Erlang/OTP 28.4

OTP-19824

Application(s):

ssh

Related Id(s):

PR-10512, PR-10655

Added support for the PQC key exchange (kex) algorithm mlkem768x25519-sha256, a hybrid quantum-resistant algorithm combining ML-KEM-768 with X25519.

OTP-19908

Application(s):

erts

Related Id(s):

GH-9681, PR-9695

Added persistent_term:put_new/2 that will quickly do nothing if a term with the given name and value already exists, and raise a badarg exception if the term exists with a different value.

OTP-19892

Application(s):

inets

Related Id(s):

ERIERL-1283, PR-10469

Added a new HttpOption {autoretry, timeout()} to httpc:request/4,5. This option allows the client to decide how to act upon receiving a Retry-After response header. The default behavior changes, as now only one retry is made before returning the error code, instead of retrying infinitely.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

OTP-19923

Related Id(s):

PR-10550

The GH Actions CI forbids non-maintainers to commit *.beam files to the Erlang/OTP repo

OTP-19959

Related Id(s):

PR-10630

Updated openssl from 3.6.0 to 3.6.1.

This change does not perform any changes in the md5 vendor implementation from openssl. The change merges upstream cosmetic changes from openssl. This is necessary to automatically migrate cleanly to the next openssl version without conflicts with upstream.

OTP-19989

Related Id(s):

PR-10714

The removal of the slave and slave modules have been postponed to Erlang/OTP 31.

The partial removal of the archive feature has been postponed to Erlang/OTP 30.

The asn1-5.4.3 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of asn1-5.4.3

erts-14.0, kernel-9.0, stdlib-5.0

The common_test-1.30 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19913

Related Id(s):

ERIERL-1264, PR-10271

Added documentation about the behavior of ct:comment/1 and ct:comment/2 when executed from processes other than the process running test functions.

OTP-19972

Related Id(s):

PR-10623, PR-10624, PR-10625, PR-10665

Updated jquery to 4.0.0

OTP-19989

Related Id(s):

PR-10714

The removal of the slave and slave modules have been postponed to Erlang/OTP 31.

The partial removal of the archive feature has been postponed to Erlang/OTP 30.

Full runtime dependencies of common_test-1.30

compiler-6.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, kernel-8.4, observer-2.1, runtime_tools-1.8.16, sasl-2.5, snmp-5.1.2, ssh-4.0, stdlib-4.0, syntax_tools-1.7, tools-3.2, xmerl-1.3.8

The compiler-9.0.5 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19951

Related Id(s):

PR-10588

Fixed a compiler alias analysis bug that could generate unsafe code for repeated binary segments.

Full runtime dependencies of compiler-9.0.5

crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

The crypto-5.8.2 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19973

Related Id(s):

GH-10652, PR-10668

Fixed crypto:crypto_one_time_aead/4, which could crash the runtime system if invoked in parallel with the same state.

Full runtime dependencies of crypto-5.8.2

erts-9.0, kernel-6.0, stdlib-3.9

The diameter-2.6.1 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of diameter-2.6.1

erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0

The erl_interface-5.6.4 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19959

Related Id(s):

PR-10630

Updated openssl from 3.6.0 to 3.6.1.

This change does not perform any changes in the md5 vendor implementation from openssl. The change merges upstream cosmetic changes from openssl. This is necessary to automatically migrate cleanly to the next openssl version without conflicts with upstream.

OTP-16607

Related Id(s):

OTP-16608

The ei API for decoding/encoding terms is not fully 64-bit compatible since terms that have a representation on the external term format larger than 2 GB cannot be handled.

The erts-16.3 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19914

Related Id(s):

ERIERL-1251, PR-10537

Fixed a documentation build warning when one or more applications failed their configure step and were skipped.

OTP-19977

The (IPv6) flowinfo control message header was not properly supported.

OTP-19987

Related Id(s):

PR-10684

Fixed NetBSD thread naming, using pthread_setname_np(); used for debugging.

OTP-19904

Related Id(s):

PR-10451

The erlang:link_option/0 type is now exported.

OTP-19908

HIGHLIGHT

 

Added persistent_term:put_new/2 that will quickly do nothing if a term with the given name and value already exists, and raise a badarg exception if the term exists with a different value.

OTP-19920

Related Id(s):

GH-10371, PR-10546

The manifest.xml file for the Windows build now has version numbers updated to correctly report OS versions on Windows 10, 11, Server 2016, 2019, 2022.

OTP-19950

Related Id(s):

PR-10486

Improved yielding inside re:run. Regular expressions searching for one specific byte character could spin in memchr() without any yielding or reduction counting.

OTP-19959

Related Id(s):

PR-10630

Updated openssl from 3.6.0 to 3.6.1.

This change does not perform any changes in the md5 vendor implementation from openssl. The change merges upstream cosmetic changes from openssl. This is necessary to automatically migrate cleanly to the next openssl version without conflicts with upstream.

OTP-19974

Related Id(s):

PR-10672

Updated ryu implementation used to convert floats to strings.

OTP-19979

Related Id(s):

PR-10675

Upgraded asmjit to v1.18

OTP-19998

Related Id(s):

PR-10752

Updated zlib to version 1.3.2.

Full runtime dependencies of erts-16.3

kernel-9.0, sasl-3.3, stdlib-4.1

The et-1.7.3 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of et-1.7.3

erts-9.0, kernel-5.3, runtime_tools-1.10, stdlib-3.4, wx-1.2

The eunit-2.10.2 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of eunit-2.10.2

erts-9.0, kernel-5.3, stdlib-6.0

The inets-9.6 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

OTP-19892

POTENTIAL INCOMPATIBILITY

 

Added a new HttpOption {autoretry, timeout()} to httpc:request/4,5. This option allows the client to decide how to act upon receiving a Retry-After response header. The default behavior changes, as now only one retry is made before returning the error code, instead of retrying infinitely.

OTP-19928

Related Id(s):

GH-10513, PR-10521

Httpc will not add a Content-Length header for requests, that do not have defined semantics for request content in RFC9110 and do not include content. The list includes methods: [GET, HEAD, OPTIONS, TRACE, DELETE]. The behavior for headers_as_is option remains unchanged.

OTP-19952

Related Id(s):

GH-10501, PR-10602

Improved documentation and specs for do/1 callback in httpd module.

Full runtime dependencies of inets-9.6

erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, ssl-9.0, stdlib-5.0, stdlib-6.0

The kernel-10.6 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19937

Related Id(s):

GH-10494, PR-10576

The built in DNS resolver inet_res has been fixed to do a final request assuming that the request name is absolute, as customary for many DNS resolver client libraries.

OTP-19860

Related Id(s):

PR-10385

Added support for zstd compression in the file module.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of kernel-10.6

crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-7.0

The megaco-4.8.3 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of megaco-4.8.3

asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14, stdlib-2.5

The mnesia-4.25.2 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of mnesia-4.25.2

erts-9.0, kernel-5.3, stdlib-5.0

The observer-2.18.2 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of observer-2.18.2

erts-15.0, et-1.5, kernel-10.0, runtime_tools-2.1, stdlib-5.0, wx-2.3

The odbc-2.16.1 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19992

Related Id(s):

PR-10678

Corrected specs to eliminate Dialyzer warnings for applications.

Full runtime dependencies of odbc-2.16.1

erts-6.0, kernel-3.0, stdlib-2.0

The parsetools-2.7.1 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19901

Related Id(s):

PR-10484

The documentation for the token/3 and tokens/3 functions was corrected. The return value when there were too few characters is {more,Cont}.

Full runtime dependencies of parsetools-2.7.1

erts-6.0, kernel-3.0, stdlib-3.4

Note! The public_key-1.20.2 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- crypto-5.8 (first satisfied in OTP 28.3)

OTP-19905

Related Id(s):

GH-10474, PR-10522

Added missing mapping for der_encode/decode to handle ‘OCSPRequest’.

OTP-19907

Related Id(s):

GH-10495, PR-10496

public_key:pkix_crl_verify/2 now handles certificates with EdDSA keys correctly instead of causing a runtime error.

Full runtime dependencies of public_key-1.20.2

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

The reltool-1.0.3 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of reltool-1.0.3

erts-15.0, kernel-9.0, sasl-4.2.1, stdlib-5.0, tools-2.6.14, wx-2.3

The runtime_tools-2.3.1 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of runtime_tools-2.3.1

erts-16.0, kernel-10.0, mnesia-4.12, stdlib-6.0

The sasl-4.3.1 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of sasl-4.3.1

erts-15.0, kernel-6.0, stdlib-4.0, tools-2.6.14

The snmp-5.20.1 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of snmp-5.20.1

asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime_tools-1.8.14, stdlib-5.0

Note! The ssh-5.5 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- crypto-5.7 (first satisfied in OTP 28.1)

OTP-19976

Related Id(s):

GH-10351, PR-10673

The type specification for the CbInitArgs parameter in ssh_client_channel:start/4 and ssh_client_channel:start_link/4 has been relaxed from [term()] to term(). This eliminates false Dialyzer warnings when passing non-list arguments (such as maps or atoms) to these functions. This change is backward compatible as term() includes [term()].

OTP-19824

HIGHLIGHT

 

Added support for the PQC key exchange (kex) algorithm mlkem768x25519-sha256, a hybrid quantum-resistant algorithm combining ML-KEM-768 with X25519.

Full runtime dependencies of ssh-5.5

crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

Note! The ssl-11.5.2 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependencies have to be satisfied:
   -- crypto-5.8 (first satisfied in OTP 28.3)
   -- public_key-1.18.3 (first satisfied in OTP 28.1)

OTP-19940

Related Id(s):

GH-10567, PR-10583

TLS servers that have early_data disabled will no longer include the early_data extension in its session tickets.

OTP-19941

Related Id(s):

GH-10470, PR-10586

ssl:connection_information/2 will now return correct information for TLS-1.2 session resumption.

OTP-19948

Related Id(s):

PR-10599

When performing renegotiation, in TLS-1.2 or earlier, `max_frag_length` will no longer be renegotiated. Instead, the connection will adhere to its originally negotiated value, and if a value was not negotiated it will not be negotiated.

OTP-19990

Related Id(s):

GH-10698, PR-10723

The NSS Keylogging refactoring mixed up of Read and Write connection states, could cause wrong NSS keylog labels, or {error, closed} returned without keylog.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of ssl-11.5.2

crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.18.3, runtime_tools-1.15.1, stdlib-7.0

Note! The stdlib-7.3 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-16.0.3 (first satisfied in OTP 28.0.3)

OTP-19911

Related Id(s):

PR-10536

Fixed functions ets:init_table/2, ets:tab2file/2,3, ets:table/1,2, ets:i/0,1, dets:from_ets/2, and dets:to_ets/2 to resolve named table arguments only once. This will prevent strange effects if the named table is deleted and recreated by a concurrent process.

OTP-19939

Corrected the af_zip_generator() type in the parser and syntax_tools.

OTP-19988

Related Id(s):

GH-10705, PR-10708

For a function that started with a bracket-only pattern (such as []), the ?FUNCTION_ARITY macro would evaluate to one less than the actual arity.

OTP-19860

Related Id(s):

PR-10385

Added support for zstd compression in the file module.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

OTP-19989

Related Id(s):

PR-10714

The removal of the slave and slave modules have been postponed to Erlang/OTP 31.

The partial removal of the archive feature has been postponed to Erlang/OTP 30.

Full runtime dependencies of stdlib-7.3

compiler-5.0, crypto-4.5, erts-16.0.3, kernel-10.0, sasl-3.0, syntax_tools-3.2.1

The syntax_tools-4.0.3 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19939

Corrected the af_zip_generator() type in the parser and syntax_tools.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of syntax_tools-4.0.3

compiler-9.0, erts-16.0, kernel-10.3, stdlib-7.0

The tools-4.1.4 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of tools-4.1.4

compiler-8.5, erts-15.0, erts-15.0, kernel-10.0, runtime_tools-2.1, stdlib-6.0

The wx-2.5.4 application can be applied independently of other applications on a full OTP 28 installation.

OTP-19886

Related Id(s):

PR-10434

Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

make release_docs places the documentation in the released code under the doc folder.

make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

Improves the source Software-Bill-of-Materials

• The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
• The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
• All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

Full runtime dependencies of wx-2.5.4

erts-12.0, kernel-8.0, stdlib-5.0

The xmerl-2.1.9 application can be applied independently of other applications on a full OTP 28 installation.

OTP-20006

Related Id(s):

PR-10438

Fixed license headers and links in documentation.

Full runtime dependencies of xmerl-2.1.9

erts-6.0, kernel-8.4, stdlib-2.5

Benjamin Philip, Dmytro Lytovchenko, Jan Uhlig, Jonatan Männchen, Luke Bakken, Maria Scott, Mend Renovate, Nelson Vides, Robert Gionea, ryan-duve, Stavros Aronis, Stefan Grundmann, wallacegibbon