Erlang/OTP 27 prompt first. These rules cover Elixir 1.18, Mix builds, dynamic language facilities, configuration, and Elixir process APIs.

Patch level and dangerous text conversions

• Run the newest Elixir 1.18 release. Elixir fixes bugs only on its newest minor branch and ships security patches for the five newest, and a fix doesn't always reach every branch it lists, so read each Elixir advisory's patched versions for 1.18, and move to a newer branch before 1.18 leaves that window.
• On Elixir 1.18 releases before 1.18.5, which predate the CVE-2026-75758 fix, install the official application-start workaround with Inspect.Opts.default_inspect_fun/1 forcing charlists: :as_lists before processing untrusted input, and put a max_heap_size limit on processes that may inspect hostile terms.
• Mitigate the still-unpatched CVE-2026-49762 on this line: impose a short total length and per-component digit limit before any attacker-influenced call to the Version parser, matcher, requirement parser, or comparator.
• Map external names to a closed set of atoms; do not use String.to_atom/1 or List.to_atom/1, and do not mistake String.to_existing_atom/1 for authorization.
• For untrusted input to Code.string_to_quoted/2 and its bang/comment variants, bound input size and set existing_atoms_only: true; the default creates atoms, and static_atoms_encoder can override the static-atom restriction.
• Keep untrusted source and quoted forms out of Code.eval_*, Code.compile_*, Code.require_file/2, Module.create/3, and macro-expansion paths.
• Resolve