Elixir v1.20.1

v1.20.1
Fixed 5
  • Cap width in Calendar.strftime/2 to 1024 characters
  • Ensure Code.require_file releases the file if compilation fails
  • Fix documentation generation to use the correct version in search
  • Validate paths and files when extracting archives in mix archive.install
  • Honor --no-compile option when loading plugins in mix format
Security 1
  • Limit integer components in Version to 14 decimal bytes to avoid parsing too large integers from untrusted user input
1. Security
Elixir
  • [Version] Limit integer components in Version to 14 decimal bytes, to avoid parsing too large integers from untrusted user input. We strongly advise developers parsing versions from user input to limit the data size given to the Version module (CVE-2026-49762, GHSA-w2h8-8x3g-278p)
2. Bug fixes
Elixir
  • [Calendar] Cap width in Calendar.strftime/2 to 1024 characters
  • [Code] Ensure Code.require_file releases the file if compilation fails
  • [Kernel] Fix documentation generation to use the correct version in search
Mix
  • [mix archive.install] Validate paths and files when extracting archives
  • [mix format] Honor --no-compile option when loading plugins
View original

Upgraded? How did it go?

Discussion