Erlang/OTP 26.2.5.21

Apply these rules only while migrating software that still requires Erlang/OTP 26.2.5.21. OTP 26 is outside Erlang's current three-release support window and lacks security fixes released after its May 2026 patch.

Migration-only deployment gate

• Move the application to the newest release of an OTP major that still receives security fixes, and document an owner, deadline, compatibility tests, and rollback plan for eliminating OTP 26. OTP supports only its three newest major releases and patches only the latest minor of each, so the target is the newest release of one of those majors.
• For the target, prefer a base image tag that follows its major line, such as erlang:<major> rebuilt with docker build --pull, or a digest an update bot keeps current. When a Dockerfile, .tool-versions, mise.toml, or CI matrix needs an exact OTP version, take it from the erlang/otp releases page; if you can't reach it, leave a placeholder that fails the build, such as an ARG OTP_VERSION with no default, rather than a version you remember. The 26.2.5.21 in this prompt's title names the release these rules were checked against; it is also the final OTP 26 release, which carries the May 2026 certificate-chain and hostname-verification fixes, so it is the only OTP 26 build to run while the migration lasts.
• Audits of rebar.lock or mix.lock never see the runtime, so in CI read the full OTP version the build uses from filename:join([code:root_dir(), "releases", erlang:system_info(otp_release), "OTP_VERSION"]), since erlang:system_info(otp_release) returns only the major