Skip to content

Update dependency erlang to v29 - #23

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/erlang-29.x
Open

Update dependency erlang to v29#23
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/erlang-29.x

Conversation

@renovate

@renovate renovate Bot commented Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
erlang major 26.2.1 → 29.1.2

Release Notes

erlang/otp (erlang)

v29.1.2: OTP 29.1.2

Compare Source

Patch Package:           OTP 29.1.2
Git Tag:                 OTP-29.1.2
Date:                    2026-10-14
Trouble Report Id:       OTP-20359, OTP-20360, OTP-20385, OTP-20392,
                         OTP-20394, OTP-20408, OTP-20415, OTP-20418,
                         OTP-20420, OTP-20423, OTP-20426, OTP-20427,
                         OTP-20428, OTP-20437, OTP-20438, OTP-20439,
                         OTP-20440, OTP-20442, OTP-20444, OTP-20445,
                         OTP-20447, OTP-20456
Seq num:                 CVE-2026-105236, CVE-2026-42789,
                         CVE-2026-48856, CVE-2026-94200,
                         CVE-2026-96596, ERIERL-1362, ERIERL-1367,
                         GH-11620, GH-11691, GH-11702, GH-11709,
                         GH-11724, GH-11735, GH-11748, GH-11762,
                         GH-SA-m75x-4vwg-ggjh, GH-SA-q7cq-pfgf-5hr7,
                         OTP-20155, OTP-20346, PR-11474, PR-11561,
                         PR-11623, PR-11662, PR-11692, PR-11707,
                         PR-11708, PR-11719, PR-11720, PR-11727,
                         PR-11753, PR-11755, PR-11763, PR-11767,
                         PR-11768, PR-11773, PR-11791, PR-11808,
                         PR-11823, PR-11824, PR-11825
System:                  OTP
Release:                 29
Application:             compiler-10.0.7, dialyzer-6.0.4, erts-17.1.1,
                         inets-9.8.1, mnesia-4.27.1, odbc-2.17.2,
                         public_key-1.21.8, snmp-5.20.6, ssh-6.0.7,
                         ssl-11.7.8, stdlib-8.1.1
Predecessor:             OTP 29.1.1

Check out the git tag OTP-29.1.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

  • When the max_channels limit is reached for a port-forwarding channel (direct-tcpip or forwarded-tcpip), the SSH daemon now refuses the individual channel with SSH_MSG_CHANNEL_OPEN_FAILURE and keeps the connection alive, instead of terminating the whole SSH connection. Port-forwarding channels now behave like session channels, which already survived the limit, and this matches OpenSSH. Applications that relied on the connection being closed when the channel limit was reached must instead handle the channel-open failure.

    Own Id: OTP-20420
    Application(s): ssh
    Related Id(s): PR-11708

compiler-10.0.7

The compiler-10.0.7 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fix native record bugs when used together with try...catch

    Own Id: OTP-20415
    Related Id(s): GH-11691, PR-11719

  • Compilation of a function with thousands of clauses would be very slow.

    Own Id: OTP-20437
    Related Id(s): GH-11735, PR-11767

  • Sometimes compiling with deterministic would not guarantee generation of identical BEAM files for every build.

    Own Id: OTP-20438
    Related Id(s): GH-11748, PR-11753

  • A crash in sys_core_fold on native record patterns has been eliminated.

    Own Id: OTP-20440
    Related Id(s): GH-11724, PR-11768

Full runtime dependencies of compiler-10.0.7

crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

dialyzer-6.0.4

The dialyzer-6.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Dialyzer will now avoid an infinite loop when multiple nominal types with the same structure are analyzed together.

    Own Id: OTP-20444
    Related Id(s): GH-11762, PR-11763

Full runtime dependencies of dialyzer-6.0.4

compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0

erts-17.1.1

The erts-17.1.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Two trace sessions that trace garbage_collection on the same process crash the emulator on the first collection.

    trace_gc() in erl_trace.c builds the GC info list on a temporary heap for the first session and frees it inside the session loop. The next session reuses msg, which now points into freed memory.

    The memory is now freed after the session loop, which removes the use-after-free.

    Own Id: OTP-20385
    Related Id(s): PR-11623

  • Fix native record bugs when used together with try...catch

    Own Id: OTP-20415
    Related Id(s): GH-11691, PR-11719

Full runtime dependencies of erts-17.1.1

kernel-9.0, sasl-3.3, stdlib-4.1

inets-9.8.1

The inets-9.8.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Credentials supplied in the userinfo component of a request URI (http://user:password@host/path) were still sent to the redirect target when httpc followed a cross-origin redirect. The userinfo component is now cleared together with the sensitive headers whenever the redirect target differs in host or port from the original request. Redirects that stay within the same origin are unaffected and still carry the credentials.

    Own Id: OTP-20456
    Related Id(s): GH-SA-m75x-4vwg-ggjh, PR-11825, CVE-2026-48856, OTP-20155

Full runtime dependencies of inets-9.8.1

erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, ssl-9.0, stdlib-5.0, stdlib-6.0

mnesia-4.27.1

The mnesia-4.27.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed the type specification for mnesia:restore/2, which incorrectly listed the operation restore_tables instead of recreate_tables, causing Dialyzer to reject valid calls and accept invalid ones.

    Own Id: OTP-20442
    Related Id(s): PR-11755

Full runtime dependencies of mnesia-4.27.1

erts-9.0, kernel-5.3, stdlib-5.0

odbc-2.17.2

The odbc-2.17.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fix error handling to avoid possible memory issues that could cause odbc port program to fail.

    Own Id: OTP-20439
    Related Id(s): PR-11808

Full runtime dependencies of odbc-2.17.2

erts-6.0, kernel-3.0, stdlib-2.0

public_key-1.21.8

The public_key-1.21.8 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Enforce the RFC 5280 basic-constraints CA checks for X.509 version 1 and version 2 certificates during certificate path validation. A v1/v2 certificate carries no extensions and therefore no basicConstraints, so it must never be accepted as a CA; such a certificate is now rejected in issuer position with {bad_cert, missing_basic_constraint} while remaining valid as a leaf. This closes the version-1 path left uncovered by the earlier CVE-2026-42789 fix.

    Own Id: OTP-20423
    Related Id(s): PR-11727, CVE-2026-42789

Full runtime dependencies of public_key-1.21.8

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

snmp-5.20.6

The snmp-5.20.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • The SNMP agent no longer fails to answer an SNMPv3 message whose msgUserName matches the configured terminating-discovery trigger_username (by default the empty string) and whose msgAuthoritativeEngineID is the agent's own engine ID. Such a message is not a stage-1 discovery request, but the agent treated it as one and then failed while generating the report, logging a configuration error and discarding the request without responding. The agent now answers it with a usmStatsUnknownUserNames report, as prescribed by RFC 3414, section 3.2. As a consequence of the same change, a message carrying the trigger user name together with an unknown, non-empty engine ID is now answered with a usmStatsUnknownEngineIDs report instead of being silently discarded.

    Own Id: OTP-20427
    Related Id(s): ERIERL-1362, PR-11823

  • The byte-length bounds added in OTP-20346 for varbind values now apply to every integer field decoded by snmp_pdus: the v3 header fields msgID, msgMaxSize and msgSecurityModel, the USM security parameters msgAuthoritativeEngineBoots and msgAuthoritativeEngineTime, and the PDU fields request-id, error-status, error-index, non-repeaters, max-repetitions, generic-trap and specific-trap. Each field accepts at most the number of BER content octets that its type requires, instead of an arbitrary number of octets that were converted into a large integer. An over-long integer is now signalled with an exit rather than a throw. Code that calls the exported snmp_pdus decode functions inside a catch will receive {'EXIT', Reason} where it previously received the thrown term directly. Inside the agent and manager, such a message is now discarded and counted in snmpInASNParseErrs; previously it caused a case_clause failure during message processing.

    Own Id: OTP-20428
    Related Id(s): GH-SA-q7cq-pfgf-5hr7, PR-11824, OTP-20346

Full runtime dependencies of snmp-5.20.6

asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime_tools-1.8.14, stdlib-5.0

ssh-6.0.7

The ssh-6.0.7 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed a bug where SSH CLI sessions using {shell, {shell, start, []}} did not handle latin1-encoded put_chars messages from the Erlang shell. This caused exception output (e.g. "** exception error: ...") to not be displayed on the SSH client, and {unhandled_request, ...} messages to appear on the daemon host.

    Own Id: OTP-20359
    Related Id(s): PR-11474

  • Fixed the following bugs in the SSH application:

    • The SFTP client (ssh_sftp) checked the channel state record against 0 instead of the exit status integer when handling an exit_status message. The success branch was therefore dead code, and every SFTP subsystem exit — including a clean exit with status 0 — was reported to callers as an error. A clean exit is now reported as a normal stop.
    • The SSH_FXP_EXTENDED_REPLY decoder in ssh_xfer bound only a single byte of the reply payload instead of the full binary (the pattern was missing a /binary specifier). This made SFTP extension operations such as statvfs@openssh.com fail with a function_clause crash whenever the payload was not exactly one byte.
    • The TCP forwarding acceptor supervisor used the default permanent restart strategy, causing the acceptor to be restarted unnecessarily when a forwarded socket closed normally. The child now uses a transient restart strategy.
    • The keyboard_interact_fun handling returned the atom nok instead of not_ok on an invalid response, causing a crash during SSH message encoding instead of a clean authentication rejection.
    • The ssh*client_channel catch pattern error:{undef, *} never matched Erlang's actual error:undef exception, so a missing optional handle_call/3 or handle_cast/2 callback crashed the channel process instead of being ignored. The catch now matches error:undef and uses erlang:function_exported/3 to tell a genuinely missing optional callback (ignored, as before) from an undef raised deeper inside an implemented callback (now re-raised instead of being silently swallowed).
    • Both ssh_tcpip_forward_client and ssh_tcpip_forward_srv called gen_tcp:close(undefined) in terminate/2 when the forwarding socket was never established (or already closed), producing noisy crash reports on normal forward teardown. terminate/2 now handles the undefined socket.

    Own Id: OTP-20360
    Related Id(s): PR-11561

  • Fixed an SSH port-forwarding acceptor crash triggered by a peer that connects and immediately resets the connection. Transient TCP errors from accept and peername are now handled gracefully instead of terminating the acceptor.

    Own Id: OTP-20392
    Related Id(s): PR-11720

  • When the max_channels limit is reached for a port-forwarding channel (direct-tcpip or forwarded-tcpip), the SSH daemon now refuses the individual channel with SSH_MSG_CHANNEL_OPEN_FAILURE and keeps the connection alive, instead of terminating the whole SSH connection. Port-forwarding channels now behave like session channels, which already survived the limit, and this matches OpenSSH. Applications that relied on the connection being closed when the channel limit was reached must instead handle the channel-open failure.

    Own Id: OTP-20420
    Related Id(s): PR-11708

    *** POTENTIAL INCOMPATIBILITY ***

Full runtime dependencies of ssh-6.0.7

crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-8.0

ssl-11.7.8

Note! The ssl-11.7.8 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.

   On a full OTP 29 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.21.1 (first satisfied in OTP 29.0.1)

Fixed Bugs and Malfunctions

  • DoS attack prevention missed corner case, now fall back to the incomplete peer-only chain handling when paths/2 yields no path, restoring the OTP 28 behavior and matching OpenSSL, curl and browsers. The digraph and its chain-length limit from PR #​11343 are unchanged, so the DoS protection is preserved; the extra cost is one trust-store lookup, as for a leaf-only chain.

    Own Id: OTP-20394
    Related Id(s): GH-11620, PR-11662

  • The equivalent options dh and dhfile where unintentionally ignored and the default value was used instead.

    Own Id: OTP-20408
    Related Id(s): ERIERL-1367, PR-11692

  • Redesign TLS-1.3 auto client ticket handling to adhere to RFC single-use by consuming a ticket when offered removing it from the client ticket store. This resolves unnecessary connections errors for concurrent client connections that previously could end up trying to use the same ticket, or tickets being evicted form the client store when a client still needed to look it up.

    Own Id: OTP-20418
    Related Id(s): GH-11702, GH-11709, PR-11707

  • Validate the handshake message type when decoding TLS-1.3 hello extensions (RFC 8446 / RFC 9846). A malicious or man-in-the-middle TLS-1.3 server could send a NewSessionTicket carrying a zero-length early_data extension, which a client with automatic session-ticket management (session_tickets => auto) stored and then crashed on during a later resumption, taking down the node-global client ticket store and disrupting TLS-1.3 resumption for the whole node. Extensions are now decoded only in the handshake messages in which they are permitted, so such a ticket is ignored instead of poisoning the store. This avoids a denial-of-service possibility.

    Own Id: OTP-20426
    Related Id(s): PR-11773, CVE-2026-94200

  • Fixed a TLS/DTLS session resumption flaw ((D)TLS-1.2 abbreviated handshake) where an SNI-aware server could resume a cached session even when the resumption request's server_name differed from the one that established the session, violating RFC 6066 §3. In virtual-hosting deployments where several SNI names share one server certificate but apply different client-authentication trust, a client could resume a session established under one SNI name while connecting under another — bypassing the second virtual service's client-authentication boundary and skipping the certificate exchange.

    The server now binds the establishing SNI hostname to the session and refuses resumption (falling back to a full handshake) when the requested SNI differs. A request without SNI only matches a session established without SNI, so ordinary non-SNI resumption is unaffected.

    As a related correction, a listener's derived reuse_sessions default (enabled under verify_none) is no longer carried into an SNI virtual service that switches to verify_peer; such a service must enable reuse_sessions explicitly.

    Own Id: OTP-20445
    Related Id(s): PR-11773, CVE-2026-105236

Full runtime dependencies of ssl-11.7.8

crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.21.1, runtime_tools-1.15.1, stdlib-7.0

stdlib-8.1.1

The stdlib-8.1.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • A loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the erl_tar module allowed an attacker who supplied a tar archive to cause a denial of service via a crafted GNU sparse member. This has been corrected.

    In addition, when attempting to extract a tar file with a legal GNU sparse member, extraction could fail with a badarg exception. That has also been corrected.

    Own Id: OTP-20447
    Related Id(s): PR-11791, CVE-2026-96596

Full runtime dependencies of stdlib-8.1.1

compiler-5.0, crypto-4.5, erts-16.0.3, kernel-11.0, sasl-3.0, syntax_tools-3.2.1

Thanks to

Alexey Aristov, Daniel Gorin, Marcelino Alberdi Pereira, Marko Mindek, Miguel Rubinos Rodríguez

v29.1.1: OTP 29.1.1

Compare Source

Patch Package:           OTP 29.1.1
Git Tag:                 OTP-29.1.1
Date:                    2026-09-22
Trouble Report Id:       OTP-20272, OTP-20287, OTP-20355, OTP-20371,
                         OTP-20386, OTP-20388, OTP-20390, OTP-20393
Seq num:                 CVE-2026-65634, CVE-2026-68956,
                         CVE-2026-89422, ERIERL-1355, ERIERL-1363,
                         GH-11586, GH-11619, GH-SA-qhcm-px9c-rvfh,
                         PR-11523, PR-11559, PR-11616, PR-11630,
                         PR-11638, PR-11641, PR-11651, PR-11655
System:                  OTP
Release:                 29
Application:             asn1-5.5.2, compiler-10.0.6,
                         public_key-1.21.7, ssh-6.0.6, ssl-11.7.7
Predecessor:             OTP 29.1

Check out the git tag OTP-29.1.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

  • Fixed a vulnerability where the max_channels daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit.

    The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting {max_channels, infinity}.

    The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting {max_sessions, infinity}.

    Own Id: OTP-20287
    Application(s): ssh
    Related Id(s): GH-SA-qhcm-px9c-rvfh, PR-11523, CVE-2026-68956

asn1-5.5.2

The asn1-5.5.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed a denial-of-service attack in asn1, where abnormally large OID components (arcs) could cause resource exhaustion.

    Own Id: OTP-20272
    Related Id(s): PR-11655, CVE-2026-65634

  • The JER backend will no longer break certain values (true, false, null) when they are typed as ENUMERATED, they will now be encoded as strings as required by the standard.

    Own Id: OTP-20355
    Related Id(s): ERIERL-1355, PR-11559

Full runtime dependencies of asn1-5.5.2

erts-14.0, kernel-9.0, stdlib-5.0

compiler-10.0.6

The compiler-10.0.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Certain uses of funs could crash the compiler. For example:

    f() ->
    F = fun Fn(0) -> 0; Fn(N) -> Fn(N - 1) end,
    [F(X) || X <- [1, 2]].

    This has been corrected.

    Own Id: OTP-20386
    Related Id(s): GH-11619, PR-11638

Full runtime dependencies of compiler-10.0.6

crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

public_key-1.21.7

The public_key-1.21.7 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Handle that policy qualifiers are optional.

    Own Id: OTP-20393
    Related Id(s): PR-11630

Full runtime dependencies of public_key-1.21.7

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

ssh-6.0.6

The ssh-6.0.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed a vulnerability where the max_channels daemon option was not enforced for session channels without an active subsystem, allowing a remote authenticated user to open an infinite number of channels and exhaust server resources despite the configured limit.

    The default value of the max_channels daemon option has been changed from infinity to 256. Deployments requiring more than 256 simultaneous channels per connection can restore the previous behavior by setting {max_channels, infinity}.

    The default value of the max_sessions daemon option has been changed from infinity to 1024. Deployments requiring more concurrent SSH connections can restore the previous behavior by setting {max_sessions, infinity}.

    Own Id: OTP-20287
    Related Id(s): GH-SA-qhcm-px9c-rvfh, PR-11523, CVE-2026-68956

    *** POTENTIAL INCOMPATIBILITY ***

  • The SSH daemon no longer rejects a subsystem request that is preceded by env or pty-req request on the same channel.

    Own Id: OTP-20371
    Related Id(s): ERIERL-1363, GH-11586, PR-11616

Full runtime dependencies of ssh-6.0.6

crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-8.0

ssl-11.7.7

Note! The ssl-11.7.7 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.

   On a full OTP 29 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.21.1 (first satisfied in OTP 29.0.1)

Fixed Bugs and Malfunctions

  • Reject unsolicited TLS-1.3 pre_shared_key in client.

    Own Id: OTP-20388
    Related Id(s): PR-11641, CVE-2026-89422

  • Security and robustness hardening returning RFC mandated alert reasons, narrowing/correcting length checks.

    Correct signature algorithm handling that slightly mixed up signature algorithms and signature algorithms cert in TLS-1.2.

    Add missing TLS-1.3 Brainpool groups support. (Not relevant in 27 patch)

    Enhanced/corrected documentation and spec errors/deviations.

    Own Id: OTP-20390
    Related Id(s): PR-11651

Full runtime dependencies of ssl-11.7.7

crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.21.1, runtime_tools-1.15.1, stdlib-7.0

Thanks to

Alan Duffield

v29.1: OTP 29.1

Compare Source

Patch Package:           OTP 29.1
Git Tag:                 OTP-29.1
Date:                    2026-09-16
Trouble Report Id:       OTP-19631, OTP-20118, OTP-20131, OTP-20145,
                         OTP-20152, OTP-20158, OTP-20169, OTP-20175,
                         OTP-20177, OTP-20180, OTP-20187, OTP-20188,
                         OTP-20189, OTP-20209, OTP-20211, OTP-20213,
                         OTP-20218, OTP-20228, OTP-20235, OTP-20236,
                         OTP-20238, OTP-20246, OTP-20249, OTP-20254,
                         OTP-20255, OTP-20256, OTP-20262, OTP-20265,
                         OTP-20267, OTP-20276, OTP-20277, OTP-20280,
                         OTP-20290, OTP-20291, OTP-20292, OTP-20293,
                         OTP-20295, OTP-20297, OTP-20298, OTP-20303,
                         OTP-20304, OTP-20305, OTP-20309, OTP-20316,
                         OTP-20317, OTP-20318, OTP-20320, OTP-20322,
                         OTP-20326, OTP-20327, OTP-20328, OTP-20331,
                         OTP-20335, OTP-20338, OTP-20339, OTP-20352,
                         OTP-20354, OTP-20356, OTP-20358, OTP-20362,
                         OTP-20364, OTP-20365, OTP-20367, OTP-20373,
                         OTP-20374
Seq num:                 ERIERL-1356, GH-10879, GH-10968, GH-11093,
                         GH-11119, GH-11155, GH-11248, GH-11308,
                         GH-11338, GH-11344, GH-11349, GH-11351,
                         GH-11352, GH-11360, GH-11366, GH-11367,
                         GH-11397, GH-11398, GH-11401, GH-11406,
                         GH-11413, GH-11414, GH-11423, GH-11472,
                         GH-11534, GH-4417, GH-7862, GH-9302,
                         OTP-20102, PR-10297, PR-11074, PR-11096,
                         PR-11097, PR-11115, PR-11128, PR-11129,
                         PR-11130, PR-11133, PR-11137, PR-11144,
                         PR-11159, PR-11165, PR-11167, PR-11170,
                         PR-11196, PR-11203, PR-11216, PR-11226,
                         PR-11249, PR-11260, PR-11274, PR-11284,
                         PR-11300, PR-11313, PR-11316, PR-11324,
                         PR-11335, PR-11345, PR-11356, PR-11359,
                         PR-11361, PR-11363, PR-11375, PR-11376,
                         PR-11378, PR-11379, PR-11388, PR-11390,
                         PR-11391, PR-11396, PR-11410, PR-11422,
                         PR-11424, PR-11426, PR-11438, PR-11440,
                         PR-11442, PR-11444, PR-11446, PR-11447,
                         PR-11460, PR-11466, PR-11477, PR-11501,
                         PR-11505, PR-11507, PR-11530, PR-11552,
                         PR-11556, PR-11563, PR-11566, PR-11567,
                         PR-11570, PR-11574, PR-11600
System:                  OTP
Release:                 29
Application:             asn1-5.5.1, common_test-1.31.2,
                         compiler-10.0.5, crypto-5.10, dialyzer-6.0.3,
                         erts-17.1, inets-9.8, kernel-11.0.4,
                         mnesia-4.27, odbc-2.17.1, public_key-1.21.6,
                         runtime_tools-2.5, ssl-11.7.6, stdlib-8.1,
                         syntax_tools-4.1.1, tools-4.2.3, wx-2.7
Predecessor:             OTP 29.0.6

Check out the git tag OTP-29.1, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

  • When beam_lib returns an error tuple, the filename in the information tuple is now a list of characters instead of an atom.

    Example:

    1> beam_lib:chunks(code:which(lists), ["nope"]).
{error,beam_lib,
       {missing_chunk,".../git/otp/lib/stdlib/ebin/lists.beam",
                      "nope"}}

    The reason for this change is that a long file name is not guaranteed to fit in an atom. Applications or tools that do deep inspection of the beam_lib errors (not recommended) will need to be updated.

    Own Id: OTP-20118
    Application(s): stdlib
    Related Id(s): PR-11167

OTP-29.1

Improvements and New Features

  • A new [versions] module has been added to the runtime_tools application containing functions for, e.g., comparing, versions that adhere to the OTP Versions Scheme.

    The documentation of the OTP Versions Scheme has also been improved.

    Own Id: OTP-20352
    Related Id(s): [PR-11556], [PR-11600]

asn1-5.5.1

The asn1-5.5.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • The modern representation of BITSTRINGs is now always supported for encoding, regardless of any legacy options given. The JER backend would not support the modern representation when any legacy option was given.

    Own Id: OTP-20145
    Related Id(s): PR-11097

  • The make clean command did not remove all generated .erl files.

    Own Id: OTP-20295
    Related Id(s): [PR-11375]

Full runtime dependencies of asn1-5.5.1

erts-14.0, kernel-9.0, stdlib-5.0

common_test-1.31.2

The common_test-1.31.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • The internal cte_track event handler now correctly displays the suite name for suites without an init_per_suite/1 callback.

    Own Id: OTP-20316
    Related Id(s): [PR-11501]

Full runtime dependencies of common_test-1.31.2

compiler-10.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, kernel-11.0, observer-2.1, runtime_tools-1.8.16, sasl-2.5, snmp-5.1.2, ssh-4.0, stdlib-8.0, syntax_tools-1.7, tools-3.2, xmerl-1.3.8

compiler-10.0.5

The compiler-10.0.5 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed a native record crash in the sys_core_fold compiler pass.

    Own Id: OTP-20254
    Related Id(s): GH-11351, [PR-11359]

  • The compiler could crash when compiling a map comprehension.

    Own Id: OTP-20255
    Related Id(s): GH-11352, [PR-11363]

  • Fixed a crash when the key pattern in a map comprehension was a bitstring.

    Own Id: OTP-20262
    Related Id(s): GH-11367, [PR-11379]

  • Fixed an issue that could crash the compiler when compiling comprehensions with the compr_assign feature enabled.

    Own Id: OTP-20267
    Related Id(s): GH-11366, [PR-11390]

  • Code that called erlang:0() inside a fun could crash the compiler.

    Own Id: OTP-20280
    Related Id(s): GH-11414, [PR-11424]

  • Fixed an internal error when lists:keyfind/3 is called with an argument that exceeds system limits.

    Own Id: OTP-20291
    Related Id(s): GH-11413, [PR-11444]

  • An incorrect useless_building warning has been eliminated.

    Own Id: OTP-20304
    Related Id(s): GH-11472, [PR-11477]

  • In rare circumstances, the type analysis pass of the compiler could run for many minutes.

    Own Id: OTP-20365
    Related Id(s): GH-11534, [PR-11566]

Full runtime dependencies of compiler-10.0.5

crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

crypto-5.10

The crypto-5.10 application can be applied independently of other applications on a full OTP 29 installation.

Improvements and New Features

  • The documentation of the crypto module now contains runnable examples for most functions. The examples are verified by the crypto test suite, so they always match actual behavior.

    Own Id: OTP-20373
    Related Id(s): PR-11170

Full runtime dependencies of crypto-5.10

erts-9.0, kernel-6.0, stdlib-3.9

dialyzer-6.0.3

The dialyzer-6.0.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed Dialyzer crash when overriding built-in types.

    Own Id: OTP-19631
    Related Id(s): GH-11093, PR-11096

  • Typer crashed when multiple functions were written in the same line. For example:

    -module(m).
f() -> ok. g() -> ok.

    Own Id: OTP-20297
    Related Id(s): [PR-11466]

Full runtime dependencies of dialyzer-6.0.3

compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0

erts-17.1

The erts-17.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed bug in ets:member/2 for set, bag and duplicate_bag. The bug could (maybe) lead to ets:member spuriously returning false for a value which is actually a member for a table that faces high insert load.

    Own Id: OTP-20152
    Related Id(s): PR-11115

  • Fixed crashing bug caused by race between timer creating process and suspending receiver of the timer. Only seen to cause crash one time by extremely provoking test case. Bug exists only since OTP 29.0.

    Own Id: OTP-20175
    Related Id(s): PR-11196

  • Fixed bug in enif_realloc_binary when called with a read-only binary. Instead of returning false at out-of-memory failure, it returned true and did nothing.

    Own Id: OTP-20187
    Related Id(s): PR-11133

  • Fixed alternate signal stack sizing on musl (Alpine) running on CPUs whose Linux kernel reports large signal frames (AVX-512/AMX). It caused emulator to abort during startup with "Failed to set alternate signal stack".

    Own Id: OTP-20213
    Related Id(s): GH-11248, PR-11249

  • For socket:recvmmsg/6, the buffer length was not handled correctly when the OS network stack truncated the received message, so garbage data with incorrect length could be delivered to the calling process. This bug has been corrected.

    Own Id: OTP-20246
    Related Id(s): [PR-11335]

  • binary_to_term/1 will now reject an external native record with duplicated fields.

    Own Id: OTP-20276
    Related Id(s): GH-11398, [PR-11410]

  • Fixed a crash upon starting the emulator on systems with a very large minimum signal stack size.

    Own Id: OTP-20292
    Related Id(s): GH-11349, [PR-11376]

  • Fixed lock order violation during crash dump due to export table exhaustion. Only problem for debug emulator.

    Own Id: OTP-20305
    Related Id(s): [PR-11460]

  • Fixed rounding errors when converting large integers to floating point numbers, explicitly with float/1 or implicitly in arithmetic such as 1.0 * N. Integers with absolute values larger than 64 bits that could not be represented exactly as a float could be rounded to the second nearest float instead of the nearest. For example, float(428654966685883400000) returned 4.2865496668588343e20 instead of the correct 4.286549666858834e20, which is what binary_to_float/1 returns for the same number.

    Own Id: OTP-20317
    Related Id(s): [PR-11391]

  • An error check in prim_inet has been fixed. This manifested itself as file:sendfile/* sometimes crashing instead of returning an error when the remote end closes the socket during initialization.

    Own Id: OTP-20356
    Related Id(s): [PR-11438]

Improvements and New Features

  • Fairness of code permission locks have been improved to avoid long latencies for code loading and trace operations.

    Own Id: OTP-20188
    Related Id(s): PR-11144

  • The BIFs that convert strings to integers (for example [binary_to_integer/1]) are now much faster for huge input strings. On a modern computer, even a string with more than a million decimal digits should finish in less than a second.

    The div and rem operators are now also much faster for large operands.

    Own Id: OTP-20209
    Related Id(s): PR-11074, PR-11324

  • Arithmetic operations on large integers will now increase the reduction count for the process, causing context switches to occur more frequently when doing arithmetic on large integers.

    Own Id: OTP-20211
    Related Id(s): PR-11274

Full runtime dependencies of erts-17.1

kernel-9.0, sasl-3.3, stdlib-4.1

inets-9.8

The inets-9.8 application can be applied independently of other applications on a full OTP 29 installation.

Improvements and New Features

  • OPTIONS is now accepted for HTTP/1.x requests and routed through the normal module pipeline like other standard methods. Requests that no module handles still receive a 501 (Not Implemented) response, so behavior is unchanged for deployments that do not add explicit OPTIONS handling.

    Own Id: OTP-20249
    Related Id(s): GH-11119, PR-11316

Full runtime dependencies of inets-9.8

erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, ssl-9.0, stdlib-5.0, stdlib-6.0

kernel-11.0.4

The kernel-11.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed incorrect TOS format when using gen_udp with the socket backend.

    Own Id: OTP-20131
    Related Id(s): GH-10968, OTP-20102

  • Decoding of names in inet_res has been tightened to not allow names longer than 255 octets, as according to RFC 1035.

    Decoding has also been made more strict by only allowing compression pointers to lower positions in the message.

    A few bugs when decoding malformed truncated DNS messages have also been fixed, as well as handling broken UTF-8 content in NAPTR RR:s regular expressions field.

    Own Id: OTP-20228
    Related Id(s): PR-11300

  • When using the socket backend in gen_tcp, the default value for the read_ahead option was incorrect and has been corrected, according the documentation, to be true.

    Own Id: OTP-20238
    Related Id(s): PR-11284

  • A field in net_kernel's internal state was not cleaned up in some cases for failed connections could cause the state to grow indefinitely over time. This has now been fixed.

    Own Id: OTP-20265
    Related Id(s): GH-11308, [PR-11388]

  • Fixed pg:which_groups/1 to not include empty groups where all members have leaved. Bug existed since OTP 29.0.

    Own Id: OTP-20303
    Related Id(s): GH-11360, [PR-11361]

Full runtime dependencies of kernel-11.0.4

crypto-5.8, erts-17.0, sasl-3.0, stdlib-8.0

mnesia-4.27

The mnesia-4.27 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed mnesia:force_load_table/1 getting stuck when the remote node becomes unreachable during table loading. When a network loader is aborted due to sender node going down and a user has forced a table load, we now retry loading from disc instead. Additionally, for disc_only_copies tables, the process actually loading the table is the dets server process, not the mnesia loader, so it would not receive the abort notification and would hang indefinitely. Now it correctly receives the notification and aborts table loading.

    Own Id: OTP-20256
    Related Id(s): GH-11344, [PR-11426]

  • Fixed incorrect results from mnesia:select_reverse/2,3 on ordered_set tables inside a transaction that had already written to or deleted from the same table. Deleted records could reappear, updated records could appear twice, and the descending order was not preserved.

    Own Id: OTP-20364
    Related Id(s): [PR-11563]

Improvements and New Features

  • The documentation of the mnesia module now contains runnable examples for most functions. The examples are verified by the mnesia test suite, so they always match actual behavior.

    Own Id: OTP-20374
    Related Id(s): PR-11216

Full runtime dependencies of mnesia-4.27

erts-9.0, kernel-5.3, stdlib-5.0

odbc-2.17.1

The odbc-2.17.1 application can be applied independently of other applications on a full OTP 29 installation.

Improvements and New Features

  • Added the max_long_column_size option to limit buffer allocation size preventing memory exhaustion.

    Own Id: OTP-20328
    Related Id(s): GH-9302, PR-10297

Full runtime dependencies of odbc-2.17.1

erts-6.0, kernel-3.0, stdlib-2.0

public_key-1.21.6

The public_key-1.21.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Added missing no_cacerts_found clauses so that the intended {failed_load_cacerts, no_cacerts_found} error is raised and formatted properly.

    Own Id: OTP-20318
    Related Id(s): [PR-11378]

  • Align moduli and pubkey_moduli.hrl to state on OTP-28 and newer.

    Own Id: OTP-20367
    Related Id(s): [PR-11574]

Improvements and New Features

  • Worked around domain component using wrong ASN-1 PrintableString encoding instead of IA5String encoding.

    Own Id: OTP-20338
    Related Id(s): GH-10879, PR-11226

  • ASN.1 files are now compiled sequentially to guarantee reproducible builds.

    Own Id: OTP-20362
    Related Id(s): GH-4417, [PR-11396]

Full runtime dependencies of public_key-1.21.6

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

runtime_tools-2.5

The runtime_tools-2.5 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed bug if a process that called dbg:session/2 exits before dbg:session_destroy/1 is called. An error report was logged and any trace messages lost and not delivered.

    Own Id: OTP-20218
    Related Id(s): PR-11260

Improvements and New Features

  • A new [versions] module has been added to the runtime_tools application containing functions for, e.g., comparing, versions that adhere to the OTP Versions Scheme.

    The documentation of the OTP Versions Scheme has also been improved.

    Own Id: OTP-20352
    Related Id(s): [PR-11556], [PR-11600]

Full runtime dependencies of runtime_tools-2.5

erts-16.0, kernel-10.0, mnesia-4.12, stdlib-6.0

ssl-11.7.6

Note! The ssl-11.7.6 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.

   On a full OTP 29 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.21.1 (first satisfied in OTP 29.0.1)

Fixed Bugs and Malfunctions

  • Undecodable certificate_authorities names are now skipped, as they are just a hint.

    Own Id: OTP-20327
    Related Id(s): GH-11338, [PR-11356]

  • Corrected generated keylog information generated from the keylog_hs option in the corner case that it was invoked after the client had reached its connection state, but the server closed the connection before it reached its connection state.

    Own Id: OTP-20358
    Related Id(s): ERIERL-1356, [PR-11570]

Improvements and New Features

  • Added TLS-1.3 selected_group to ssl:connection_information/2.

    Own Id: OTP-20326
    Related Id(s): [PR-11440]

  • The ECDHE-PSK Chacha20-Poly1305 cipher suites are now supported. This is relevant for TLS-1.2 (and lower).

    Own Id: OTP-20331
    Related Id(s): [PR-11345]

Full runtime dependencies of ssl-11.7.6

crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.21.1, runtime_tools-1.15.1, stdlib-7.0

stdlib-8.1

The stdlib-8.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • When beam_lib returns an error tuple, the filename in the information tuple is now a list of characters instead of an atom.

    Example:

    1> beam_lib:chunks(code:which(lists), ["nope"]).
{error,beam_lib,
       {missing_chunk,".../git/otp/lib/stdlib/ebin/lists.beam",
                      "nope"}}

    The reason for this change is that a long file name is not guaranteed to fit in an atom. Applications or tools that do deep inspection of the beam_lib errors (not recommended) will need to be updated.

    Own Id: OTP-20118
    Related Id(s): PR-11167

    *** POTENTIAL INCOMPATIBILITY ***

  • The default seed in the rand module has been improved to spread out its entropy over all three seed words.

    This avoids identical first random numbers from two successive seeds on machines with low system time resolution.

    Own Id: OTP-20158
    Related Id(s): PR-11165

  • Fixed unicode:characters_to_binary/2 to handle incomplete utf-32 sequences without crashing.

    Also fixed a performance regression in unicode:characters_to_nfkd_list/1.

    Own Id: OTP-20169
    Related Id(s): PR-11130

  • The array module has been improved. array:slice/3 now raises badarg for negative lengths.

    The performance of array:mapfoldl/3 and array:sparse_mapfoldl/3 has been improved.

    The documentation has been clarified regarding array growth/shrink behavior and how concat/1,2 handles mixed arrays.

    Own Id: OTP-20177
    Related Id(s): PR-11159

  • Added more checks in the linter for badly formed {Name,Arity} attributes

    Own Id: OTP-20277
    Related Id(s): GH-11397, [PR-11422]

  • Fixed return value of zip:zip_get/2. When a file was extracted to a directory, the function returned a map instead of a file name.

    Own Id: OTP-20298
    Related Id(s): PR-11313

  • When compr_assign is enabled, the linter will correctly check for unbounded variables after block expressions in comprehensions.

    Own Id: OTP-20309
    Related Id(s): GH-11406, [PR-11567]

  • When compiling a module with a triple-quoted string with escape sequences and a chunk boundary happened to fall just after an escape character, that character was not passed to the reentrancy continuation, so the scanner interpreted the following characters as not an escape sequence.

    This bug has now been fixed.

    Own Id: OTP-20320
    Related Id(s): GH-11423, [PR-11505]

  • Fixed some errors in examples in the documentation for the [string] and [uri_string] modules.

    Own Id: OTP-20322
    Related Id(s): [PR-11446]

  • Linter will emit better error messages when a behaviour attribute has a bad module name.

    Own Id: OTP-20354
    Related Id(s): GH-11401, [PR-11552]

Improvements and New Features

  • uri_string:parse/1 now reports the actual offending character in error tuples instead of reporting a misleading cascade-failure position.

    Previously, when parsing a URI containing an invalid character (such as | or non-ASCII characters like ö), the error tuple would point to the : character — the position where the parser's final backtracking attempt failed — rather than the character that actually violated the URI grammar. For example, uri_string:parse("http://localhost/A|B") returned {error,invalid_uri,":"} instead of the more helpful {error,invalid_uri,"|"}

    Own Id: OTP-20235
    Related Id(s): GH-7862, PR-11129

  • Fixed a guard precedence bug in uri_string:compose_query/2 that caused inconsistent error handling depending on the encoding option.

    When compose_query/2 was called with invalid input (e.g. an atom instead of a string) and {encoding, unicode}, it would crash with ** exception error: bad argument instead of returning the expected {error, invalid_input, Term} tuple. The same call with {encoding, utf8} correctly returned the error tuple. Both encoding options now consistently return {error, invalid_input, Term} for invalid input.

    Own Id: OTP-20236
    Related Id(s): PR-11128

Full runtime dependencies of stdlib-8.1

compiler-5.0, crypto-4.5, erts-16.0.3, kernel-11.0, sasl-3.0, syntax_tools-3.2.1

syntax_tools-4.1.1

The syntax_tools-4.1.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • Fixed exception when the epp_dodger AST contains macro-named record.

    Own Id: OTP-20180
    Related Id(s): GH-11155, PR-11203

  • Any caller who passed a single syntax tree that was not a form_list (e.g. erl_recomment:recomment_forms(erl_syntax:atom(foo), Cs) or any expression/function tree) would get a hard crash instead of the documented result. This issue has been fixed.

    Own Id: OTP-20290
    Related Id(s): [PR-11442]

Full runtime dependencies of syntax_tools-4.1.1

compiler-9.0, erts-16.0, kernel-10.3, stdlib-8.0

tools-4.2.3

The tools-4.2.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • The tags.erl module is used to generate TAGS files for Emacs. There was a case where single quote items starting in position 0 would crash the scanner. This use case can potentially happen in docstrings, although not too common. This fix makes the scanner to handle such cases instead of crashing.

    Own Id: OTP-20293
    Related Id(s): [PR-11447]

  • Updated the Emacs skeleton to reflect latest format_status callback handling.

    Own Id: OTP-20339
    Related Id(s): [PR-11507]

Full runtime dependencies of tools-4.2.3

compiler-8.5, crypto-5.9, erts-15.0, kernel-10.0, public_key-1.21, runtime_tools-2.1, stdlib-6.0

wx-2.7

The wx-2.7 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

  • A large set of correctness and robustness fixes were applied across the wx application, addressing issues found by static analysis of both the Erlang and C/C++ sources.

    Own Id: OTP-20335
    Related Id(s): [PR-11530]

Improvements and New Features

  • Removed configure checks that prevented cross compilation of wx. Note that cross compilation is not tested and may require manual configuration.

    Own Id: OTP-20189
    Related Id(s): PR-11137

Full runtime dependencies of wx-2.7

erts-12.0, kernel-8.0, stdlib-5.0

Thanks to

Alois Vitasek, Anton Thomasson, ausimian, Bernhard M. Wiedemann, Cole Christensen, Dmitri Vereshchagin, Dmytro Lytovchenko, Eric Meadows-Jönsson, haoxian, Jianbo He, João Henrique Ferreira de Freitas, Johan Bevemyr, John Downey, Jonatan Männchen, Julian Doherty, kagetora66, k-patrik, Louis Pilfold, Lukasz Samson, Luke Bakken, Maria Scott, Mikael Pettersson, Paul Guyot, Renato Ceolin, ruslandoga, Scott Wiggins, Stanislav Yaglo, Thomas Arts, Thomas Cioppettini, Zeke Dou, zmstone

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/erlang-29.x branch from 68bdd91 to 7fa4b81 Compare October 16, 2026 22:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants