08 May 16:42

52199ed

OTP 25.3.2.21

Patch Package:           OTP 25.3.2.21
Git Tag:                 OTP-25.3.2.21
Date:                    2025-05-08
Trouble Report Id:       OTP-19577, OTP-19599, OTP-19605, OTP-19608,
                         OTP-19625
Seq num:                 CVE-2025-46712, ERIERL-1220, GH-9707,
                         GH-9720, PR-9696, PR-9724, PR-9765, PR-9767
System:                  OTP
Release:                 25
Application:             erts-13.2.2.16, kernel-8.5.4.6, ssh-4.15.3.13
Predecessor:             OTP 25.3.2.20

 Check out the git tag OTP-25.3.2.21, and build a full OTP system
 including documentation. Apply one or more applications from this
 build as patches to your installation using the 'otp_patch_apply'
 tool. For information on install requirements, see descriptions for
 each application version below.

 ---------------------------------------------------------------------
 --- erts-13.2.2.16 --------------------------------------------------
 ---------------------------------------------------------------------

 Note! The erts-13.2.2.16 application *cannot* be applied
       independently of other applications on an arbitrary OTP 25
       installation.

       On a full OTP 25 installation, also the following runtime
       dependencies have to be satisfied:
       -- kernel-8.5 (first satisfied in OTP 25.1)
       -- stdlib-4.1 (first satisfied in OTP 25.1)


 --- Fixed Bugs and Malfunctions ---

  OTP-19577    Application(s): erts
               Related Id(s): ERIERL-1220, PR-9696

               Fixed an emulator crash when setting an error_handler
               module that was not yet loaded.


  OTP-19599    Application(s): erts
               Related Id(s): PR-9724

               Fixed a rare bug that could cause an emulator crash
               after unloading a module or erasing a persistent_term.


 Full runtime dependencies of erts-13.2.2.16: kernel-8.5, sasl-3.3,
 stdlib-4.1


 ---------------------------------------------------------------------
 --- kernel-8.5.4.6 --------------------------------------------------
 ---------------------------------------------------------------------

 Note! The kernel-8.5.4.6 application *cannot* be applied
       independently of other applications on an arbitrary OTP 25
       installation.

       On a full OTP 25 installation, also the following runtime
       dependencies have to be satisfied:
       -- erts-13.1.3 (first satisfied in OTP 25.2)
       -- stdlib-4.1.1 (first satisfied in OTP 25.1.1)


 --- Fixed Bugs and Malfunctions ---

  OTP-19605    Application(s): kernel
               Related Id(s): GH-9720, PR-9765

               With this change, disk_log will not crash when using
               chunk_step/3 after log size was decreased.


  OTP-19608    Application(s): kernel
               Related Id(s): GH-9707, PR-9767

               With this change, disk_log will not run into infinite
               loop when using chunk/2,3 after log size was decreased.


 Full runtime dependencies of kernel-8.5.4.6: crypto-5.0, erts-13.1.3,
 sasl-3.0, stdlib-4.1.1


 ---------------------------------------------------------------------
 --- ssh-4.15.3.13 ---------------------------------------------------
 ---------------------------------------------------------------------

 The ssh-4.15.3.13 application can be applied independently of other
 applications on a full OTP 25 installation.

 --- Fixed Bugs and Malfunctions ---

  OTP-19625    Application(s): ssh
               Related Id(s): CVE-2025-46712

               Fix KEX strict implementation according to
               draft-miller-sshm-strict-kex-01 document.


 Full runtime dependencies of ssh-4.15.3.13: crypto-5.0, erts-11.0,
 kernel-6.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-3.15


 ---------------------------------------------------------------------
 --- Thanks to -------------------------------------------------------
 ---------------------------------------------------------------------

 João Henrique Ferreira de Freitas, Lý Nhật Tâm


 ---------------------------------------------------------------------
 ---------------------------------------------------------------------
 ---------------------------------------------------------------------

Assets 12

05 May 18:55

proxyles

OTP-28.0-rc4

56f63ad

OTP 28.0-rc4 Pre-release

Pre-release

OTP 28.0-rc4

Erlang/OTP 28.0-rc4 is the fourth release candidate before the OTP 28.0 release.

The intention with this release is to get feedback from our users. All feedback is welcome, even if it is only to say that it works for you, and that it installs as it should. We encourage users to try it out and give us feedback either by creating an issue at https://github.com/erlang/otp/issues or by posting to Erlang Forums.

All artifacts for the release can be downloaded from the Erlang/OTP Github release and you can view the new documentation at https://erlang.org/documentation/doc-16-rc4/doc. You can also install the latest release using kerl like this:

kerl build 28.0-rc4 28.0-rc4

Starting with this release, a source Software Bill of Materials (SBOM) will describe the release on the Github Releases page. We welcome feedback on the SBOM.

Erlang/OTP 28 is a new major release with new features, improvements as well as a few incompatibilities. Some of the new features are highlighted below.

Many thanks to all contributors!

Highlights for RC4

The ancient ASN.1 modules used in public_key has been replaced with more modern versions, but we have strived to keep the documented Erlang API for the public_key application compatible.

Highlights for RC2

Functionality making it possible for processes to enable reception of priority messages has been introduced in accordance with EEP 76.

Highlights for RC1

New language features

Comprehensions have been extended with "zip generators" allowing multiple generators to be run in parallel. For example, [A+B || A <- [1,2,3] && B <- [4,5,6]] will produce [5,7,9].
Generators in comprehensions can now be strict, meaning that if the generator pattern does not match, an exception will be raised instead of silently ignore the value that didn't match.
It is now possible to use any base for floating point numbers as per EEP 75: Based Floating Point Literals.

Compiler and JIT improvements

For certain types of errors, the compiler can now suggest corrections. For example, when attempting to use variable A that is not defined but A0 is, the compiler could emit the following message: variable 'A' is unbound, did you mean 'A0'?
The size of an atom in the Erlang source code was limited to 255 bytes in previous releases, meaning that an atom containing only emojis could contain only 63 emojis. While atoms are still only allowed to contain 255 characters, the number of bytes is no longer limited.
The warn_deprecated_catch option enables warnings for use of old-style catch expressions on the form catch Expr instead of the modern try ... catch ... end.
Provided that the map argument for a maps:put/3 call is known to the compiler to be a map, the compiler will replace such calls with the corresponding update using the map syntax.
Some BIFs with side-effects (such as binary_to_atom/1) are optimized in try ... catch in the same way as guard BIFs in order to gain performance.
The compiler’s alias analysis pass is now both faster and less conservative, allowing optimizations of records and binary construction to be applied in more cases.

ERTS

The trace:system/3 function has been added. It has a similar interface as erlang:system_monitor/2 but it also supports trace sessions.
os:set_signal/2 now supports setting handlers for the SIGWINCH, SIGCONT, and SIGINFO signals.
The two new BIFs erlang:processes_iterator/0 and erlang:process_next/1 make it possible to iterate over the process table in a way that scales better than erlang:processes/0.

Shell and terminal

The erl -noshell mode has been updated to have two sub modes called raw and cooked, where cooked is the old default behaviour and raw can be used to bypass the line-editing support of the native terminal. Using raw mode it is possible to read keystrokes as they occur without the user having to press Enter. Also, the raw mode does not echo the typed characters to stdout.
The shell now prints a help message explaining how to interrupt a running command when stuck executing a command for longer than 5 seconds.

STDLIB

The join(Binaries, Separator) function that joins a list of binaries has been added to the binary module.
By default, sets created by module sets will now be represented as maps.
Module re has been updated to use the newer PCRE2 library instead of the PCRE library.
There is a new zstd module that does Zstandard compression.

Dialyzer

EEP 69: Nominal Types has been implemented.

SSL

The data handling for tls-v1.3 has been optimized.

Emacs mode (in the Tools application)

The indent-region in Emacs command will now handle multiline strings better.

For more details about new features and potential incompatibilities see the README.

Assets 18

16 Apr 14:17

github-actions

OTP-27.3.3

10e20b1

OTP 27.3.3

Patch Package:           OTP 27.3.3
Git Tag:                 OTP-27.3.3
Date:                    2025-04-16
Trouble Report Id:       OTP-19581, OTP-19582, OTP-19585, OTP-19592,
                         OTP-19595
Seq num:                 CVE-2025-32433, ERIERL-1219, ERIERL-1222,
                         PR-9566, PR-9679, PR-9706
System:                  OTP
Release:                 27
Application:             erts-15.2.6, kernel-10.2.6, megaco-4.7.2,
                         ssh-5.2.10, ssl-11.2.12
Predecessor:             OTP 27.3.2

Check out the git tag OTP-27.3.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

erts-15.2.6

The erts-15.2.6 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

Fixed bug in call_memory tracing that could cause wildly incorrect reported memory values. Bug exists since OTP 27.1.

Also fixed return type spec of trace:info/3.

Own Id: OTP-19581
Related Id(s): ERIERL-1219, PR-9706

Full runtime dependencies of erts-15.2.6

kernel-9.0, sasl-3.3, stdlib-4.1

kernel-10.2.6

Note! The kernel-10.2.6 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-15.2.5 (first satisfied in OTP 27.3.2)

Fixed Bugs and Malfunctions

Fixed bug in call_memory tracing that could cause wildly incorrect reported memory values. Bug exists since OTP 27.1.

Also fixed return type spec of trace:info/3.

Own Id: OTP-19581
Related Id(s): ERIERL-1219, PR-9706

Full runtime dependencies of kernel-10.2.6

crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-6.0

megaco-4.7.2

The megaco-4.7.2 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

Corrected type spec for type mid().

Own Id: OTP-19585
Related Id(s): ERIERL-1222

Full runtime dependencies of megaco-4.7.2

asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14, stdlib-2.5

ssh-5.2.10

The ssh-5.2.10 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

Reception of wrong Unicode does not cause unnecessary processing. US-ASCII fields are not decoded as Unicode.

Own Id: OTP-19582
Related Id(s): PR-9679
SSH daemon disconnects upon receiving connection protocol message for unauthenticated used.

Thanks to Fabian Bäumer, Marcel Maehren, Marcus Brinkmann, Nurullah Erinola, Jörg Schwenk (Ruhr University Bochum).

Own Id: OTP-19595
Related Id(s): CVE-2025-32433

Full runtime dependencies of ssh-5.2.10

crypto-5.0, erts-14.0, kernel-9.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

ssl-11.2.12

Note! The ssl-11.2.12 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.16.4 (first satisfied in OTP 27.1.3)

Improvements and New Features

Lower log level for user cancelation as this is not an error case. Also handle possible undecrypted close alert during TLS-1.3 handshake.

Own Id: OTP-19592
Related Id(s): PR-9566

Full runtime dependencies of ssl-11.2.12

crypto-5.0, erts-15.0, inets-5.10.7, kernel-9.0, public_key-1.16.4, runtime_tools-1.15.1, stdlib-6.0

Thanks to

Simon Cornish

Assets 13

16 Apr 15:03

github-actions

OTP-26.2.5.11

9f6c4eb

OTP 26.2.5.11

Patch Package:           OTP 26.2.5.11
Git Tag:                 OTP-26.2.5.11
Date:                    2025-04-16
Trouble Report Id:       OTP-19496, OTP-19582, OTP-19595
Seq num:                 CVE-2025-32433, GH-9190, PR-9463, PR-9679
System:                  OTP
Release:                 26
Application:             ssh-5.1.4.8, xmerl-1.3.34.2
Predecessor:             OTP 26.2.5.10

 Check out the git tag OTP-26.2.5.11, and build a full OTP system
 including documentation. Apply one or more applications from this
 build as patches to your installation using the 'otp_patch_apply'
 tool. For information on install requirements, see descriptions for
 each application version below.

 ---------------------------------------------------------------------
 --- ssh-5.1.4.8 -----------------------------------------------------
 ---------------------------------------------------------------------

 The ssh-5.1.4.8 application can be applied independently of other
 applications on a full OTP 26 installation.

 --- Fixed Bugs and Malfunctions ---

  OTP-19582    Application(s): ssh
               Related Id(s): PR-9679

               Reception of wrong Unicode does not cause unnecessary
               processing. US-ASCII fields are not decoded as Unicode.


  OTP-19595    Application(s): ssh
               Related Id(s): CVE-2025-32433

               SSH daemon disconnects upon receiving connection
               protocol message for unauthenticated used.

               Thanks to Fabian Bäumer, Marcel Maehren, Marcus
               Brinkmann, Nurullah Erinola, Jörg Schwenk (Ruhr
               University Bochum).


 Full runtime dependencies of ssh-5.1.4.8: crypto-5.0, erts-14.0,
 kernel-9.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0,
 stdlib-5.0


 ---------------------------------------------------------------------
 --- xmerl-1.3.34.2 --------------------------------------------------
 ---------------------------------------------------------------------

 The xmerl-1.3.34.2 application can be applied independently of other
 applications on a full OTP 26 installation.

 --- Fixed Bugs and Malfunctions ---

  OTP-19496    Application(s): xmerl
               Related Id(s): GH-9190, PR-9463

               Some old-style catch expressions in the
               xmerl_sax_parser when the continuation fun was called
               caused the stack to grow until all free memory was
               exhausted. These parts have been rewritten so that the
               parser now runs correctly without growing the stack. At
               the same time all old-style catch expressions in xmerl
               were replaced with try/catch.


 Full runtime dependencies of xmerl-1.3.34.2: erts-6.0, kernel-8.4,
 stdlib-2.5


 ---------------------------------------------------------------------
 ---------------------------------------------------------------------
 ---------------------------------------------------------------------

Assets 12

16 Apr 15:30

github-actions

OTP-25.3.2.20

ae0052c

OTP 25.3.2.20

Patch Package:           OTP 25.3.2.20
Git Tag:                 OTP-25.3.2.20
Date:                    2025-04-16
Trouble Report Id:       OTP-19582, OTP-19595
Seq num:                 CVE-2025-32433, PR-9679
System:                  OTP
Release:                 25
Application:             ssh-4.15.3.12
Predecessor:             OTP 25.3.2.19

 Check out the git tag OTP-25.3.2.20, and build a full OTP system
 including documentation. Apply one or more applications from this
 build as patches to your installation using the 'otp_patch_apply'
 tool. For information on install requirements, see descriptions for
 each application version below.

 ---------------------------------------------------------------------
 --- ssh-4.15.3.12 ---------------------------------------------------
 ---------------------------------------------------------------------

 The ssh-4.15.3.12 application can be applied independently of other
 applications on a full OTP 25 installation.

 --- Fixed Bugs and Malfunctions ---

  OTP-19582    Application(s): ssh
               Related Id(s): PR-9679

               Reception of wrong Unicode does not cause unnecessary
               processing. US-ASCII fields are not decoded as Unicode.


  OTP-19595    Application(s): ssh
               Related Id(s): CVE-2025-32433

               SSH daemon disconnects upon receiving connection
               protocol message for unauthenticated used.

               Thanks to Fabian Bäumer, Marcel Maehren, Marcus
               Brinkmann, Nurullah Erinola, Jörg Schwenk (Ruhr
               University Bochum).


 Full runtime dependencies of ssh-4.15.3.12: crypto-5.0, erts-11.0,
 kernel-6.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-3.15


 ---------------------------------------------------------------------
 ---------------------------------------------------------------------
 ---------------------------------------------------------------------

Assets 12

16 Apr 11:24

proxyles

OTP-28.0-rc3

feae4e6

OTP 28.0-rc3 Pre-release

Pre-release

OTP 28.0-rc3

Erlang/OTP 28.0-rc3 is the third release candidate of before the OTP 28.0 release.

All artifacts for the release can be downloaded from the Erlang/OTP Github release and you can view the new documentation at https://erlang.org/documentation/doc-16-rc3/doc. You can also install the latest release using kerl like this:

kerl build 28.0-rc3 28.0-rc3.

Starting with this release, a source Software Bill of Materials (SBOM) will describe the release on the Github Releases page. We welcome feedback on the SBOM.

Erlang/OTP 28 is a new major release with new features, improvements as well as a few incompatibilities. Some of the new features are highlighted below.

Many thanks to all contributors!

Highlights for RC2

Functionality making it possible for processes to enable reception of priority messages has been introduced in accordance with EEP 76.

Highlights for RC1

New language features

Comprehensions have been extended with "zip generators" allowing multiple generators to be run in parallel. For example, [A+B || A <- [1,2,3] && B <- [4,5,6]] will produce [5,7,9].
Generators in comprehensions can now be strict, meaning that if the generator pattern does not match, an exception will be raised instead of silently ignore the value that didn't match.
It is now possible to use any base for floating point numbers as per EEP 75: Based Floating Point Literals.

Compiler and JIT improvements

For certain types of errors, the compiler can now suggest corrections. For example, when attempting to use variable A that is not defined but A0 is, the compiler could emit the following message: variable 'A' is unbound, did you mean 'A0'?
The size of an atom in the Erlang source code was limited to 255 bytes in previous releases, meaning that an atom containing only emojis could contain only 63 emojis. While atoms are still only allowed to contain 255 characters, the number of bytes is no longer limited.
The warn_deprecated_catch option enables warnings for use of old-style catch expressions on the form catch Expr instead of the modern try ... catch ... end.
Provided that the map argument for a maps:put/3 call is known to the compiler to be a map, the compiler will replace such calls with the corresponding update using the map syntax.
Some BIFs with side-effects (such as binary_to_atom/1) are optimized in try ... catch in the same way as guard BIFs in order to gain performance.
The compiler’s alias analysis pass is now both faster and less conservative, allowing optimizations of records and binary construction to be applied in more cases.

ERTS

The trace:system/3 function has been added. It has a similar interface as erlang:system_monitor/2 but it also supports trace sessions.
os:set_signal/2 now supports setting handlers for the SIGWINCH, SIGCONT, and SIGINFO signals.
The two new BIFs erlang:processes_iterator/0 and erlang:process_next/1 make it possible to iterate over the process table in a way that scales better than erlang:processes/0.

Shell and terminal

The erl -noshell mode has been updated to have two sub modes called raw and cooked, where cooked is the old default behaviour and raw can be used to bypass the line-editing support of the native terminal. Using raw mode it is possible to read keystrokes as they occur without the user having to press Enter. Also, the raw mode does not echo the typed characters to stdout.
The shell now prints a help message explaining how to interrupt a running command when stuck executing a command for longer than 5 seconds.

STDLIB

The join(Binaries, Separator) function that joins a list of binaries has been added to the binary module.
By default, sets created by module sets will now be represented as maps.
Module re has been updated to use the newer PCRE2 library instead of the PCRE library.
There is a new zstd module that does Zstandard compression.

Dialyzer

EEP 69: Nominal Types has been implemented.

SSL

The data handling for tls-v1.3 has been optimized.

Emacs mode (in the Tools application)

The indent-region in Emacs command will now handle multiline strings better.

For more details about new features and potential incompatibilities see the README.

Assets 18

04 Apr 09:05

github-actions

OTP-27.3.2

7b8942e

OTP 27.3.2

Patch Package:           OTP 27.3.2
Git Tag:                 OTP-27.3.2
Date:                    2025-04-04
Trouble Report Id:       OTP-19482, OTP-19560, OTP-19561, OTP-19562,
                         OTP-19563, OTP-19564, OTP-19565, OTP-19567,
                         OTP-19568, OTP-19569, OTP-19571
Seq num:                 ERIERL-1207, ERIERL-1208, ERIERL-1210,
                         ERIERL-1211, ERIERL-1212, ERIERL-1214,
                         ERIERL-1216, GH-9541, PR-9650, PR-9658,
                         PR-9661, PR-9676
System:                  OTP
Release:                 27
Application:             asn1-5.3.4, compiler-8.6.1, erts-15.2.5,
                         kernel-10.2.5, megaco-4.7.1, snmp-5.18.2,
                         ssl-11.2.11, xmerl-2.1.2
Predecessor:             OTP 27.3.1

Check out the git tag OTP-27.3.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

asn1-5.3.4

The asn1-5.3.4 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

Negative REAL numbers greater than -1 would be incorrectly encoded (the minus sign would be lost).

Own Id: OTP-19567
Related Id(s): ERIERL-1214, PR-9658

Full runtime dependencies of asn1-5.3.4

erts-14.0, kernel-9.0, stdlib-5.0

compiler-8.6.1

The compiler-8.6.1 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

Fix the compiler crash when the inner-most tuple in a nested tuple with 3 layers is updated.

Own Id: OTP-19561
Related Id(s): ERIERL-1208, ERIERL-1210, PR-9650

Full runtime dependencies of compiler-8.6.1

crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

erts-15.2.5

The erts-15.2.5 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

On Windows, using socket:sendv, a large IOV (size > MAX), the tail was not sent.

Own Id: OTP-19482
Uplift pcre 8.44 to pcre 8.45

Own Id: OTP-19565

Full runtime dependencies of erts-15.2.5

kernel-9.0, sasl-3.3, stdlib-4.1

kernel-10.2.5

Note! The kernel-10.2.5 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-15.2.5 (first satisfied in OTP 27.3.2)

Fixed Bugs and Malfunctions

On Windows, using socket:sendv, a large IOV (size > MAX), the tail was not sent.

Own Id: OTP-19482
gen_tcp connect with a sockaddr with loopback address failed.

Own Id: OTP-19560
Related Id(s): GH-9541
Remove debug printouts from gen_tcp_socket

Own Id: OTP-19564

Full runtime dependencies of kernel-10.2.5

crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-6.0

megaco-4.7.1

The megaco-4.7.1 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

Correct type spec for ActionReply

Own Id: OTP-19563
Related Id(s): ERIERL-1216

Full runtime dependencies of megaco-4.7.1

asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14, stdlib-2.5

snmp-5.18.2

The snmp-5.18.2 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

When manager receives an v3 inform (request) it used engine-id and full address (including port number) to check if engine was known. This did not work if agent used ephemeral ports for notifications. Has now been changed to only use (context) engine-id and address (without port).

Own Id: OTP-19562
Related Id(s): ERIERL-1207
Fixed snmp_generic (dialyzer) spec for function table_func.

Own Id: OTP-19568
Related Id(s): ERIERL-1211

Full runtime dependencies of snmp-5.18.2

crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime_tools-1.8.14, stdlib-5.0

ssl-11.2.11

Note! The ssl-11.2.11 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.16.4 (first satisfied in OTP 27.1.3)

Fixed Bugs and Malfunctions

Correct the debug functionality for NSS keylogging for TLS-1.3 introduced in OTP-27.3.1 so that TLS-1.3 key updates items always get correct counter value and each item is logged as one single line.

Own Id: OTP-19569
Related Id(s): PR-9661

Full runtime dependencies of ssl-11.2.11

crypto-5.0, erts-15.0, inets-5.10.7, kernel-9.0, public_key-1.16.4, runtime_tools-1.15.1, stdlib-6.0

xmerl-2.1.2

The xmerl-2.1.2 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

Corrected faulty type specification

Corrected type specification for the input parameter of xmerl_xs:value_of/1.

Also replaced underscore in the return type specifications of xmerl_xs:select/2, xmerl_xpath:string/2 and xmerl_xpath:string/3 with specified return values to improve documentation.

Own Id: OTP-19571
Related Id(s): ERIERL-1212, PR-9676

Full runtime dependencies of xmerl-2.1.2

erts-6.0, kernel-8.4, stdlib-2.5

Thanks to

Björn Gustavsson

Assets 13

28 Mar 13:10

github-actions

OTP-27.3.1

76266a9

OTP 27.3.1

Patch Package:           OTP 27.3.1
Git Tag:                 OTP-27.3.1
Date:                    2025-03-28
Trouble Report Id:       OTP-19391, OTP-19437, OTP-19469, OTP-19525,
                         OTP-19527, OTP-19529, OTP-19542, OTP-19543,
                         OTP-19545, OTP-19546, OTP-19547, OTP-19548,
                         OTP-19549, OTP-19559
Seq num:                 #9172, CVE-2025-30211, ERIERL-1204,
                         ERIERL-1205, ERIERL-1206, GH-8891, GH-9483,
                         GH-9554, OTP-19472, OTP-19544, PR-9221,
                         PR-9486, PR-9534, PR-9545, PR-9553, PR-9577,
                         PR-9587, PR-9588, PR-9596, PR-9611, PR-9612
System:                  OTP
Release:                 27
Application:             asn1-5.3.3, erts-15.2.4, kernel-10.2.4,
                         mnesia-4.23.5, ssh-5.2.9, ssl-11.2.10,
                         stdlib-6.2.2
Predecessor:             OTP 27.3

Check out the git tag OTP-27.3.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

OTP-27.3.1

Fixed Bugs and Malfunctions

Update used ExDoc version to v0.37.3

Own Id: OTP-19525
Related Id(s): PR-9553

asn1-5.3.3

The asn1-5.3.3 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

The JER backend will now include the SIZE constraint in the type info for OCTET STRINGs, and a SIZE constraint with a range will now be included for BIT STRINGs. This does not change the actual encoding or decoding of JER, but can be useful for tools.

Own Id: OTP-19542
Related Id(s): ERIERL-1204, PR-9588

Improvements and New Features

When using the JSON encoding rules, it is now possible to call the decode/2 function in the following way with data that has already been decoded by json:decode/1:
```
SomeModule:decode(Type, {json_decoded, Decoded}).
```
Own Id: OTP-19547
Related Id(s): ERIERL-1206, PR-9611

Full runtime dependencies of asn1-5.3.3

erts-14.0, kernel-9.0, stdlib-5.0

erts-15.2.4

The erts-15.2.4 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

Behavior for socket:recv/3 has been improved. The behavior has also been clarified in the documentation.

Own Id: OTP-19469
Related Id(s): #9172
Trace messages due to receive tracing could potentially be delayed a very long time if the traced process waited in a receive expression without clauses matching on messages (timed wait), or just did not enter a receive expression for a very long time.

Own Id: OTP-19527
Related Id(s): PR-9577
Improve the naming of the (internal) esock mutex(es). It is now possible to configure (as in autoconf) the use of simple names for the esock mutex(es).

Own Id: OTP-19548
Related Id(s): OTP-19472

Full runtime dependencies of erts-15.2.4

kernel-9.0, sasl-3.3, stdlib-4.1

kernel-10.2.4

Note! The kernel-10.2.4 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-15.1 (first satisfied in OTP 27.1)

Fixed Bugs and Malfunctions

Behavior for socket:recv/3 has been improved. The behavior has also been clarified in the documentation.

Own Id: OTP-19469
Related Id(s): #9172
An infinite loop in CNAME loop detection that can cause Out Of Memory has been fixed. This affected CNAME lookup with the internal DNS resolver.

Own Id: OTP-19545
Related Id(s): PR-9587, OTP-19544

Full runtime dependencies of kernel-10.2.4

crypto-5.0, erts-15.1, sasl-3.0, stdlib-6.0

mnesia-4.23.5

The mnesia-4.23.5 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

With this change mnesia will merge schema of tables using external backends.

Own Id: OTP-19437
Related Id(s): PR-9534

Full runtime dependencies of mnesia-4.23.5

erts-9.0, kernel-5.3, stdlib-5.0

ssh-5.2.9

The ssh-5.2.9 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

Reception of malicious KEX init message does not result with ssh daemon excessive memory usage.

Own Id: OTP-19543
Related Id(s): CVE-2025-30211
Call to ssh:daemon_replace_options does not crash when argument is not a valid daemon ref.

Own Id: OTP-19559
Related Id(s): GH-9554, PR-9545

Full runtime dependencies of ssh-5.2.9

crypto-5.0, erts-14.0, kernel-9.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

ssl-11.2.10

Note! The ssl-11.2.10 application cannot be applied independently of other applications on an arbitrary OTP 27 installation.

   On a full OTP 27 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.16.4 (first satisfied in OTP 27.1.3)

Fixed Bugs and Malfunctions

Correct handling of unassigned signature algorithms to properly ignore them instead of failing the handshake.

Own Id: OTP-19529
Related Id(s): GH-9483, PR-9486
Update key mechanism in CRL cache so that CRL DP with same URI path component becomes distinguishable from each other.

Own Id: OTP-19549
Related Id(s): GH-8891, PR-9612

Improvements and New Features

Add callback for NSS keylogging so that it can work as expected for all scenarios.

Own Id: OTP-19391
Related Id(s): PR-9221

Full runtime dependencies of ssl-11.2.10

crypto-5.0, erts-15.0, inets-5.10.7, kernel-9.0, public_key-1.16.4, runtime_tools-1.15.1, stdlib-6.0

stdlib-6.2.2

The stdlib-6.2.2 application can be applied independently of other applications on a full OTP 27 installation.

Fixed Bugs and Malfunctions

Fixed crash when fetching initial_call when user code have modified the process_dictionary.

Own Id: OTP-19546
Related Id(s): ERIERL-1205, PR-9596

Full runtime dependencies of stdlib-6.2.2

compiler-5.0, crypto-4.5, erts-15.0, kernel-10.0, sasl-3.0

Thanks to

Alexandre Rodrigues, Marc Worrell, Sergei Shuvatov, zmstone

Assets 13

28 Mar 14:49

github-actions

OTP-26.2.5.10

f607645

OTP 26.2.5.10

Patch Package:           OTP 26.2.5.10
Git Tag:                 OTP-26.2.5.10
Date:                    2025-03-28
Trouble Report Id:       OTP-19437, OTP-19469, OTP-19493, OTP-19501,
                         OTP-19527, OTP-19529, OTP-19543, OTP-19545,
                         OTP-19548, OTP-19559
Seq num:                 #9172, CVE-2025-30211, ERIERL-1195, GH-9483,
                         GH-9554, OTP-19472, OTP-19544, PR-9443,
                         PR-9486, PR-9499, PR-9534, PR-9545, PR-9577,
                         PR-9587
System:                  OTP
Release:                 26
Application:             erts-14.2.5.9, kernel-9.2.4.7,
                         mnesia-4.23.1.2, ssh-5.1.4.7, ssl-11.1.4.8
Predecessor:             OTP 26.2.5.9

 Check out the git tag OTP-26.2.5.10, and build a full OTP system
 including documentation. Apply one or more applications from this
 build as patches to your installation using the 'otp_patch_apply'
 tool. For information on install requirements, see descriptions for
 each application version below.

 ---------------------------------------------------------------------
 --- erts-14.2.5.9 ---------------------------------------------------
 ---------------------------------------------------------------------

 The erts-14.2.5.9 application can be applied independently of other
 applications on a full OTP 26 installation.

 --- Fixed Bugs and Malfunctions ---

  OTP-19469    Application(s): erts, kernel
               Related Id(s): #9172

               Behavior for socket:recv/3 has been improved. The
               behavior has also been clarified in the documentation.


  OTP-19493    Application(s): erts
               Related Id(s): PR-9443

               Fix prim_inet:send/3 (and in extension
               gen_tcp:send/2,3) to use the selective recive
               optimization when waiting for a send acknowledgement.


  OTP-19527    Application(s): erts
               Related Id(s): PR-9577

               Trace messages due to receive tracing could potentially
               be delayed a very long time if the traced process
               waited in a receive expression without clauses matching
               on messages (timed wait), or just did not enter a
               receive expression for a very long time.


  OTP-19548    Application(s): erts
               Related Id(s): OTP-19472

               Improve the naming of the (internal) esock mutex(es).
               It is now possible to configure (as in autoconf) the
               use of simple names for the esock mutex(es).


 Full runtime dependencies of erts-14.2.5.9: kernel-9.0, sasl-3.3,
 stdlib-4.1


 ---------------------------------------------------------------------
 --- kernel-9.2.4.7 --------------------------------------------------
 ---------------------------------------------------------------------

 The kernel-9.2.4.7 application can be applied independently of other
 applications on a full OTP 26 installation.

 --- Fixed Bugs and Malfunctions ---

  OTP-19469    Application(s): erts, kernel
               Related Id(s): #9172

               Behavior for socket:recv/3 has been improved. The
               behavior has also been clarified in the documentation.


  OTP-19545    Application(s): kernel
               Related Id(s): PR-9587, OTP-19544

               An infinite loop in CNAME loop detection that can cause
               Out Of Memory has been fixed. This affected CNAME
               lookup with the internal DNS resolver.


 Full runtime dependencies of kernel-9.2.4.7: crypto-5.0, erts-14.0,
 sasl-3.0, stdlib-5.0


 ---------------------------------------------------------------------
 --- mnesia-4.23.1.2 -------------------------------------------------
 ---------------------------------------------------------------------

 The mnesia-4.23.1.2 application can be applied independently of other
 applications on a full OTP 26 installation.

 --- Fixed Bugs and Malfunctions ---

  OTP-19437    Application(s): mnesia
               Related Id(s): PR-9534

               With this change mnesia will merge schema of tables
               using external backends.


  OTP-19501    Application(s): mnesia
               Related Id(s): ERIERL-1195, PR-9499

               Mnesia could fail to load a table, if one of the copy
               holders was moved during startup.


 Full runtime dependencies of mnesia-4.23.1.2: erts-9.0, kernel-5.3,
 stdlib-5.0


 ---------------------------------------------------------------------
 --- ssh-5.1.4.7 -----------------------------------------------------
 ---------------------------------------------------------------------

 The ssh-5.1.4.7 application can be applied independently of other
 applications on a full OTP 26 installation.

 --- Fixed Bugs and Malfunctions ---

  OTP-19543    Application(s): ssh
               Related Id(s): CVE-2025-30211

               Reception of malicious KEX init message does not result
               with ssh daemon excessive memory usage.


  OTP-19559    Application(s): ssh
               Related Id(s): GH-9554, PR-9545

               Call to ssh:daemon_replace_options does not crash when
               argument is not a valid daemon ref.


 Full runtime dependencies of ssh-5.1.4.7: crypto-5.0, erts-14.0,
 kernel-9.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0,
 stdlib-5.0


 ---------------------------------------------------------------------
 --- ssl-11.1.4.8 ----------------------------------------------------
 ---------------------------------------------------------------------

 The ssl-11.1.4.8 application can be applied independently of other
 applications on a full OTP 26 installation.

 --- Fixed Bugs and Malfunctions ---

  OTP-19529    Application(s): ssl
               Related Id(s): GH-9483, PR-9486

               Correct handling of unassigned signature algorithms to
               properly ignore them instead of failing the handshake.


 Full runtime dependencies of ssl-11.1.4.8: crypto-5.0, erts-14.0,
 inets-5.10.7, kernel-9.0, public_key-1.11.3, runtime_tools-1.15.1,
 stdlib-4.1


 ---------------------------------------------------------------------
 --- Thanks to -------------------------------------------------------
 ---------------------------------------------------------------------

 Alexandre Rodrigues, Marc Worrell, Sergei Shuvatov, zmsone


 ---------------------------------------------------------------------
 ---------------------------------------------------------------------
 ---------------------------------------------------------------------

Assets 12

28 Mar 15:14

github-actions

OTP-25.3.2.19

6cbc096

OTP 25.3.2.19

Patch Package:           OTP 25.3.2.19
Git Tag:                 OTP-25.3.2.19
Date:                    2025-03-28
Trouble Report Id:       OTP-19501, OTP-19527, OTP-19543, OTP-19545,
                         OTP-19559
Seq num:                 CVE-2025-30211, ERIERL-1195, GH-9554,
                         OTP-19544, PR-9499, PR-9545, PR-9577, PR-9587
System:                  OTP
Release:                 25
Application:             erts-13.2.2.15, kernel-8.5.4.5,
                         mnesia-4.21.4.4, ssh-4.15.3.11
Predecessor:             OTP 25.3.2.18

 Check out the git tag OTP-25.3.2.19, and build a full OTP system
 including documentation. Apply one or more applications from this
 build as patches to your installation using the 'otp_patch_apply'
 tool. For information on install requirements, see descriptions for
 each application version below.

 ---------------------------------------------------------------------
 --- erts-13.2.2.15 --------------------------------------------------
 ---------------------------------------------------------------------

 Note! The erts-13.2.2.15 application *cannot* be applied
       independently of other applications on an arbitrary OTP 25
       installation.

       On a full OTP 25 installation, also the following runtime
       dependencies have to be satisfied:
       -- kernel-8.5 (first satisfied in OTP 25.1)
       -- stdlib-4.1 (first satisfied in OTP 25.1)


 --- Fixed Bugs and Malfunctions ---

  OTP-19527    Application(s): erts
               Related Id(s): PR-9577

               Trace messages due to receive tracing could potentially
               be delayed a very long time if the traced process
               waited in a receive expression without clauses matching
               on messages (timed wait), or just did not enter a
               receive expression for a very long time.


 Full runtime dependencies of erts-13.2.2.15: kernel-8.5, sasl-3.3,
 stdlib-4.1


 ---------------------------------------------------------------------
 --- kernel-8.5.4.5 --------------------------------------------------
 ---------------------------------------------------------------------

 Note! The kernel-8.5.4.5 application *cannot* be applied
       independently of other applications on an arbitrary OTP 25
       installation.

       On a full OTP 25 installation, also the following runtime
       dependencies have to be satisfied:
       -- erts-13.1.3 (first satisfied in OTP 25.2)
       -- stdlib-4.1.1 (first satisfied in OTP 25.1.1)


 --- Fixed Bugs and Malfunctions ---

  OTP-19545    Application(s): kernel
               Related Id(s): PR-9587, OTP-19544

               An infinite loop in CNAME loop detection that can cause
               Out Of Memory has been fixed. This affected CNAME
               lookup with the internal DNS resolver.


 Full runtime dependencies of kernel-8.5.4.5: crypto-5.0, erts-13.1.3,
 sasl-3.0, stdlib-4.1.1


 ---------------------------------------------------------------------
 --- mnesia-4.21.4.4 -------------------------------------------------
 ---------------------------------------------------------------------

 The mnesia-4.21.4.4 application can be applied independently of other
 applications on a full OTP 25 installation.

 --- Fixed Bugs and Malfunctions ---

  OTP-19501    Application(s): mnesia
               Related Id(s): ERIERL-1195, PR-9499

               Mnesia could fail to load a table, if one of the copy
               holders was moved during startup.


 Full runtime dependencies of mnesia-4.21.4.4: erts-9.0, kernel-5.3,
 stdlib-3.4


 ---------------------------------------------------------------------
 --- ssh-4.15.3.11 ---------------------------------------------------
 ---------------------------------------------------------------------

 The ssh-4.15.3.11 application can be applied independently of other
 applications on a full OTP 25 installation.

 --- Fixed Bugs and Malfunctions ---

  OTP-19543    Application(s): ssh
               Related Id(s): CVE-2025-30211

               Reception of malicious KEX init message does not result
               with ssh daemon excessive memory usage.


  OTP-19559    Application(s): ssh
               Related Id(s): GH-9554, PR-9545

               Call to ssh:daemon_replace_options does not crash when
               argument is not a valid daemon ref.


 Full runtime dependencies of ssh-4.15.3.11: crypto-5.0, erts-11.0,
 kernel-6.0, public_key-1.6.1, runtime_tools-1.15.1, stdlib-3.15


 ---------------------------------------------------------------------
 --- Thanks to -------------------------------------------------------
 ---------------------------------------------------------------------

 Alexandre Rodrigues, Sergei Shuvatov


 ---------------------------------------------------------------------
 ---------------------------------------------------------------------
 ---------------------------------------------------------------------

Assets 12

Releases: erlang/otp

OTP 25.3.2.21

Uh oh!

OTP 28.0-rc4

OTP 28.0-rc4

Highlights for RC4

Highlights for RC2

Highlights for RC1

New language features

Compiler and JIT improvements

ERTS

Shell and terminal

STDLIB

Dialyzer

SSL

Emacs mode (in the Tools application)

Uh oh!

OTP 27.3.3

erts-15.2.6

Fixed Bugs and Malfunctions

Full runtime dependencies of erts-15.2.6

kernel-10.2.6

Fixed Bugs and Malfunctions

Full runtime dependencies of kernel-10.2.6

megaco-4.7.2

Fixed Bugs and Malfunctions

Full runtime dependencies of megaco-4.7.2

ssh-5.2.10

Fixed Bugs and Malfunctions

Full runtime dependencies of ssh-5.2.10

ssl-11.2.12

Improvements and New Features

Full runtime dependencies of ssl-11.2.12

Thanks to

Uh oh!

OTP 26.2.5.11

Uh oh!

OTP 25.3.2.20

Uh oh!

OTP 28.0-rc3

OTP 28.0-rc3

Highlights for RC2

Highlights for RC1

New language features

Compiler and JIT improvements

ERTS

Shell and terminal

STDLIB

Dialyzer

SSL

Emacs mode (in the Tools application)

Uh oh!

OTP 27.3.2

asn1-5.3.4

Fixed Bugs and Malfunctions

Full runtime dependencies of asn1-5.3.4

compiler-8.6.1

Fixed Bugs and Malfunctions

Full runtime dependencies of compiler-8.6.1

erts-15.2.5

Fixed Bugs and Malfunctions

Full runtime dependencies of erts-15.2.5

kernel-10.2.5

Fixed Bugs and Malfunctions

Full runtime dependencies of kernel-10.2.5

megaco-4.7.1

Fixed Bugs and Malfunctions

Full runtime dependencies of megaco-4.7.1

snmp-5.18.2

Fixed Bugs and Malfunctions

Full runtime dependencies of snmp-5.18.2

ssl-11.2.11

Fixed Bugs and Malfunctions

Full runtime dependencies of ssl-11.2.11

xmerl-2.1.2

Fixed Bugs and Malfunctions

Full runtime dependencies of xmerl-2.1.2

Thanks to

Uh oh!

OTP 27.3.1