chore(deps): update dependency erlang to v28

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
erlang	major	27.3.4 → 28.4

---

Release Notes

erlang/otp (erlang)

v28.4: OTP 28.4

Compare Source

Patch Package:           OTP 28.4
Git Tag:                 OTP-28.4
Date:                    2026-03-04
Trouble Report Id:       OTP-16607, OTP-19824, OTP-19860, OTP-19886,
                         OTP-19892, OTP-19901, OTP-19904, OTP-19905,
                         OTP-19907, OTP-19908, OTP-19911, OTP-19913,
                         OTP-19914, OTP-19920, OTP-19923, OTP-19928,
                         OTP-19937, OTP-19939, OTP-19940, OTP-19941,
                         OTP-19948, OTP-19950, OTP-19951, OTP-19952,
                         OTP-19959, OTP-19972, OTP-19973, OTP-19974,
                         OTP-19976, OTP-19977, OTP-19979, OTP-19987,
                         OTP-19988, OTP-19989, OTP-19990, OTP-19992,
                         OTP-19998, OTP-20006
Seq num:                 ERIERL-1251, ERIERL-1264, ERIERL-1283,
                         GH-10351, GH-10371, GH-10470, GH-10474,
                         GH-10494, GH-10495, GH-10501, GH-10513,
                         GH-10567, GH-10652, GH-10698, GH-10705,
                         GH-9681, OTP-16608, PR-10271, PR-10385,
                         PR-10434, PR-10438, PR-10451, PR-10469,
                         PR-10484, PR-10486, PR-10496, PR-10512,
                         PR-10521, PR-10522, PR-10536, PR-10537,
                         PR-10546, PR-10550, PR-10576, PR-10583,
                         PR-10586, PR-10588, PR-10599, PR-10602,
                         PR-10623, PR-10624, PR-10625, PR-10630,
                         PR-10655, PR-10665, PR-10668, PR-10672,
                         PR-10673, PR-10675, PR-10678, PR-10684,
                         PR-10708, PR-10714, PR-10723, PR-10752,
                         PR-9695
System:                  OTP
Release:                 28
Application:             asn1-5.4.3, common_test-1.30, compiler-9.0.5,
                         crypto-5.8.2, diameter-2.6.1,
                         erl_interface-5.6.4, erts-16.3, et-1.7.3,
                         eunit-2.10.2, inets-9.6, kernel-10.6,
                         megaco-4.8.3, mnesia-4.25.2, observer-2.18.2,
                         odbc-2.16.1, parsetools-2.7.1,
                         public_key-1.20.2, reltool-1.0.3,
                         runtime_tools-2.3.1, sasl-4.3.1, snmp-5.20.1,
                         ssh-5.5, ssl-11.5.2, stdlib-7.3,
                         syntax_tools-4.0.3, tools-4.1.4, wx-2.5.4,
                         xmerl-2.1.9
Predecessor:             OTP 28.3.3

Check out the git tag OTP-28.4, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

HIGHLIGHTS

• Added support for the PQC key exchange (kex) algorithm mlkem768x25519-sha256, a hybrid quantum-resistant algorithm combining ML-KEM-768 with X25519.

  Own Id: OTP-19824
  Application(s): ssh
  Related Id(s): PR-10512, PR-10655

• Added persistent_term:put_new/2 that will quickly do nothing if a term with the given name and value already exists, and raise a badarg exception if the term exists with a different value.

  Own Id: OTP-19908
  Application(s): erts
  Related Id(s): GH-9681, [PR-9695]

POTENTIAL INCOMPATIBILITIES

• Added a new HttpOption {autoretry, timeout()} to httpc:request/4,5. This option allows the client to decide how to act upon receiving a Retry-After response header. The default behavior changes, as now only one retry is made before returning the error code, instead of retrying infinitely.

  Own Id: OTP-19892
  Application(s): inets
  Related Id(s): ERIERL-1283, PR-10469

OTP-28.4

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

• The GH Actions CI forbids non-maintainers to commit *.beam files to the Erlang/OTP repo

  Own Id: OTP-19923
  Related Id(s): PR-10550

• Updated openssl from 3.6.0 to 3.6.1.

  This change does not perform any changes in the md5 vendor implementation from openssl. The change merges upstream cosmetic changes from openssl. This is necessary to automatically migrate cleanly to the next openssl version without conflicts with upstream.

  Own Id: OTP-19959
  Related Id(s): PR-10630

• The removal of the [slave] and [slave] modules have been postponed to Erlang/OTP 31.

  The partial removal of the archive feature has been postponed to Erlang/OTP 30.

  Own Id: OTP-19989
  Related Id(s): [PR-10714]

asn1-5.4.3

The asn1-5.4.3 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of asn1-5.4.3

erts-14.0, kernel-9.0, stdlib-5.0

common_test-1.30

The common_test-1.30 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Added documentation about the behavior of ct:comment/1 and ct:comment/2 when executed from processes other than the process running test functions.

  Own Id: OTP-19913
  Related Id(s): ERIERL-1264, PR-10271

Improvements and New Features

• Updated jquery to 4.0.0

  Own Id: OTP-19972
  Related Id(s): PR-10623, PR-10624, PR-10625, PR-10665

• The removal of the [slave] and [slave] modules have been postponed to Erlang/OTP 31.

  The partial removal of the archive feature has been postponed to Erlang/OTP 30.

  Own Id: OTP-19989
  Related Id(s): [PR-10714]

Full runtime dependencies of common_test-1.30

compiler-6.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, kernel-8.4, observer-2.1, runtime_tools-1.8.16, sasl-2.5, snmp-5.1.2, ssh-4.0, stdlib-4.0, syntax_tools-1.7, tools-3.2, xmerl-1.3.8

compiler-9.0.5

The compiler-9.0.5 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Fixed a compiler alias analysis bug that could generate unsafe code for repeated binary segments.

  Own Id: OTP-19951
  Related Id(s): PR-10588

Full runtime dependencies of compiler-9.0.5

crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0

crypto-5.8.2

The crypto-5.8.2 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Fixed crypto:crypto_one_time_aead/4, which could crash the runtime system if invoked in parallel with the same state.

  Own Id: OTP-19973
  Related Id(s): GH-10652, PR-10668

Full runtime dependencies of crypto-5.8.2

erts-9.0, kernel-6.0, stdlib-3.9

diameter-2.6.1

The diameter-2.6.1 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of diameter-2.6.1

erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0

erl_interface-5.6.4

The erl_interface-5.6.4 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Updated openssl from 3.6.0 to 3.6.1.

  This change does not perform any changes in the md5 vendor implementation from openssl. The change merges upstream cosmetic changes from openssl. This is necessary to automatically migrate cleanly to the next openssl version without conflicts with upstream.

  Own Id: OTP-19959
  Related Id(s): PR-10630

Known Bugs and Problems

• The ei API for decoding/encoding terms is not fully 64-bit compatible since terms that have a representation on the external term format larger than 2 GB cannot be handled.

  Own Id: OTP-16607
  Related Id(s): OTP-16608

erts-16.3

The erts-16.3 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Fixed a documentation build warning when one or more applications failed their configure step and were skipped.

  Own Id: OTP-19914
  Related Id(s): ERIERL-1251, PR-10537

• The (IPv6) flowinfo control message header was not properly supported.

  Own Id: OTP-19977

• Fixed NetBSD thread naming, using pthread_setname_np(); used for debugging.

  Own Id: OTP-19987
  Related Id(s): [PR-10684]

Improvements and New Features

• The erlang:link_option/0 type is now exported.

  Own Id: OTP-19904
  Related Id(s): PR-10451

• Added persistent_term:put_new/2 that will quickly do nothing if a term with the given name and value already exists, and raise a badarg exception if the term exists with a different value.

  Own Id: OTP-19908
  Related Id(s): GH-9681, [PR-9695]

  *** HIGHLIGHT ***

• The manifest.xml file for the Windows build now has version numbers updated to correctly report OS versions on Windows 10, 11, Server 2016, 2019, 2022.

  Own Id: OTP-19920
  Related Id(s): GH-10371, PR-10546

• Improved yielding inside re:run. Regular expressions searching for one specific byte character could spin in memchr() without any yielding or reduction counting.

  Own Id: OTP-19950
  Related Id(s): PR-10486

• Updated openssl from 3.6.0 to 3.6.1.

  This change does not perform any changes in the md5 vendor implementation from openssl. The change merges upstream cosmetic changes from openssl. This is necessary to automatically migrate cleanly to the next openssl version without conflicts with upstream.

  Own Id: OTP-19959
  Related Id(s): PR-10630

• Updated ryu implementation used to convert floats to strings.

  Own Id: OTP-19974
  Related Id(s): PR-10672

• Upgraded asmjit to v1.18

  Own Id: OTP-19979
  Related Id(s): PR-10675

• Updated zlib to version 1.3.2.

  Own Id: OTP-19998
  Related Id(s): [PR-10752]

Full runtime dependencies of erts-16.3

kernel-9.0, sasl-3.3, stdlib-4.1

et-1.7.3

The et-1.7.3 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of et-1.7.3

erts-9.0, kernel-5.3, runtime_tools-1.10, stdlib-3.4, wx-1.2

eunit-2.10.2

The eunit-2.10.2 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of eunit-2.10.2

erts-9.0, kernel-5.3, stdlib-6.0

inets-9.6

The inets-9.6 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

• Added a new HttpOption {autoretry, timeout()} to httpc:request/4,5. This option allows the client to decide how to act upon receiving a Retry-After response header. The default behavior changes, as now only one retry is made before returning the error code, instead of retrying infinitely.

  Own Id: OTP-19892
  Related Id(s): ERIERL-1283, PR-10469

  *** POTENTIAL INCOMPATIBILITY ***

• Httpc will not add a Content-Length header for requests, that do not have defined semantics for request content in [RFC9110] and do not include content. The list includes methods: [GET, HEAD, OPTIONS, TRACE, DELETE]. The behavior for headers_as_is option remains unchanged.

  Own Id: OTP-19928
  Related Id(s): GH-10513, PR-10521

• Improved documentation and specs for do/1 callback in httpd module.

  Own Id: OTP-19952
  Related Id(s): GH-10501, PR-10602

Full runtime dependencies of inets-9.6

erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, ssl-9.0, stdlib-5.0, stdlib-6.0

kernel-10.6

The kernel-10.6 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• The built in DNS resolver inet_res has been fixed to do a final request assuming that the request name is absolute, as customary for many DNS resolver client libraries.

  Own Id: OTP-19937
  Related Id(s): GH-10494, PR-10576

Improvements and New Features

• Added support for zstd compression in the [file] module.

  Own Id: OTP-19860
  Related Id(s): PR-10385

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of kernel-10.6

crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-7.0

megaco-4.8.3

The megaco-4.8.3 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of megaco-4.8.3

asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14, stdlib-2.5

mnesia-4.25.2

The mnesia-4.25.2 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of mnesia-4.25.2

erts-9.0, kernel-5.3, stdlib-5.0

observer-2.18.2

The observer-2.18.2 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of observer-2.18.2

erts-15.0, et-1.5, kernel-10.0, runtime_tools-2.1, stdlib-5.0, wx-2.3

odbc-2.16.1

The odbc-2.16.1 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Corrected specs to eliminate Dialyzer warnings for applications.

  Own Id: OTP-19992
  Related Id(s): PR-10678

Full runtime dependencies of odbc-2.16.1

erts-6.0, kernel-3.0, stdlib-2.0

parsetools-2.7.1

The parsetools-2.7.1 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• The documentation for the token/3 and tokens/3 functions was corrected. The return value when there were too few characters is {more,Cont}.

  Own Id: OTP-19901
  Related Id(s): PR-10484

Full runtime dependencies of parsetools-2.7.1

erts-6.0, kernel-3.0, stdlib-3.4

public_key-1.20.2

Note! The public_key-1.20.2 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- crypto-5.8 (first satisfied in OTP 28.3)

Fixed Bugs and Malfunctions

• Added missing mapping for der_encode/decode to handle 'OCSPRequest'.

  Own Id: OTP-19905
  Related Id(s): GH-10474, PR-10522

• public_key:pkix_crl_verify/2 now handles certificates with EdDSA keys correctly instead of causing a runtime error.

  Own Id: OTP-19907
  Related Id(s): GH-10495, PR-10496

Full runtime dependencies of public_key-1.20.2

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

reltool-1.0.3

The reltool-1.0.3 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of reltool-1.0.3

erts-15.0, kernel-9.0, sasl-4.2.1, stdlib-5.0, tools-2.6.14, wx-2.3

runtime_tools-2.3.1

The runtime_tools-2.3.1 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of runtime_tools-2.3.1

erts-16.0, kernel-10.0, mnesia-4.12, stdlib-6.0

sasl-4.3.1

The sasl-4.3.1 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of sasl-4.3.1

erts-15.0, kernel-6.0, stdlib-4.0, tools-2.6.14

snmp-5.20.1

The snmp-5.20.1 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of snmp-5.20.1

asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime_tools-1.8.14, stdlib-5.0

ssh-5.5

Note! The ssh-5.5 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- crypto-5.7 (first satisfied in OTP 28.1)

Fixed Bugs and Malfunctions

• The type specification for the CbInitArgs parameter in ssh_client_channel:start/4 and ssh_client_channel:start_link/4 has been relaxed from [term()] to term(). This eliminates false Dialyzer warnings when passing non-list arguments (such as maps or atoms) to these functions. This change is backward compatible as term() includes [term()].

  Own Id: OTP-19976
  Related Id(s): GH-10351, PR-10673

Improvements and New Features

• Added support for the PQC key exchange (kex) algorithm mlkem768x25519-sha256, a hybrid quantum-resistant algorithm combining ML-KEM-768 with X25519.

  Own Id: OTP-19824
  Related Id(s): PR-10512, PR-10655

  *** HIGHLIGHT ***

Full runtime dependencies of ssh-5.5

crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-5.0, stdlib-6.0

ssl-11.5.2

Note! The ssl-11.5.2 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependencies have to be satisfied:
   -- crypto-5.8 (first satisfied in OTP 28.3)
   -- public_key-1.18.3 (first satisfied in OTP 28.1)

Fixed Bugs and Malfunctions

• TLS servers that have early_data disabled will no longer include the early_data extension in its session tickets.

  Own Id: OTP-19940
  Related Id(s): GH-10567, PR-10583

• ssl:connection_information/2 will now return correct information for TLS-1.2 session resumption.

  Own Id: OTP-19941
  Related Id(s): GH-10470, PR-10586

• When performing renegotiation, in TLS-1.2 or earlier, `max_frag_length` will no longer be renegotiated. Instead, the connection will adhere to its originally negotiated value, and if a value was not negotiated it will not be negotiated.

  Own Id: OTP-19948
  Related Id(s): PR-10599

• The NSS Keylogging refactoring mixed up of Read and Write connection states, could cause wrong NSS keylog labels, or {error, closed} returned without keylog.

  Own Id: OTP-19990
  Related Id(s): GH-10698, [PR-10723]

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of ssl-11.5.2

crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.18.3, runtime_tools-1.15.1, stdlib-7.0

stdlib-7.3

Note! The stdlib-7.3 application cannot be applied independently of other applications on an arbitrary OTP 28 installation.

   On a full OTP 28 installation, also the following runtime
   dependency has to be satisfied:
   -- erts-16.0.3 (first satisfied in OTP 28.0.3)

Fixed Bugs and Malfunctions

• Fixed functions ets:init_table/2, ets:tab2file/2,3, ets:table/1,2, ets:i/0,1, dets:from_ets/2, and dets:to_ets/2 to resolve named table arguments only once. This will prevent strange effects if the named table is deleted and recreated by a concurrent process.

  Own Id: OTP-19911
  Related Id(s): PR-10536

• Corrected the af_zip_generator() type in the parser and syntax_tools.

  Own Id: OTP-19939

• For a function that started with a bracket-only pattern (such as []), the ?FUNCTION_ARITY macro would evaluate to one less than the actual arity.

  Own Id: OTP-19988
  Related Id(s): GH-10705, [PR-10708]

Improvements and New Features

• Added support for zstd compression in the [file] module.

  Own Id: OTP-19860
  Related Id(s): PR-10385

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

• The removal of the [slave] and [slave] modules have been postponed to Erlang/OTP 31.

  The partial removal of the archive feature has been postponed to Erlang/OTP 30.

  Own Id: OTP-19989
  Related Id(s): [PR-10714]

Full runtime dependencies of stdlib-7.3

compiler-5.0, crypto-4.5, erts-16.0.3, kernel-10.0, sasl-3.0, syntax_tools-3.2.1

syntax_tools-4.0.3

The syntax_tools-4.0.3 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Corrected the af_zip_generator() type in the parser and syntax_tools.

  Own Id: OTP-19939

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of syntax_tools-4.0.3

compiler-9.0, erts-16.0, kernel-10.3, stdlib-7.0

tools-4.1.4

The tools-4.1.4 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of tools-4.1.4

compiler-8.5, erts-15.0, erts-15.0, kernel-10.0, runtime_tools-2.1, stdlib-6.0

wx-2.5.4

The wx-2.5.4 application can be applied independently of other applications on a full OTP 28 installation.

Improvements and New Features

• Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages.

  A make release application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore.

  make release_docs places the documentation in the released code under the doc folder.

  make release_tests places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore.

  The Software Bill of Materials places the examples folders as if they are part of the SPDX-otp-<app>-doc packge, instead of placing examples as if they were running source code.

  Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run ./Install -minimal \pwd`and add the release to thePATH. After that, one can run tests as usual, going into the released tests directory, entering test_server` and running the emulator.

  Improves the source Software-Bill-of-Materials

  • The improvements adds new SPDX relations for asmjit and zlib to be optional_components_of the Erlang/OTP project.
  • The autoconf scripts in make and erts have now been categorised as build_tool_of the Erlang/OTP project.
  • All remaining configure, configure.ac, config.h.in, Makefile.in, Makefile.src, EMakefile, and GNUMakefile are now part of a specific SPDX package with relation build_tool_of the Erlang/OTP project.

  Own Id: OTP-19886
  Related Id(s): PR-10434

Full runtime dependencies of wx-2.5.4

erts-12.0, kernel-8.0, stdlib-5.0

xmerl-2.1.9

The xmerl-2.1.9 application can be applied independently of other applications on a full OTP 28 installation.

Fixed Bugs and Malfunctions

• Fixed license headers and links in documentation.

  Own Id: OTP-20006
  Related Id(s): PR-10438

Full runtime dependencies of xmerl-2.1.9

erts-6.0, kernel-8.4, stdlib-2.5

Thanks to

Benjamin Philip, Dmytro Lytovchenko, Jan Uhlig, Jonatan Männchen, Luke Bakken, Maria Scott, Mend Renovate, Nelson Vides, Robert Gionea, ryan-duve, Stavros Aronis, Stefan Grundmann, wallacegibbon

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing Touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch renovate/erlang-28.x

---

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Explain this complex logic.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai explain this code block.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and explain its main purpose.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate docstrings to generate docstrings for this PR.
• @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
• @coderabbitai generate unit tests to generate unit tests for this PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.