Every release since Erlang/OTP 17.0, arranged as the tree their version numbers describe. Pick one to see what it contains, which versions are guaranteed to contain it, and which advisories it still carries.
One row per line of otp_versions.table in the
erlang/otp
repository. The changed applications are the entries before the #; the rest
carry over unchanged.
The date each OTP-x.y.z tag was created, read from the git tag rather than the
GitHub release. Tags go back to 2014, while GitHub releases only start at
Erlang/OTP 21 and the older ones were backfilled with the date of the backfill.
Nothing here is hand-maintained: a version number alone says which branch it is on. Three components or fewer means the main track; more means a branch identified by all but the last component, based on that identifier with trailing zeroes dropped. The rules are in Version Scheme.
Each release gets a maintenance branch when the next one takes over the main track. A branch cut from anywhere else was made to resolve a particular issue rather than to maintain the release, and is drawn with a broken line.
Erlang/OTP supports the last three releases with security updates and patches, so releases older than that are marked no longer supported. The policy is in SECURITY.md; which three they are follows from the newest release in the table.
The security advisories of the repository are the list, and each one's CVE record says which releases and application versions it affects, along with the CVSS score, the CWE and any workaround.
openvex.table from the
openvex branch fills in the
advisories whose CVE record does not describe releases. It is generated from the same
security advisories, so it trails them, which is why it is not the list itself. It is also
the only source for the bundled components — zlib, OpenSSL, PCRE2, wxWidgets —
where it records that Erlang/OTP is not affected, and why.
Where neither says which releases an advisory affects, it is listed apart rather than guessed at.