elixir-lang/elixir v1.20.5 on GitHub

[URI] Bind port limits during URI.parse (CVE-2026-109821)
[JSON] Raise when decoding integers in JSON beyond float64 ranges (CVE-2026-115274)

[mix deps.partition] Validate deps.partition configuration with checksum on multi-user systems (CVE-2026-97209)

[Calendar.ISO] Optimize Calendar.ISO.parse_duration/1
[Kernel] Improve boot time by parsing the Erlang/OTP release with list_to_integer/1

[Date] Fix Date.from_gregorian_days/2 passing an invalid day fraction to non-ISO calendars
[Duration] Fix Duration.from_iso8601/1 accepting a fractional seconds component after whole seconds, such as PT1S2.5S
[Duration] Reject inputs longer than 192 bytes in Duration.from_iso8601/1
[Regex] Raise SystemLimitError when a match reaches the regex engine match limit, instead of returning no match
[Registry] Do not crash on timeouts on Registry.lock/3
[String] Skip U+055F (Armenian abbreviation mark) when applying the Greek final sigma rule in String.downcase/2 and String.capitalize/2
[Task] Do not leak timeout messages on Task.async_stream/3

[IEx] Do not halt the remote node when the remote shell receives EOF with --remsh
[IEx] Fix crash on tab completion when shell is not found

[mix xref] Fix outgoing compile-connected counts in mix xref graph --format stats