diff --git a/.tool-versions b/.tool-versions
index b962cc3a8..c34e3c20f 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,4 +1,4 @@
-elixir 1.14.5-otp-25
-erlang 25.3.2.12
+elixir 1.16.3-otp-26
+erlang 26.2.5
 python 3.9.16
 poetry 1.7.0
diff --git a/apps/alb_monitor/lib/alb_monitor/monitor.ex b/apps/alb_monitor/lib/alb_monitor/monitor.ex
index c62e2d15a..611d602e7 100644
--- a/apps/alb_monitor/lib/alb_monitor/monitor.ex
+++ b/apps/alb_monitor/lib/alb_monitor/monitor.ex
@@ -109,7 +109,7 @@ defmodule ALBMonitor.Monitor do
     end
   end
 
-  defp log_warn(message) when is_binary(message), do: Logger.warn(["alb_monitor ", message])
+  defp log_warn(message) when is_binary(message), do: Logger.warning(["alb_monitor ", message])
   defp log_info(message) when is_binary(message), do: Logger.info(["alb_monitor ", message])
 
   defp schedule_check(%State{check_interval: check_interval}) do
diff --git a/apps/api_accounts/lib/api_accounts.ex b/apps/api_accounts/lib/api_accounts.ex
index 6b2cee1bb..48ff74362 100644
--- a/apps/api_accounts/lib/api_accounts.ex
+++ b/apps/api_accounts/lib/api_accounts.ex
@@ -660,6 +660,8 @@ defmodule ApiAccounts do
   def totp_uri(%User{} = user) do
     host = System.get_env("HOST")
 
-    NimbleTOTP.otpauth_uri("MBTA-API: #{host}/#{user.email}", user.totp_secret_bin, issuer: "MBTA")
+    NimbleTOTP.otpauth_uri("MBTA-API: #{host}/#{user.email}", user.totp_secret_bin,
+      issuer: "MBTA"
+    )
   end
 end
diff --git a/apps/api_web/.sobelow-skips b/apps/api_web/.sobelow-skips
new file mode 100644
index 000000000..4047118ca
--- /dev/null
+++ b/apps/api_web/.sobelow-skips
@@ -0,0 +1,4 @@
+
+0430EA328823B25D53909F55172F2E3F
+7DB23C919D8A36AE6A649DA0A83FBAE2
+CB8E15060F63E711108608C13BA30278
\ No newline at end of file
diff --git a/apps/api_web/config/test.exs b/apps/api_web/config/test.exs
index e1ceb7c13..f788cc772 100644
--- a/apps/api_web/config/test.exs
+++ b/apps/api_web/config/test.exs
@@ -25,4 +25,4 @@ config :recaptcha,
   secret: "6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe"
 
 # Print only warnings and errors during test
-config :logger, level: :warn
+config :logger, level: :warning
diff --git a/apps/api_web/lib/api_web/templates/client_portal/user/_new.html.heex b/apps/api_web/lib/api_web/templates/client_portal/user/_new.html.heex
index 80d73f832..150141078 100644
--- a/apps/api_web/lib/api_web/templates/client_portal/user/_new.html.heex
+++ b/apps/api_web/lib/api_web/templates/client_portal/user/_new.html.heex
@@ -24,12 +24,16 @@
 
         <.form_group form={f} field={:password_confirmation}>
           <%= label(f, :password_confirmation, class: "control-label") %>
-          <%= password_input(f, :password_confirmation, class: "form-control", autocomplete: "off") %>
+          <%= password_input(f, :password_confirmation,
+            class: "form-control",
+            autocomplete: "off"
+          ) %>
           <%= error_tag(f, :password_confirmation) %>
         </.form_group>
 
         <div class="form-group">
           <%= if Application.get_env(:recaptcha, :enabled) do %>
+            <!-- skip Sobelow XSS.Raw because there's no client input used in this response -->
             <%= raw(Recaptcha.Template.display(callback: "recaptchaCompleted")) %>
           <% end %>
         </div>
diff --git a/apps/api_web/mix.exs b/apps/api_web/mix.exs
index dd893d50d..832aa6e56 100644
--- a/apps/api_web/mix.exs
+++ b/apps/api_web/mix.exs
@@ -73,7 +73,6 @@ defmodule ApiWeb.Mixfile do
       {:api_accounts, in_umbrella: true},
       {:memcachex, "~> 0.5"},
       {:ehmon, github: "mbta/ehmon", branch: "master", only: :prod},
-      {:benchwarmer, "~> 0.0", only: [:dev, :test]},
       {:dialyxir, "~> 1.2", only: [:dev, :test], runtime: false},
       {:logster, "~> 1.1"},
       {:phoenix_swagger, "~> 0.8"},
diff --git a/apps/api_web/test/test_helper.exs b/apps/api_web/test/test_helper.exs
index a689c8eb1..28d8dae08 100644
--- a/apps/api_web/test/test_helper.exs
+++ b/apps/api_web/test/test_helper.exs
@@ -2,7 +2,7 @@ excludes = [:integration]
 
 # try to connect to memcache: if it fails, don't run those tests
 excludes =
-  case :gen_tcp.connect('localhost', 11_211, [:inet], 100) do
+  case :gen_tcp.connect(~c"localhost", 11_211, [:inet], 100) do
     {:ok, sock} ->
       :gen_tcp.close(sock)
       excludes
diff --git a/apps/fetch/lib/fetch/worker.ex b/apps/fetch/lib/fetch/worker.ex
index 06275f7a7..4fde39e28 100644
--- a/apps/fetch/lib/fetch/worker.ex
+++ b/apps/fetch/lib/fetch/worker.ex
@@ -64,7 +64,7 @@ defmodule Fetch.Worker do
 
   def handle_info(message, state) do
     _ =
-      Logger.warn(fn ->
+      Logger.warning(fn ->
         # no cover
         "unexpected message to Fetch.Worker[#{state.url}]: #{inspect(message)}"
       end)
@@ -200,7 +200,7 @@ defmodule Fetch.Worker do
   end
 
   defp logger_with_level_for_error({:error, %HTTPoison.Error{reason: :timeout}}),
-    do: &Logger.warn/1
+    do: &Logger.warning/1
 
   defp logger_with_level_for_error(_), do: &Logger.error/1
 
@@ -231,7 +231,7 @@ defmodule Fetch.Worker do
         :ok
 
       {:error, posix} ->
-        _ = Logger.warn("Error while writing #{cache_file}: #{inspect(posix)}")
+        _ = Logger.warning("Error while writing #{cache_file}: #{inspect(posix)}")
         :ok
     end
   end
diff --git a/apps/health/test/health/checkers/run_queue_test.exs b/apps/health/test/health/checkers/run_queue_test.exs
index e995d8ee0..7c245692a 100644
--- a/apps/health/test/health/checkers/run_queue_test.exs
+++ b/apps/health/test/health/checkers/run_queue_test.exs
@@ -13,7 +13,7 @@ defmodule Health.Checkers.RunQueueTest do
     end
 
     test "does nothing when the log level is high" do
-      assert log_processes(false, :warn) == :ignored
+      assert log_processes(false, :warning) == :ignored
     end
   end
 
diff --git a/apps/parse/lib/parse/commuter_rail_occupancies.ex b/apps/parse/lib/parse/commuter_rail_occupancies.ex
index a30a976bf..973c06aae 100644
--- a/apps/parse/lib/parse/commuter_rail_occupancies.ex
+++ b/apps/parse/lib/parse/commuter_rail_occupancies.ex
@@ -14,7 +14,7 @@ defmodule Parse.CommuterRailOccupancies do
         Enum.flat_map(data, &parse_record/1)
 
       e ->
-        Logger.warn("#{__MODULE__} decode_error e=#{inspect(e)}")
+        Logger.warning("#{__MODULE__} decode_error e=#{inspect(e)}")
         []
     end
   end
@@ -38,13 +38,13 @@ defmodule Parse.CommuterRailOccupancies do
       ]
     else
       error ->
-        Logger.warn("#{__MODULE__} parse_error error=#{inspect(error)} #{inspect(record)}")
+        Logger.warning("#{__MODULE__} parse_error error=#{inspect(error)} #{inspect(record)}")
         []
     end
   end
 
   defp parse_record(record) do
-    Logger.warn("#{__MODULE__} parse_error error=missing_fields #{inspect(record)}")
+    Logger.warning("#{__MODULE__} parse_error error=missing_fields #{inspect(record)}")
     []
   end
 
diff --git a/apps/state/bench/server.exs b/apps/state/bench/server.exs
index b22a35ff2..c0bb02667 100644
--- a/apps/state/bench/server.exs
+++ b/apps/state/bench/server.exs
@@ -15,7 +15,7 @@ defmodule State.ServerBench do
     Application.ensure_all_started(:mnesia)
     State.Schedule.start_link
     State.Schedule.new_state(@items)
-    Logger.configure(level: :warn)
+    Logger.configure(level: :warning)
     {:ok, :ignored}
   end
 
diff --git a/apps/state/lib/logger.ex b/apps/state/lib/logger.ex
index c6b359676..c43dddd2d 100644
--- a/apps/state/lib/logger.ex
+++ b/apps/state/lib/logger.ex
@@ -12,7 +12,7 @@ defmodule State.Logger do
   @doc """
   Measures time of `function` and logs
   """
-  @spec debug_time(measured :: (() -> result), message :: (milliseconds :: float -> String.t())) ::
+  @spec debug_time(measured :: (-> result), message :: (milliseconds :: float -> String.t())) ::
           result
         when result: any
   def debug_time(measured, message) when is_function(measured, 0) and is_function(message, 1) do
diff --git a/apps/state/lib/state/facility.ex b/apps/state/lib/state/facility.ex
index 7132850c6..f72dfdc85 100644
--- a/apps/state/lib/state/facility.ex
+++ b/apps/state/lib/state/facility.ex
@@ -16,7 +16,7 @@ defmodule State.Facility do
           optional(:types) => [String.t()]
         }
 
-  @type facility_search :: (() -> [Facility.t()])
+  @type facility_search :: (-> [Facility.t()])
 
   # If you change this list, be sure to also update the gtfs-documentation
   @facility_types ~w(
diff --git a/apps/state/lib/state/stop.ex b/apps/state/lib/state/stop.ex
index fe4bb92ee..fdafb12c4 100644
--- a/apps/state/lib/state/stop.ex
+++ b/apps/state/lib/state/stop.ex
@@ -25,7 +25,7 @@ defmodule State.Stop do
           optional(:route_types) => [Model.Route.route_type()]
         }
 
-  @type stop_search :: (() -> [Stop.t()])
+  @type stop_search :: (-> [Stop.t()])
 
   def start_link(_opts \\ []) do
     Supervisor.start_link(__MODULE__, nil, name: __MODULE__)
diff --git a/apps/state/test/state/routes_by_service_test.exs b/apps/state/test/state/routes_by_service_test.exs
index 350fa0c12..a46d53619 100644
--- a/apps/state/test/state/routes_by_service_test.exs
+++ b/apps/state/test/state/routes_by_service_test.exs
@@ -47,7 +47,7 @@ defmodule State.RoutesByServiceTest do
     update!()
 
     on_exit(fn ->
-      Logger.configure(level: :warn)
+      Logger.configure(level: :warning)
     end)
   end
 
diff --git a/apps/state_mediator/lib/state_mediator/mediator.ex b/apps/state_mediator/lib/state_mediator/mediator.ex
index f772065e6..ecc9a94f3 100644
--- a/apps/state_mediator/lib/state_mediator/mediator.ex
+++ b/apps/state_mediator/lib/state_mediator/mediator.ex
@@ -159,7 +159,7 @@ defmodule StateMediator.Mediator do
     end)
   end
 
-  defp logger_with_level_for_error(%HTTPoison.Error{reason: :timeout}), do: &Logger.warn/1
+  defp logger_with_level_for_error(%HTTPoison.Error{reason: :timeout}), do: &Logger.warning/1
   defp logger_with_level_for_error(_), do: &Logger.error/1
 
   @spec expand_url(String.t() | {module(), atom(), [any()]}) :: String.t()
diff --git a/apps/state_mediator/test/gtfs_decompress_test.exs b/apps/state_mediator/test/gtfs_decompress_test.exs
index 58e98d775..4da72bd37 100644
--- a/apps/state_mediator/test/gtfs_decompress_test.exs
+++ b/apps/state_mediator/test/gtfs_decompress_test.exs
@@ -55,7 +55,7 @@ defmodule GtfsDecompressTest do
         {to_charlist(filename), body(filename)}
       end
 
-    {:ok, {_, body}} = :zip.create('GTFS.zip', file_list, [:memory])
+    {:ok, {_, body}} = :zip.create(~c"GTFS.zip", file_list, [:memory])
     body
   end
 
diff --git a/apps/state_mediator/test/state_mediator/integration/gtfs_test.exs b/apps/state_mediator/test/state_mediator/integration/gtfs_test.exs
index 3c42cdebe..01cae14b2 100644
--- a/apps/state_mediator/test/state_mediator/integration/gtfs_test.exs
+++ b/apps/state_mediator/test/state_mediator/integration/gtfs_test.exs
@@ -31,7 +31,7 @@ defmodule StateMediator.Integration.GtfsTest do
     receive_items(State.RoutesPatternsAtStop)
     receive_items(State.Shape)
     receive_items(State.StopsOnRoute)
-    Logger.configure(level: :warn)
+    Logger.configure(level: :warning)
   end
 
   defp maybe_start_lasso!(nil) do
diff --git a/apps/state_mediator/test/state_mediator_test.exs b/apps/state_mediator/test/state_mediator_test.exs
index 6b86b67f2..1acb48aa8 100644
--- a/apps/state_mediator/test/state_mediator_test.exs
+++ b/apps/state_mediator/test/state_mediator_test.exs
@@ -8,7 +8,7 @@ defmodule StateMediatorTest do
 
     test "returns environment value when set set" do
       expected = "config_b"
-      :os.putenv('FAKE_VAR_B', String.to_charlist(expected))
+      :os.putenv(~c"FAKE_VAR_B", String.to_charlist(expected))
       assert StateMediator.source_url(State.FakeModuleB) == expected
     end
 
diff --git a/mix.lock b/mix.lock
index da8e6e431..88a35c0a9 100644
--- a/mix.lock
+++ b/mix.lock
@@ -5,7 +5,6 @@
   "bandit": {:hex, :bandit, "1.2.2", "569fe5d0efb107c9af37a1e37e25ce2ceec293101a2d4bc512876fc3207192b5", [:mix], [{:hpax, "~> 0.1.1", [hex: :hpax, repo: "hexpm", optional: false]}, {:plug, "~> 1.14", [hex: :plug, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}, {:thousand_island, "~> 1.0", [hex: :thousand_island, repo: "hexpm", optional: false]}, {:websock, "~> 0.5", [hex: :websock, repo: "hexpm", optional: false]}], "hexpm", "2f89adb7281c78d4e75733e0a9e1b24f46f84d2993963d6fa57d0eafadec5f03"},
   "bcrypt_elixir": {:hex, :bcrypt_elixir, "3.1.0", "0b110a9a6c619b19a7f73fa3004aa11d6e719a67e672d1633dc36b6b2290a0f7", [:make, :mix], [{:comeonin, "~> 5.3", [hex: :comeonin, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.6", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "2ad2acb5a8bc049e8d5aa267802631912bb80d5f4110a178ae7999e69dca1bf7"},
   "benchfella": {:hex, :benchfella, "0.3.5", "b2122c234117b3f91ed7b43b6e915e19e1ab216971154acd0a80ce0e9b8c05f5", [:mix], [], "hexpm", "23f27cbc482cbac03fc8926441eb60a5e111759c17642bac005c3225f5eb809d"},
-  "benchwarmer": {:hex, :benchwarmer, "0.0.2", "902e5c020608647b07c38b82103e4af6d2667dfd5d5d13c67382238de6943136", [:mix], [], "hexpm", "8b98b39c1c50df624f9c2d13ca953eeed465eed6feda975da26b479df2b4c9f5"},
   "bunt": {:hex, :bunt, "0.2.1", "e2d4792f7bc0ced7583ab54922808919518d0e57ee162901a16a1b6664ef3b14", [:mix], [], "hexpm", "a330bfb4245239787b15005e66ae6845c9cd524a288f0d141c148b02603777a5"},
   "castore": {:hex, :castore, "0.1.22", "4127549e411bedd012ca3a308dede574f43819fe9394254ca55ab4895abfa1a2", [:mix], [], "hexpm", "c17576df47eb5aa1ee40cc4134316a99f5cad3e215d5c77b8dd3cfef12a22cac"},
   "certifi": {:hex, :certifi, "2.9.0", "6f2a475689dd47f19fb74334859d460a2dc4e3252a3324bd2111b8f0429e7e21", [:rebar3], [], "hexpm", "266da46bdb06d6c6d35fde799bcb28d36d985d424ad7c08b5bb48f5b5cdd4641"},
@@ -85,8 +84,8 @@
   "result": {:hex, :result, "1.7.2", "a57c569f7cf5c158d2299d3b5624a48b69bd1520d0771dc711bcf9f3916e8ab6", [:mix], [], "hexpm", "89f98e98cfbf64237ecf4913aa36b76b80463e087775d19953dc4b435a35f087"},
   "rstar": {:git, "https://github.com/armon/erl-rstar.git", "a406b2cce609029bf65b9ccfbe93a0416c0ee0cd", []},
   "sentry": {:hex, :sentry, "8.0.6", "c8de1bf0523bc120ec37d596c55260901029ecb0994e7075b0973328779ceef7", [:mix], [{:hackney, "~> 1.8", [hex: :hackney, repo: "hexpm", optional: true]}, {:jason, "~> 1.1", [hex: :jason, repo: "hexpm", optional: true]}, {:plug, "~> 1.6", [hex: :plug, repo: "hexpm", optional: true]}, {:plug_cowboy, "~> 2.3", [hex: :plug_cowboy, repo: "hexpm", optional: true]}], "hexpm", "051a2d0472162f3137787c7c9d6e6e4ef239de9329c8c45b1f1bf1e9379e1883"},
-  "sobelow": {:hex, :sobelow, "0.11.1", "23438964486f8112b41e743bbfd402da3e5b296fdc9eacab29914b79c48916dd", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "9897363a7eff96f4809304a90aad819e2ad5e5d24db547af502885146746a53c"},
-  "ssl_verify_fun": {:hex, :ssl_verify_fun, "1.1.6", "cf344f5692c82d2cd7554f5ec8fd961548d4fd09e7d22f5b62482e5aeaebd4b0", [:make, :mix, :rebar3], [], "hexpm", "bdb0d2471f453c88ff3908e7686f86f9be327d065cc1ec16fa4540197ea04680"},
+  "sobelow": {:hex, :sobelow, "0.13.0", "218afe9075904793f5c64b8837cc356e493d88fddde126a463839351870b8d1e", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "cd6e9026b85fc35d7529da14f95e85a078d9dd1907a9097b3ba6ac7ebbe34a0d"},
+  "ssl_verify_fun": {:hex, :ssl_verify_fun, "1.1.7", "354c321cf377240c7b8716899e182ce4890c5938111a1296add3ec74cf1715df", [:make, :mix, :rebar3], [], "hexpm", "fe4c190e8f37401d30167c8c405eda19469f34577987c76dde613e838bbc67f8"},
   "stream_data": {:hex, :stream_data, "0.5.0", "b27641e58941685c75b353577dc602c9d2c12292dd84babf506c2033cd97893e", [:mix], [], "hexpm", "012bd2eec069ada4db3411f9115ccafa38540a3c78c4c0349f151fc761b9e271"},
   "sweet_xml": {:hex, :sweet_xml, "0.7.3", "debb256781c75ff6a8c5cbf7981146312b66f044a2898f453709a53e5031b45b", [:mix], [], "hexpm", "e110c867a1b3fe74bfc7dd9893aa851f0eed5518d0d7cad76d7baafd30e4f5ba"},
   "telemetry": {:hex, :telemetry, "1.2.1", "68fdfe8d8f05a8428483a97d7aab2f268aaff24b49e0f599faa091f1d4e7f61c", [:rebar3], [], "hexpm", "dad9ce9d8effc621708f99eac538ef1cbe05d6a874dd741de2e689c47feafed5"},