1. Security

• [List] Avoid recursion when invalid charlists are given to List.to_string/1 or List.to_charlist/1 (CVE-2026-75758, GHSA-jf5q-v438-665c)

2. Bug fixes

Elixir

• [Base] Fix false positives in Base64 validation
• [Kernel] Fix inferred type of :erlang.split_binary/2 when given a bitstring
• [Kernel] Fix type checker crash on comprehensions with a non-returning :into expression
• [String] Fix final sigma handling in Greek casing
• [Task] Fix Task.yield_many/2 waiting indefinitely when :limit exceeds the task count

1. Security

• [List] Avoid recursion when invalid charlists are given to List.to_string/1 or List.to_charlist/1 (CVE-2026-75758, GHSA-jf5q-v438-665c)

1. Security

• [List] Avoid recursion when invalid charlists are given to List.to_string/1 or List.to_charlist/1 (CVE-2026-75758, GHSA-jf5q-v438-665c)

Automated release for latest v1.20.

Automated release for latest v1.19.

Automated release for latest v1.18.

Automated release for latest main.

1. Enhancements

Elixir

• [Kernel.ParallelCompiler] Batch type checker cache operations to improve compilation times

2. Bug fixes

Elixir

• [Kernel] Improve type precision of the ++/2 operator
• [Kernel] Improve type precision of the send/2 return type
• [Kernel] Improve type refinement for and/2 and or/2
• [Kernel] Fix type checking of Map.put/3 on empty map types
• [Kernel] Fix type checking of tuple insertion on equivalent tuple types
• [Kernel] Fix type checking of tuple insertion on gradual types with empty static parts
• [Kernel] Fix variable refinements leaking from invalid receive/after timeout expressions
• [Kernel] Fix rendering inferred types containing unions of static and dynamic functions
• [Kernel] Ensure typing errors in :maps.values/1 reference the correct function
• [Kernel] Mark %_{} patterns as precise so subsequent redundant struct clauses are detected
• [elixirc] Fix parsing of the --profile time option

IEx

• [IEx.Helpers] Fix break!/1 with unknown expressions

1. Enhancements

Elixir

• [Kernel.ParallelCompiler] Include per-module type checking times when compiler profiling is enabled with profile: :time

2. Bug fixes

Elixir

• [Kernel] Fix binary comprehensions with sizes when options such as :uniq or :into are used
• [Kernel] Improve compiler error messages when quote with unquote is used inside a pattern or guard
• [Kernel] Restore the compiler optimization of Kernel.put_elem/3 to emit :erlang.setelement/3
• [Module] Fix type checking when applying an empty function type
• [Module] Fix type checking of bitstring patterns that reuse variables
• [Module] Fix type information for __info__(:struct) to include the :required key
• [Module] Fix type operations on map and optional keys during difference/intersection, including open keys and empty intersections
• [Module] Fix typing of list types involving dynamic or empty lists
• [Module] Include bitstrings as a possible domain key in the type system
• [Module] Preserve file metadata from each clause in type system warnings
• [Module] Fix type warnings for protocol implementations whose protocol module defines additional callbacks
• [Module] Raise clearer type checking errors when an expected struct is removed or redefined during compilation

Mix

• [mix compile] Avoid unnecessary umbrella recompilation when a path dependency's manifest is newer but unchanged
• [mix deps.compile] Recompile fetched dependencies when their compile-time environment changes

1. Security

Elixir

• [Version] Limit integer components in Version to 14 decimal bytes, to avoid parsing too large integers from untrusted user input. We strongly advise developers parsing versions from user input to limit the data size given to the Version module (CVE-2026-49762, GHSA-w2h8-8x3g-278p)

2. Bug fixes

Elixir

• [Calendar] Cap width in Calendar.strftime/2 to 1024 characters
• [Code] Ensure Code.require_file releases the file if compilation fails
• [Kernel] Fix documentation generation to use the correct version in search

Mix

• [mix archive.install] Validate paths and files when extracting archives
• [mix format] Honor --no-compile option when loading plugins