Skip to content

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented May 21, 2025

This PR contains the following updates:

Package Update Change
erlang major 24.1.7 -> 28.0.2

Release Notes

erlang/otp (erlang)

v28.0.2: OTP 28.0.2

Compare Source

Patch Package:           OTP 28.0.2
Git Tag:                 OTP-28.0.2
Date:                    2025-07-17
Trouble Report Id:       OTP-19661, OTP-19670, OTP-19673, OTP-19674,
                         OTP-19678, OTP-19680, OTP-19682, OTP-19683,
                         OTP-19684, OTP-19687, OTP-19690, OTP-19691,
                         OTP-19697, OTP-19699, OTP-19700, OTP-19702,
                         OTP-19703, OTP-19707, OTP-19710, OTP-19711
Seq num:                 ERIERL-1240, ERIERL-1241, ERIERL-1242,
                         GH-10001, GH-10007, GH-10028, GH-10047,
                         GH-9632, GH-9655, GH-9858, GH-9884, GH-9992,
                         PR-10003, PR-10008, PR-10016, PR-10023,
                         PR-10024, PR-10029, PR-10031, PR-10035,
                         PR-10036, PR-10039, PR-10048, PR-9887,
                         PR-9930, PR-9952, PR-9953, PR-9955, PR-9994,
                         PR-9996
System:                  OTP
Release:                 28
Application:             compiler-9.0.1, debugger-6.0.2, erts-16.0.2,
                         kernel-10.3.2, public_key-1.18.2, ssh-5.3.2,
                         ssl-11.3.2, stdlib-7.0.2, wx-2.5.1
Predecessor:             OTP 28.0.1

Check out the git tag OTP-28.0.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

OTP-28.0.2

Fixed Bugs and Malfunctions

  • Fix otp_patch_apply to work with Erlang/OTP 28 and later.

    Own Id: OTP-19682
    Related Id(s): PR-9953

compiler-9.0.1

The compiler-9.0.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • Fixed a bug that could cause empty bitstring matches to always succeed, even when they should not.

    Own Id: OTP-19711
    Related Id(s): GH-10047, PR-10048

Full runtime dependencies of compiler-9.0.1

crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

debugger-6.0.2

The debugger-6.0.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • Fixed debugger priv dir, which was removed and caused crashes when the icons could not be found.

    Own Id: OTP-19687
    Related Id(s): GH-9858, PR-9994

Full runtime dependencies of debugger-6.0.2

compiler-8.0, erts-15.0, kernel-10.0, stdlib-7.0, wx-2.0

erts-16.0.2

The erts-16.0.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • prim_net nif used incorrect encoding for family resulting in non-functional address selection.

    Own Id: OTP-19674

  • Fix windows uninstall command.

    Own Id: OTP-19683
    Related Id(s): GH-9884, GH-9992, PR-9887

  • With this change erlang will start if it receives short (ms-dos compatible) path to executable.

    Own Id: OTP-19690
    Related Id(s): PR-9996

Improvements and New Features

  • The maximum amount of connections for epmd on Windows platforms has been increased from 64 to 1024.

    Own Id: OTP-19710
    Related Id(s): PR-10039

Full runtime dependencies of erts-16.0.2

kernel-9.0, sasl-3.3, stdlib-4.1

kernel-10.3.2

The kernel-10.3.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • socket:sendv/3 with 'nowait' sometimes return 'completion' without 'CompletionInfo' (Windows only).

    Own Id: OTP-19661

  • prim_net nif used incorrect encoding for family resulting in non-functional address selection.

    Own Id: OTP-19674

  • socket:accept can return unexpected 'select_sent'.

    Own Id: OTP-19684
    Related Id(s): ERIERL-1242

  • net_kernel could be blocked for a very long time when selecting distribution module for a connection if the DNS service was slow. This prevented any new connections to be set up during that time.

    Own Id: OTP-19702
    Related Id(s): ERIERL-1241, PR-10029

Improvements and New Features

  • Improved documentation of CompletionStatus for asynchronous (nowait) socket operations.

    Own Id: OTP-19670
    Related Id(s): PR-9930

Full runtime dependencies of kernel-10.3.2

crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-6.0

public_key-1.18.2

The public_key-1.18.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • Adjustments in include file to retain compatibility with supported ASN-1 standards, although not all record and macros are explicitly documented.

    Own Id: OTP-19678
    Related Id(s): GH-10001, PR-10008, PR-9955

  • Handle certificates that are signed with RSASSA-PSS but the PSS params are specified in the 'SignatureAlgorithm' of the signed cert and not in the signer's 'SubjectPublicKeyInfo'.

    Own Id: OTP-19699
    Related Id(s): GH-9632, PR-10023

  • Add modern ASN-1 specs to be able to retain support for ExtensionRequest from legacy PKCS-9 spec.

    Own Id: OTP-19703
    Related Id(s): GH-10028, PR-10031

Full runtime dependencies of public_key-1.18.2

asn1-5.0, crypto-5.0, erts-13.0, kernel-8.0, stdlib-4.0

ssh-5.3.2

The ssh-5.3.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • Fix file handle id generation.

    Own Id: OTP-19691
    Related Id(s): PR-10003

  • Fixes a badmatch error, when SFTP operation cannot be processed due to channel closed in parallel.

    Own Id: OTP-19707
    Related Id(s): GH-9655, PR-10035, PR-10036

Full runtime dependencies of ssh-5.3.2

crypto-5.0, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

ssl-11.3.2

The ssl-11.3.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • Improve error message for bad arguments to underlying connect.

    Own Id: OTP-19697
    Related Id(s): GH-10007, PR-10016

Full runtime dependencies of ssl-11.3.2

crypto-5.6, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.16.4, runtime_tools-1.15.1, stdlib-7.0

stdlib-7.0.2

The stdlib-7.0.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • A set of small bugs in sort stability for `lists:sort/1` and `lists:keysort/1` has been fixed. The bug happened for only some, seemingly random, element sequences. Most sorts were stable.

    Sort stability for `lists:sort/1` is only possible to observe when sorting lists with floating point and integer numbers of the same value.

    For `lists:keysort/1` the list had to start with two tuples where the keys or the whole tuples compared equal.

    Own Id: OTP-19673
    Related Id(s): ERIERL-1240

  • Fixed bug in io_lib:bformat/2 which crashed if format string contained unicode characters.

    Own Id: OTP-19680
    Related Id(s): PR-9952

Full runtime dependencies of stdlib-7.0.2

compiler-5.0, crypto-4.5, erts-16.0, kernel-10.0, sasl-3.0, syntax_tools-3.2.1

wx-2.5.1

The wx-2.5.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • Don't include gl.beam in pre-built source tar file, since it depends on local configure results.

    Own Id: OTP-19700
    Related Id(s): PR-10024

Full runtime dependencies of wx-2.5.1

erts-12.0, kernel-8.0, stdlib-5.0

Thanks to

Dmytro Lytovchenko

GH-10001: https://github.com/erlang/otp/issues/10001 GH-10007: https://github.com/erlang/otp/issues/10007 GH-10028: https://github.com/erlang/otp/issues/10028 GH-10047: https://github.com/erlang/otp/issues/10047 GH-9632: https://github.com/erlang/otp/issues/9632 GH-9655: https://github.com/erlang/otp/issues/9655 GH-9858: https://github.com/erlang/otp/issues/9858 GH-9884: https://github.com/erlang/otp/issues/9884 GH-9992: https://github.com/erlang/otp/issues/9992 PR-10003: https://github.com/erlang/otp/pull/10003 PR-10008: https://github.com/erlang/otp/pull/10008 PR-10016: https://github.com/erlang/otp/pull/10016 PR-10023: https://github.com/erlang/otp/pull/10023 PR-10024: https://github.com/erlang/otp/pull/10024 PR-10029: https://github.com/erlang/otp/pull/10029 PR-10031: https://github.com/erlang/otp/pull/10031 PR-10035: https://github.com/erlang/otp/pull/10035 PR-10036: https://github.com/erlang/otp/pull/10036 PR-10039: https://github.com/erlang/otp/pull/10039 PR-10048: https://github.com/erlang/otp/pull/10048 PR-9887: https://github.com/erlang/otp/pull/9887 PR-9930: https://github.com/erlang/otp/pull/9930 PR-9952: https://github.com/erlang/otp/pull/9952 PR-9953: https://github.com/erlang/otp/pull/9953 PR-9955: https://github.com/erlang/otp/pull/9955 PR-9994: https://github.com/erlang/otp/pull/9994 PR-9996: https://github.com/erlang/otp/pull/9996

v28.0.1: OTP 28.0.1

Compare Source

Patch Package:           OTP 28.0.1
Git Tag:                 OTP-28.0.1
Date:                    2025-06-16
Trouble Report Id:       OTP-19634, OTP-19635, OTP-19637, OTP-19638,
                         OTP-19641, OTP-19644, OTP-19645, OTP-19650,
                         OTP-19653, OTP-19658, OTP-19662, OTP-19665,
                         OTP-19675, OTP-19676
Seq num:                 CVE-2025-4748, ERIERL-1225, ERIERL-1235,
                         GH-6463, GH-9102, GH-9841, GH-9858, GH-9863,
                         GH-9872, PR-9103, PR-9691, PR-9838, PR-9846,
                         PR-9849, PR-9859, PR-9861, PR-9870, PR-9878,
                         PR-9880, PR-9892, PR-9905, PR-9926, PR-9941
System:                  OTP
Release:                 28
Application:             asn1-5.4.1, debugger-6.0.1, eldap-1.2.16,
                         erts-16.0.1, kernel-10.3.1,
                         public_key-1.18.1, ssh-5.3.1, ssl-11.3.1,
                         stdlib-7.0.1, xmerl-2.1.5
Predecessor:             OTP 28.0

Check out the git tag OTP-28.0.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

asn1-5.4.1

The asn1-5.4.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • The ASN.1 compiler could generate code that would cause Dialyzer with the unmatched_returns option to emit warnings.

    Own Id: OTP-19638 Related Id(s): GH-9841, PR-9846

Full runtime dependencies of asn1-5.4.1

erts-14.0, kernel-9.0, stdlib-5.0

debugger-6.0.1

The debugger-6.0.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • Restore deleted icon so that debugger does not crash on startup.

    Own Id: OTP-19641 Related Id(s): GH-9858, PR-9861

Full runtime dependencies of debugger-6.0.1

compiler-8.0, erts-15.0, kernel-10.0, stdlib-7.0, wx-2.0

eldap-1.2.16

The eldap-1.2.16 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • With this change eldap's 'not' function will have specs fixed.

    Own Id: OTP-19658 Related Id(s): PR-9859

Full runtime dependencies of eldap-1.2.16

asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4

erts-16.0.1

The erts-16.0.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • Fix Erlang to not crash when io:standard_error/0 is a terminal but io:standard_io/0 is not. This bug has existed since Erlang/OTP 28.0 and only effects Windows.

    Own Id: OTP-19650 Related Id(s): GH-9872, PR-9878

  • In a debug build, the BIFs for the native debugger could cause a lock order violation diagnostic from the lock checker.

    Own Id: OTP-19665 Related Id(s): PR-9926

  • When building ERTS make sure correct pcre2.h file is included even if CFLAGS contains extra include paths.

    Own Id: OTP-19675 Related Id(s): PR-9892

Full runtime dependencies of erts-16.0.1

kernel-9.0, sasl-3.3, stdlib-4.1

kernel-10.3.1

The kernel-10.3.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • Fix bug where calling io:setopts/1 in a shell without the line_history option would always disable line_history. This bug was introduced in Erlang/OTP 28.0.

    Own Id: OTP-19645 Related Id(s): GH-9863, PR-9870

Full runtime dependencies of kernel-10.3.1

crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-6.0

public_key-1.18.1

The public_key-1.18.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • Add back some ASN-1 macros and definitions that should be included in API.

    Own Id: OTP-19644 Related Id(s): PR-9880

Full runtime dependencies of public_key-1.18.1

asn1-5.0, crypto-5.0, erts-13.0, kernel-8.0, stdlib-4.0

ssh-5.3.1

The ssh-5.3.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • Various channel closing robustness improvements. Avoid crashes when channel handling process closes channel and immediately exits. Avoid breaking the protocol by sending duplicated channel-close messages. Cleanup channels which timeout during closing procedure.

    Own Id: OTP-19634 Related Id(s): GH-9102, PR-9103

  • Improved interoperability with clients acting as Paramiko.

    Own Id: OTP-19637 Related Id(s): GH-6463, PR-9838

Full runtime dependencies of ssh-5.3.1

crypto-5.0, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

ssl-11.3.1

The ssl-11.3.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • hs_keylog callback properly handle alert in initial states, where encryption is not yet used. Also add keylog callback invocation for corner-case where server alert is encrypted with application secrets as client is already in connection state.

    Own Id: OTP-19635 Related Id(s): ERIERL-1235, PR-9849

Improvements and New Features

  • The documentation for SSL option verify_fun has been improved.

    Own Id: OTP-19676 Related Id(s): PR-9691

Full runtime dependencies of ssl-11.3.1

crypto-5.6, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.16.4, runtime_tools-1.15.1, stdlib-7.0

stdlib-7.0.1

The stdlib-7.0.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • Properly strip the leading / and drive letter from filepaths when zipping and unzipping archives.

    Thanks to Wander Nauta for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.

    Own Id: OTP-19653 Related Id(s): PR-9941, CVE-2025-4748

Full runtime dependencies of stdlib-7.0.1

compiler-5.0, crypto-4.5, erts-16.0, kernel-10.0, sasl-3.0, syntax_tools-3.2.1

xmerl-2.1.5

The xmerl-2.1.5 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

  • The type specs of xmerl_scan:file/2 and xmerl_scan:string/2 has been updated to return dynamic/0. Due to hook functions they can return any user defined term.

    Own Id: OTP-19662 Related Id(s): ERIERL-1225, PR-9905

Full runtime dependencies of xmerl-2.1.5

erts-6.0, kernel-8.4, stdlib-2.5

Thanks to

Dan Janowski, Ilya Averyanov, Mikael Pettersson, Yaroslav Maslennikov

v28.0: OTP 28.0

Compare Source

OTP 28.0

Erlang/OTP 28 is a new major release with new features, improvements as well as a few incompatibilities. Some of the new features are highlighted below.

Many thanks to all contributors!

Starting with this release, a source Software Bill of Materials (SBOM) will describe the release on the Github Releases page. We welcome feedback on the SBOM.

New language features

  • Functionality making it possible for processes to enable reception of priority messages has been introduced in accordance with EEP 76.

  • Comprehensions have been extended with "zip generators" allowing multiple generators to be run in parallel. For example, [A+B || A <- [1,2,3] && B <- [4,5,6]] will produce [5,7,9].

  • Generators in comprehensions can now be strict, meaning that if the generator pattern does not match, an exception will be raised instead of silently ignore the value that didn't match.

  • It is now possible to use any base for floating point numbers as per EEP 75: Based Floating Point Literals.

Compiler and JIT improvements

  • For certain types of errors, the compiler can now suggest corrections. For example, when attempting to use variable A that is not defined but A0 is, the compiler could emit the following message: variable 'A' is unbound, did you mean 'A0'?

  • The size of an atom in the Erlang source code was limited to 255 bytes in previous releases, meaning that an atom containing only emojis could contain only 63 emojis. While atoms are still only allowed to contain 255 characters, the number of bytes is no longer limited.

  • The warn_deprecated_catch option enables warnings for use of old-style catch expressions on the form catch Expr instead of the modern try ... catch ... end.

  • Provided that the map argument for a maps:put/3 call is known to the compiler to be a map, the compiler will replace such calls with the corresponding update using the map syntax.

  • Some BIFs with side-effects (such as binary_to_atom/1) are optimized in try ... catch in the same way as guard BIFs in order to gain performance.

  • The compiler’s alias analysis pass is now both faster and less conservative, allowing optimizations of records and binary construction to be applied in more cases.

ERTS

  • The trace:system/3 function has been added. It has a similar interface as erlang:system_monitor/2 but it also supports trace sessions.

  • os:set_signal/2 now supports setting handlers for the SIGWINCH, SIGCONT, and SIGINFO signals.

  • The two new BIFs erlang:processes_iterator/0 and erlang:process_next/1 make it possible to iterate over the process table in a way that scales better than erlang:processes/0.

Shell and terminal

  • The erl -noshell mode has been updated to have two sub modes called raw and cooked, where cooked is the old default behaviour and raw can be used to bypass the line-editing support of the native terminal. Using raw mode it is possible to read keystrokes as they occur without the user having to press Enter. Also, the raw mode does not echo the typed characters to stdout.

  • The shell now prints a help message explaining how to interrupt a running command when stuck executing a command for longer than 5 seconds.

STDLIB

  • The join(Binaries, Separator) function that joins a list of binaries has been added to the binary module.

  • By default, sets created by module sets will now be represented as maps.

  • Module re has been updated to use the newer PCRE2 library instead of the PCRE library.

  • There is a new zstd module that does Zstandard compression.

Public_key

  • The ancient ASN.1 modules used in public_key has been replaced with more modern versions, but we have strived to keep the documented Erlang API for the public_key application compatible.

Dialyzer

SSL

  • The data handling for tls-v1.3 has been optimized.

Emacs mode (in the Tools application)

  • The indent-region in Emacs command will now handle multiline strings better.

For more details about new features and potential incompatibilities see the README.

v27.3.4: OTP 27.3.4

Compare Source

Patch Package:           OTP 27.3.4
Git Tag:                 OTP-27.3.4
Date:                    2025-05-08
Trouble Report Id:       OTP-19577, OTP-19599, OTP-19602, OTP-19605,
                         OTP-19608, OTP-19625
Seq num:                 CVE-2025-46712, ERIERL-1220, GH-9707,
                         GH-9720, PR-9696, PR-9724, PR-9753, PR-9765,
                         PR-9767
System:                  OTP
Release:                 27
Application:             erts-15.2.7, kernel-10.2.7, ssh-5.2.11,
                         xmerl-2.1.3
Predecessor:             OTP 27.3.3

Check out the git tag OTP-27.3.4, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

erts-15.2.7

The erts-15.2.7 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Fixed an emulator crash when setting an error_handler module that was not yet loaded.

    Own Id: OTP-19577
    Related Id(s): ERIERL-1220, PR-9696

  • Fixed a rare bug that could cause an emulator crash after unloading a module or erasing a persistent_term.

    Own Id: OTP-19599
    Related Id(s): PR-9724

Full runtime dependencies of erts-15.2.7

kernel-9.0, sasl-3.3, stdlib-4.1

kernel-10.2.7

Note! The kernel-10.2.7 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-15.2.5 (first satisfied in OTP 27.3.2)

Fixed Bugs and Malfunctions

  • With this change, disk_log will not crash when using chunk_step/3 after log size was decreased.

    Own Id: OTP-19605
    Related Id(s): GH-9720, PR-9765

  • With this change, disk_log will not run into infinite loop when using chunk/2,3 after log size was decreased.

    Own Id: OTP-19608
    Related Id(s): GH-9707, PR-9767

Full runtime dependencies of kernel-10.2.7

crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-6.0

ssh-5.2.11

The ssh-5.2.11 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Fix KEX strict implementation according to draft-miller-sshm-strict-kex-01 document.

    Own Id: OTP-19625
    Related Id(s): CVE-2025-46712

Full runtime dependencies of ssh-5.2.11

crypto-5.0, erts-14.0, kernel-9.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

xmerl-2.1.3

The xmerl-2.1.3 application can be applied independently of other applications on a full OTP 27 installation.

Improvements and New Features

  • A new option to discard whitespace before the xml tag when reading from a stream has been added to the Xmerl SAX parser.

    • {discard_ws_before_xml_document, Boolean} - Discard whitespace before xml tag instead of returning a fatal error if set to true (false is default)

    Own Id: OTP-19602
    Related Id(s): PR-9753

Full runtime dependencies of xmerl-2.1.3

erts-6.0, kernel-8.4, stdlib-2.5

Thanks to

Lý Nhật Tâm

v27.3.3: OTP 27.3.3

Compare Source

Patch Package:           OTP 27.3.3
Git Tag:                 OTP-27.3.3
Date:                    2025-04-16
Trouble Report Id:       OTP-19581, OTP-19582, OTP-19585, OTP-19592,
                         OTP-19595
Seq num:                 CVE-2025-32433, ERIERL-1219, ERIERL-1222,
                         PR-9566, PR-9679, PR-9706
System:                  OTP
Release:                 27
Application:             erts-15.2.6, kernel-10.2.6, megaco-4.7.2,
                         ssh-5.2.10, ssl-11.2.12
Predecessor:             OTP 27.3.2

Check out the git tag OTP-27.3.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

erts-15.2.6

The erts-15.2.6 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Fixed bug in call_memory tracing that could cause wildly incorrect reported memory values. Bug exists since OTP 27.1.

    Also fixed return type spec of trace:info/3.

    Own Id: OTP-19581
    Related Id(s): ERIERL-1219, PR-9706

Full runtime dependencies of erts-15.2.6

kernel-9.0, sasl-3.3, stdlib-4.1

kernel-10.2.6

Note! The kernel-10.2.6 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-15.2.5 (first satisfied in OTP 27.3.2)

Fixed Bugs and Malfunctions

  • Fixed bug in call_memory tracing that could cause wildly incorrect reported memory values. Bug exists since OTP 27.1.

    Also fixed return type spec of trace:info/3.

    Own Id: OTP-19581
    Related Id(s): ERIERL-1219, PR-9706

Full runtime dependencies of kernel-10.2.6

crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-6.0

megaco-4.7.2

The megaco-4.7.2 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Corrected type spec for type mid().

    Own Id: OTP-19585
    Related Id(s): ERIERL-1222

Full runtime dependencies of megaco-4.7.2

asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14, stdlib-2.5

ssh-5.2.10

The ssh-5.2.10 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Reception of wrong Unicode does not cause unnecessary processing. US-ASCII fields are not decoded as Unicode.

    Own Id: OTP-19582
    Related Id(s): PR-9679

  • SSH daemon disconnects upon receiving connection protocol message for unauthenticated used.

    Thanks to Fabian Bäumer, Marcel Maehren, Marcus Brinkmann, Nurullah Erinola, Jörg Schwenk (Ruhr University Bochum).

    Own Id: OTP-19595
    Related Id(s): CVE-2025-32433

Full runtime dependencies of ssh-5.2.10

crypto-5.0, erts-14.0, kernel-9.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

ssl-11.2.12

Note! The ssl-11.2.12 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.16.4 (first satisfied in OTP 27.1.3)

Improvements and New Features

  • Lower log level for user cancelation as this is not an error case. Also handle possible undecrypted close alert during TLS-1.3 handshake.

    Own Id: OTP-19592
    Related Id(s): PR-9566

Full runtime dependencies of ssl-11.2.12

crypto-5.0, erts-15.0, inets-5.10.7, kernel-9.0, public_key-1.16.4, runtime_tools-1.15.1, stdlib-6.0

Thanks to

Simon Cornish

v27.3.2: OTP 27.3.2

Compare Source

Patch Package:           OTP 27.3.2
Git Tag:                 OTP-27.3.2
Date:                    2025-04-04
Trouble Report Id:       OTP-19482, OTP-19560, OTP-19561, OTP-19562,
                         OTP-19563, OTP-19564, OTP-19565, OTP-19567,
                         OTP-19568, OTP-19569, OTP-19571
Seq num:                 ERIERL-1207, ERIERL-1208, ERIERL-1210,
                         ERIERL-1211, ERIERL-1212, ERIERL-1214,
                         ERIERL-1216, GH-9541, PR-9650, PR-9658,
                         PR-9661, PR-9676
System:                  OTP
Release:                 27
Application:             asn1-5.3.4, compiler-8.6.1, erts-15.2.5,
                         kernel-10.2.5, megaco-4.7.1, snmp-5.18.2,
                         ssl-11.2.11, xmerl-2.1.2
Predecessor:             OTP 27.3.1

Check out the git tag OTP-27.3.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

asn1-5.3.4

The asn1-5.3.4 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Negative REAL numbers greater than -1 would be incorrectly encoded (the minus sign would be lost).

    Own Id: OTP-19567
    Related Id(s): ERIERL-1214, PR-9658

Full runtime dependencies of asn1-5.3.4

erts-14.0, kernel-9.0, stdlib-5.0

compiler-8.6.1

The compiler-8.6.1 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Fix the compiler crash when the inner-most tuple in a nested tuple with 3 layers is updated.

    Own Id: OTP-19561
    Related Id(s): ERIERL-1208, ERIERL-1210, PR-9650

Full runtime dependencies of compiler-8.6.1

crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

erts-15.2.5

The erts-15.2.5 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • On Windows, using socket:sendv, a large IOV (size > MAX), the tail was not sent.

    Own Id: OTP-19482

  • Uplift pcre 8.44 to pcre 8.45

    Own Id: OTP-19565

Full runtime dependencies of erts-15.2.5

kernel-9.0, sasl-3.3, stdlib-4.1

kernel-10.2.5

Note! The kernel-10.2.5 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-15.2.5 (first satisfied in OTP 27.3.2)

Fixed Bugs and Malfunctions

  • On Windows, using socket:sendv, a large IOV (size > MAX), the tail was not sent.

    Own Id: OTP-19482

  • gen_tcp connect with a sockaddr with loopback address failed.

    Own Id: OTP-19560
    Related Id(s): GH-9541

  • Remove debug printouts from gen_tcp_socket

    Own Id: OTP-19564

Full runtime dependencies of kernel-10.2.5

crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-6.0

megaco-4.7.1

The megaco-4.7.1 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Correct type spec for ActionReply

    Own Id: OTP-19563
    Related Id(s): ERIERL-1216

Full runtime dependencies of megaco-4.7.1

asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14, stdlib-2.5

snmp-5.18.2

The snmp-5.18.2 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • When manager receives an v3 inform (request) it used engine-id and full address (including port number) to check if engine was known. This did not work if agent used ephemeral ports for notifications. Has now been changed to only use (context) engine-id and address (without port).

    Own Id: OTP-19562
    Related Id(s): ERIERL-1207

  • Fixed snmp_generic (dialyzer) spec for function table_func.

    Own Id: OTP-19568
    Related Id(s): ERIERL-1211

Full runtime dependencies of snmp-5.18.2

crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime_tools-1.8.14, stdlib-5.0

ssl-11.2.11

Note! The ssl-11.2.11 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.16.4 (first satisfied in OTP 27.1.3)

Fixed Bugs and Malfunctions

  • Correct the debug functionality for NSS keylogging for TLS-1.3 introduced in OTP-27.3.1 so that TLS-1.3 key updates items always get correct counter value and each item is logged as one single line.

    Own Id: OTP-19569
    Related Id(s): PR-9661

Full runtime dependencies of ssl-11.2.11

crypto-5.0, erts-15.0, inets-5.10.7, kernel-9.0, public_key-1.16.4, runtime_tools-1.15.1, stdlib-6.0

xmerl-2.1.2

The xmerl-2.1.2 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Corrected faulty type specification

    Corrected type specification for the input parameter of xmerl_xs:value_of/1.

    Also replaced underscore in the return type specifications of xmerl_xs:select/2, xmerl_xpath:string/2 and xmerl_xpath:string/3 with specified return values to improve documentation.

    Own Id: OTP-19571
    Related Id(s): ERIERL-1212, PR-9676

Full runtime dependencies of xmerl-2.1.2

erts-6.0, kernel-8.4, stdlib-2.5

Thanks to

Björn Gustavsson

v27.3.1: OTP 27.3.1

Compare Source

Patch Package:           OTP 27.3.1
Git Tag:                 OTP-27.3.1
Date:                    2025-03-28
Trouble Report Id:       OTP-19391, OTP-19437, OTP-19469, OTP-19525,
                         OTP-19527, OTP-19529, OTP-19542, OTP-19543,
                         OTP-19545, OTP-19546, OTP-19547, OTP-19548,
                         OTP-19549, OTP-19559
Seq num:                 #&#8203;9172, CVE-2025-30211, ERIERL-1204,
                         ERIERL-1205, ERIERL-1206, GH-8891, GH-9483,
                         GH-9554, OTP-19472, OTP-19544, PR-9221,
                         PR-9486, PR-9534, PR-9545, PR-9553, PR-9577,
                         PR-9587, PR-9588, PR-9596, PR-9611, PR-9612
System:                  OTP
Release:                 27
Application:             asn1-5.3.3, erts-15.2.4, kernel-10.2.4,
                         mnesia-4.23.5, ssh-5.2.9, ssl-11.2.10,
                         stdlib-6.2.2
Predecessor:             OTP 27.3

Check out the git tag OTP-27.3.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

OTP-27.3.1

Fixed Bugs and Malfunctions

  • Update used ExDoc version to v0.37.3

    Own Id: OTP-19525
    Related Id(s): PR-9553

asn1-5.3.3

The asn1-5.3.3 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • The JER backend will now include the SIZE constraint in the type info for OCTET STRINGs, and a SIZE constraint with a range will now be included for BIT STRINGs. This does not change the actual encoding or decoding of JER, but can be useful for tools.

    Own Id: OTP-19542
    Related Id(s): ERIERL-1204, PR-9588

Improvements and New Features

  • When using the JSON encoding rules, it is now possible to call the decode/2 function in the following way with data that has already been decoded by json:decode/1:

    SomeModule:decode(Type, {json_decoded, Decoded}).
    

    Own Id: OTP-19547
    Related Id(s): ERIERL-1206, PR-9611

Full runtime dependencies of asn1-5.3.3

erts-14.0, kernel-9.0, stdlib-5.0

erts-15.2.4

The erts-15.2.4 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Behavior for socket:recv/3 has been improved. The behavior has also been clarified in the documentation.

    Own Id: OTP-19469
    Related Id(s): #​9172

  • Trace messages due to receive tracing could potentially be delayed a very long time if the traced process waited in a receive expression without clauses matching on messages (timed wait), or just did not enter a receive expression for a very long time.

    Own Id: OTP-19527
    Related Id(s): PR-9577

  • Improve the naming of the (internal) esock mutex(es). It is now possible to configure (as in autoconf) the use of simple names for the esock mutex(es).

    Own Id: OTP-19548
    Related Id(s): OTP-19472

Full runtime dependencies of erts-15.2.4

kernel-9.0, sasl-3.3, stdlib-4.1

kernel-10.2.4

Note! The kernel-10.2.4 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-15.1 (first satisfied in OTP 27.1)

Fixed Bugs and Malfunctions

  • Behavior for socket:recv/3 has been improved. The behavior has also been clarified in the documentation.

    Own Id: OTP-19469
    Related Id(s): #​9172

  • An infinite loop in CNAME loop detection that can cause Out Of Memory has been fixed. This affected CNAME lookup with the internal DNS resolver.

    Own Id: OTP-19545
    Related Id(s): PR-9587, OTP-19544

Full runtime dependencies of kernel-10.2.4

crypto-5.0, erts-15.1, sasl-3.0, stdlib-6.0

mnesia-4.23.5

The mnesia-4.23.5 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • With this change mnesia will merge schema of tables using external backends.

    Own Id: OTP-19437
    Related Id(s): PR-9534

Full runtime dependencies of mnesia-4.23.5

erts-9.0, kernel-5.3, stdlib-5.0

ssh-5.2.9

The ssh-5.2.9 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Reception of malicious KEX init message does not result with ssh daemon excessive memory usage.

    Own Id: OTP-19543
    Related Id(s): CVE-2025-30211

  • Call to ssh:daemon_replace_options does not crash when argument is not a valid daemon ref.

    Own Id: OTP-19559
    Related Id(s): GH-9554, PR-9545

Full runtime dependencies of ssh-5.2.9

crypto-5.0, erts-14.0, kernel-9.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

ssl-11.2.10

Note! The ssl-11.2.10 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.16.4 (first satisfied in OTP 27.1.3)

Fixed Bugs and Malfunctions

  • Correct handling of unassigned signature algorithms to properly ignore them instead of failing the handshake.

    Own Id: OTP-19529
    Related Id(s): GH-9483, PR-9486

  • Update key mechanism in CRL cache so that CRL DP with same URI path component becomes distinguishable from each other.

    Own Id: OTP-19549
    Related Id(s): GH-8891, PR-9612

Improvements and New Features

  • Add callback for NSS keylogging so that it can work as expected for all scenarios.

    Own Id: OTP-19391
    Related Id(s): PR-9221

Full runtime dependencies of ssl-11.2.10

crypto-5.0, erts-15.0, inets-5.10.7, kernel-9.0, public_key-1.16.4, runtime_tools-1.15.1, stdlib-6.0

stdlib-6.2.2

The stdlib-6.2.2 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Fixed crash when fetching initial_call when user code have modified the process_dictionary.

    Own Id: OTP-19546
    Related Id(s): ERIERL-1205, PR-9596

Full runtime dependencies of stdlib-6.2.2

compiler-5.0, crypto-4.5, erts-15.0, kernel-10.0, sasl-3.0

Thanks to

Alexandre Rodrigues, Marc Worrell, Sergei Shuvatov, zmstone

v27.3: OTP 27.3

Compare Source

OTP 27.3

Erlang/OTP 27.3 is the third maintenance patch package for OTP 27, with mostly bug fixes as well as improvements.

For details about bugfixes and potential incompatibilities see the Erlang 27.3 README

The Erlang/OTP source can also be found at GitHub on the official Erlang repository, https://github.com/erlang/otp

Download links for this and previous versions are found here:

v27.2.4: OTP 27.2.4

Compare Source

Patch Package:           OTP 27.2.4
Git Tag:                 OTP-27.2.4
Date:                    2025-02-20
Trouble Report Id:       OTP-19438, OTP-19466
Seq num:                 CVE-2025-26618, ERIERL-1173, ERIERL-1180
System:                  OTP
Release:                 27
Application:             snmp-5.18.1, ssh-5.2.7
Predecessor:             OTP 27.2.3

Check out the git tag OTP-27.2.4, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

snmp-5.18.1

The snmp-5.18.1 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • SNMP Agent transports type (intAgentTransports) was incorrectly not documented as a list of transports. Also add a couple of config file generation examples.

    Own Id: OTP-19438
    Related Id(s): ERIERL-1180

Full runtime dependencies of snmp-5.18.1

crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime_tools-1.8.14, stdlib-5.0

ssh-5.2.7

The ssh-5.2.7 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • SFTP packets exceeding max packet size are not processed and dropped.

    Own Id: OTP-19466
    Related Id(s): ERIERL-1173, CVE-2025-26618

Full runtime dependencies of ssh-5.2.7

crypto-5.0, erts-14.0, kernel-9.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

v27.2.3: OTP 27.2.3

Compare Source

Patch Package:           OTP 27.2.3
Git Tag:                 OTP-27.2.3
Date:                    2025-02-17
Trouble Report Id:       OTP-19457, OTP-19467, OTP-19486
Seq num:                 ERIERL-1189, ERIERL-1190, PR-9387, PR-9408,
                         PR-9418
System:                  OTP
Release:                 27
Application:             inets-9.3.2, ssl-11.2.8
Predecessor:             OTP 27.2.2

Check out the git tag OTP-27.2.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

inets-9.3.2

The inets-9.3.2 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Improved robustness of httpd startup procedure.

    Own Id: OTP-19486
    Related Id(s): ERIERL-1190, PR-9408

Full runtime dependencies of inets-9.3.2

erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, ssl-9.0, stdlib-5.0, stdlib-6.0

ssl-11.2.8

Note! The ssl-11.2.8 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.16.4 (first satisfied in OTP 27.1.3)

Fixed Bugs and Malfunctions

  • Setting protocol version to a lower value then supported by default in server API function called after ssl:listen/2 could result in wrong default values being used and connections failing with insufficient security.

    Own Id: OTP-19457
    Related Id(s): PR-9418

  • Improve error handling of server name indication fun. This implies that if the sni_fun returns undefined we will attempt connection with original option values, if it returns unrecognized we end the connection with UNRECOGNIZED_NAME alert and if provided options fail option verification we will end the connection with a HANDSHAKE_FAILURE and an error log.

    Own Id: OTP-19467
    Related Id(s): ERIERL-1189, PR-9387

Full runtime dependencies of ssl-11.2.8

crypto-5.0, erts-15.0, inets-5.10.7, kernel-9.0, public_key-1.16.4, runtime_tools-1.15.1, stdlib-6.0

v27.2.2: OTP 27.2.2

Compare Source

Patch Package:           OTP 27.2.2
Git Tag:                 OTP-27.2.2
Date:                    2025-02-06
Trouble Report Id:       OTP-19240, OTP-19381, OTP-19411, OTP-19445,
                         OTP-19455, OTP-19462
Seq num:                 ERIERL-1174, ERIERL-1177, GH-9112, GH-9117,
                         GH-9177, GH-9208, PR-9273, PR-9286, PR-9322,
                         PR-9356, PR-9372, PR-9377
System:                  OTP
Release:                 27
Application:             compiler-8.5.5, erts-15.2.2, kernel-10.2.2,
                         public_key-1.17.1, ssl-11.2.7
Predecessor:             OTP 27.2.1

Check out the git tag OTP-27.2.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

compiler-8.5.5

The compiler-8.5.5 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Eliminated a bug in the alias analysis pass that could potentially cause unsafe optimizations of binary construction or record updates.

    Own Id: OTP-19455
    Related Id(s): PR-9356

Full runtime dependencies of compiler-8.5.5

crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

erts-15.2.2

The erts-15.2.2 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Disabled an unsafe runtime optimization in binary construction that caused silent memory corruption.

    Own Id: OTP-19462
    Related Id(s): ERIERL-1177, [PR-9372]

Full runtime dependencies of erts-15.2.2

kernel-9.0, sasl-3.3, stdlib-4.1

kernel-10.2.2

Note! The kernel-10.2.2 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-15.1 (first satisfied in OTP 27.1)

Fixed Bugs and Malfunctions

  • Fixed a couple of bugs that could make global's internal state inconsistent when a connection was reconnected.

    Own Id: OTP-19381
    Related Id(s): GH-9112, GH-9117, [PR-9377]

Full runtime dependencies of kernel-10.2.2

crypto-5.0, erts-15.1, sasl-3.0, stdlib-6.0

public_key-1.17.1

The public_key-1.17.1 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

  • Consider keyCertSign to compatible with extended key usage for TLS client/server auth in CAs, adhere to wide spread implementations

    Own Id: OTP-19240
    Related Id(s): GH-9208, PR-9286

Full runtime dependencies of public_key-1.17.1

asn1-5.0, crypto-5.0, erts-13.0, kernel-8.0, stdlib-4.0

ssl-11.2.7

Note! The ssl-11.2.7 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.16.4 (first satisfied in OTP 27.1.3)

Fixed Bugs and Malfunctions

  • An initiated handshake should always be closed with an alert, some corner cases have been fixed so that this should always be the case.

    Own Id: OTP-19411
    Related Id(s): ERIERL-1174, PR-9273

  • Correct option handling to work properly for paused handshaking. Could result in unwanted alerts or or error messages.

    Own Id: OTP-19445
    Related Id(s): GH-9177, PR-9322

Full runtime dependencies of ssl-11.2.7

crypto-5.0, erts-15.0, inets-5.10.7, kernel-9.0, public_key-1.16.4, runtime_tools-1.15.1, stdlib-6.0

Thanks to

Frej Drejhammar


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/erlang-28.x branch from 6a5d170 to 5cdb2d8 Compare June 16, 2025 15:00
@renovate renovate bot force-pushed the renovate/erlang-28.x branch from 5cdb2d8 to 059a557 Compare July 17, 2025 17:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants