Elixir 1.19

Apply the Erlang/OTP 28 prompt first. These rules cover Elixir 1.19 language features, Mix, runtime configuration, protocols, and process abstractions.

Patch level and bounded conversions

• Run the newest Elixir 1.19 release. Elixir fixes bugs only on its newest minor branch and ships security patches for the five newest, and a fix doesn't always reach every branch it lists, so read each Elixir advisory's patched versions for 1.19, and move to a newer branch before 1.19 leaves that window.
• On Elixir 1.19 releases before 1.19.6, which predate the CVE-2026-75758 fix, install the official application-start workaround with Inspect.Opts.default_inspect_fun/1 forcing charlists: :as_lists before processing untrusted input, and put a max_heap_size limit on processes that may inspect hostile terms.
• Every Elixir 1.19 release remains affected by CVE-2026-49762 in Version: reject version or requirement text over a small application limit such as 64 bytes, cap every numeric component's digit count, and only then call Version.parse/1, parse!/1, parse_requirement/1, match?/3, or compare/2.
• Never call String.to_atom/1 or List.to_atom/1 on external values; translate through a fixed mapping or use String.to_existing_atom/1 with explicit rejection handling.
• Bound external text before Code.string_to_quoted/2 or Code.string_to_quoted!/2; set existing_atoms_only: true, keep custom :static_atoms_encoder callbacks from creating atoms, and never treat the returned AST as safe to evaluate.
• Treat Code.eval_string/3, Code.eval_quoted/3,