Update dependency erlang to v29 by renovate[bot] · Pull Request #69 · RoyalMist/sms-up

renovate · 2026-05-13T10:04:29Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
erlang	tools	major	`27.3.4` → `29.0.6`

Release Notes

erlang/otp (erlang)

`v29.0.6`: OTP 29.0.6

Compare Source

Patch Package:           OTP 29.0.6
Git Tag:                 OTP-29.0.6
Date:                    2026-09-01
Trouble Report Id:       OTP-20135, OTP-20234, OTP-20264, OTP-20268,
                         OTP-20269, OTP-20270, OTP-20271, OTP-20274,
                         OTP-20278, OTP-20279, OTP-20281, OTP-20282,
                         OTP-20284, OTP-20286, OTP-20289, OTP-20296,
                         OTP-20300, OTP-20301, OTP-20302, OTP-20306,
                         OTP-20307, OTP-20308, OTP-20312, OTP-20319,
                         OTP-20321, OTP-20324, OTP-20330, OTP-20333,
                         OTP-20334, OTP-20342, OTP-20343, OTP-20344,
                         OTP-20345, OTP-20346, OTP-20347, OTP-20350,
                         OTP-20351
Seq num:                 CVE-2026-75538, ERIERL-1345, ERIERL-1354,
                         GH-11052, GH-11240, GH-11278, GH-11380,
                         GH-11404, GH-11416, GH-11419, GH-11494,
                         GH-11511, PR-11298, PR-11325, PR-11358,
                         PR-11417, PR-11425, PR-11428, PR-11429,
                         PR-11437, PR-11463, PR-11464, PR-11470,
                         PR-11478, PR-11481, PR-11485, PR-11492,
                         PR-11503, PR-11509, PR-11513, PR-11517,
                         PR-11521, PR-11533, PR-11538, PR-11539,
                         PR-11540, PR-11541, PR-11542, PR-11543,
                         PR-11544, PR-11545, PR-11546, PR-11547,
                         PR-11548, PR-11553, PR-11554
System:                  OTP
Release:                 29
Application:             compiler-10.0.4, crypto-5.9.3, eldap-1.3.1,
                         erl_interface-5.8.2, erts-17.0.6,
                         inets-9.7.2, megaco-4.9.2, mnesia-4.26.2,
                         public_key-1.21.5, snmp-5.20.5, ssh-6.0.5,
                         ssl-11.7.5, stdlib-8.0.4, tools-4.2.2
Predecessor:             OTP 29.0.5

Check out the git tag OTP-29.0.6, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

compiler-10.0.4

The compiler-10.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

compiler: Fix bug in beam_types:subtract/2 for bitstrings

Own Id: OTP-20312
Related Id(s): GH-11494, PR-11503

Full runtime dependencies of compiler-10.0.4

crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

crypto-5.9.3

The crypto-5.9.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed type mismatch between ErlNifUInt64 and uint64_t in crypto NIF that caused incompatible-pointer warnings on macOS arm64 when passing DH parameters to OpenSSL.

Own Id: OTP-20333
Related Id(s): GH-11511, PR-11513

Full runtime dependencies of crypto-5.9.3

erts-9.0, kernel-6.0, stdlib-3.9

eldap-1.3.1

The eldap-1.3.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

eldap referral URL parsing now rejects a port component longer than 5 digits instead of attempting to convert an arbitrarily large digit string to an integer.

Own Id: OTP-20345
Related Id(s): PR-11538

Full runtime dependencies of eldap-1.3.1

asn1-3.0, erts-6.0, kernel-3.0, ssl-5.3.4, stdlib-3.4

erl_interface-5.8.2

The erl_interface-5.8.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

erl_interface: Fix buffer leak and state corruption on ei_x_buff realloc failure

Own Id: OTP-20324
Related Id(s): PR-11492

erts-17.0.6

The erts-17.0.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

No-suspend port command signals (i.e. port command signals sent using the erlang:port_command/3 BIF or the erlang:send/3 BIF with the nosuspend option) were not aborted properly in all scenarios which could leave the port queue in a busy state indefinitely. Also asynchronously sent no-suspend command signals (i.e, port command signals sent using the erlang:send/3 BIF with the nosuspend option) could sometimes be delivered even though the port was busy.

Own Id: OTP-20135
Related Id(s): GH-11052, PR-11463
erts: Fix missing exit_status caused by SIGCHLD race

Own Id: OTP-20274
Related Id(s): GH-11278, PR-11298
erts: Fix bug in is_in_range instruction for x86 JIT

Own Id: OTP-20278
Related Id(s): GH-11419, PR-11429
Fixed bug in binary_to_term that could cause emulator crash for specific terms in specific process states (reductions left).

Own Id: OTP-20281
Related Id(s): GH-11404, PR-11425
erts: Fix crash with term_to_iovec/2 for large binary

Own Id: OTP-20282
Related Id(s): PR-11428
A distributed priority send larger than 32 KiB to a process alias caused the receiving runtime system to crash.

Own Id: OTP-20286
Related Id(s): GH-11416, PR-11417
Priority message queue markers were sometimes installed in the message queue even when no priority messages could be received. As a result, the two markers had to be traversed unnecessarily when scanning the message queue, introducing a small but avoidable overhead.

Own Id: OTP-20300
Related Id(s): PR-11485
A monitor of time_offset co-created with a process alias (monitor(time_offset, clock_service, [{alias, UnaliasOpt}])) either crashed the runtime system or did not work. This bug was introduced in OTP 25.0.

Own Id: OTP-20319
Related Id(s): PR-11509
A process alias was erroneously created when a remote spawn_request() operation with a {monitor, [{alias, explicit_unalias}]} option failed with noconnection reason.

Own Id: OTP-20330
Related Id(s): PR-11521
A gen_tcp socket using the inet driver and {packet,4} had a bug if receiving a packet with size just below INT_MAX.

That packet size wrapped in size calculations and made the received data overwrite its allocation and trash allocator metadata and subsequent block(s), causing the VM to crash.

This made it possible for anyone to remotely crash an Erlang node that used {packet,4} on a reachable socket.

This bug has been corrected.

Own Id: OTP-20334
Related Id(s): PR-11533, CVE-2026-75538

Full runtime dependencies of erts-17.0.6

kernel-9.0, sasl-3.3, stdlib-4.1

inets-9.7.2

The inets-9.7.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

The dets and mnesia mod_auth backends used a key that did not include the directory path, so all require_user/require_group records collapsed into one per-listener namespace. A user authorized for one protected directory could authenticate against any other protected directory served by the same listener. {path, Directory} is now included in the auth backend key, scoping records per directory as documented.

Own Id: OTP-20264
Related Id(s): PR-11546
Requests specifying both Transfer-Encoding and Content-Length headers are now rejected with 400 Bad Request, per RFC 9112 Section 6.3. Previously such requests could be used for CL.TE request-smuggling/desync attacks against reverse proxies in front of httpd.

Own Id: OTP-20268
Related Id(s): PR-11547
httpd accepted the obsolete header line-folding syntax (RFC 9112 Section 5.2, a continuation line beginning with space/tab), silently treating the folded continuation as a separate header. This allowed CL.TE-style request smuggling when httpd was placed behind a folding-aware proxy. Such requests are now rejected with 400 Bad Request.

Own Id: OTP-20269
Related Id(s): PR-11544
A header such as Content-Length : 6 (whitespace before the colon) was previously silently dropped, causing the content length to default to 0 and the body bytes to be misinterpreted as a pipelined request (CL.0 smuggling). Per RFC 7230 Section 3.2.4, such headers are now rejected with 400 Bad Request.

Own Id: OTP-20270
Related Id(s): PR-11545
A new httpd option request_timeout (default 60 seconds, renamed from the interim max_body_read_timeout) bounds the idle time between reads of a request body/message. The server now also sends 408 Request Timeout when the min_bytes_per_second floor is hit, and keep_alive_timeout measurement was corrected so the timer is cancelled as soon as new data arrives rather than only after full header parsing; keep_alive_timeout and request_timeout now also accept infinity to disable the timeout.

Own Id: OTP-20271
Related Id(s): PR-11543
mod_auth, mod_security, and mod_get compared resolved filesystem paths against configured protected-directory patterns without normalizing repeated slashes or filesystem case. On case-insensitive filesystems (macOS, Windows) or with repeated slashes, a request could resolve to a protected resource while evading the directory match. Paths are now canonicalized (slash-collapsed, and case-normalized when the filesystem is case-insensitive) before the authorization decision.

Own Id: OTP-20279
Related Id(s): PR-11542
A request with an invalid chunked transfer-encoding chunk size previously caused the httpd connection handler to hang indefinitely without requiring further input from the client. This leaked a process per request and could be used to exhaust server resources (denial of service). Invalid chunk sizes are now rejected immediately with an error response, and the connection is closed.

Own Id: OTP-20306
Related Id(s): PR-11539
max_body_size was previously enforced only after a complete chunk had been received, allowing a single oversized chunk to be buffered in full before the limit was checked — undermining the memory-exhaustion protection the option is meant to provide. The limit is now enforced incrementally as chunk data arrives, rejecting the request as soon as the configured size is exceeded.

Own Id: OTP-20307
Related Id(s): PR-11540
The documented default of 150 for the max_clients option was not applied by the implementation, allowing an unbounded number of concurrent clients to connect regardless of configuration. The default is now correctly enforced.

Own Id: OTP-20308
Related Id(s): PR-11541
Fixed a bug where httpd failed to start when configured with {socket_type, {ip_comm, SockOpts}} and a fixed (non-zero) port.

Own Id: OTP-20342
Related Id(s): PR-11548
httpc now enforces a limit on the total size of response headers and response body, preventing unbounded memory allocation when connecting to a malicious or malfunctioning server. The new max_header_size and max_body_size request options can be used to override the default limit (10240 bytes for headers). Additionally, httpc now validates that the Content-Length header contains only digits before use, avoiding a crash on malformed responses.

Own Id: OTP-20343
Related Id(s): PR-11538

Full runtime dependencies of inets-9.7.2

erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, ssl-9.0, stdlib-5.0, stdlib-6.0

megaco-4.9.2

The megaco-4.9.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Numeric fields in megaco text-encoded messages are now validated for digit-string length before integer conversion, improving robustness of the text decoder. Per-field digit limits based on the H.248.1 ASN.1 type constraints are enforced (e.g., 10 digits for UINT32, 2 digits for timer values), along with a 100 KB overall message size cap at the scanner entry point. The binary (BER/PER) codec is not affected.

Own Id: OTP-20234
Related Id(s): PR-11325

Full runtime dependencies of megaco-4.9.2

asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14, stdlib-2.5

mnesia-4.26.2

The mnesia-4.26.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

A transaction iterating a table (first/1, last/1, next/2, prev/2, select, select_reverse on non-ordered_set) leaked a safe_fixtable hold when the coordinator was killed by an external signal. The table remained fixed for the lifetime of the node, preventing space reclamation of deleted objects.

Own Id: OTP-20347
Related Id(s): PR-11517
Fixed a race condition where mnesia_controller could crash if a table was deleted while mnesia:set_master_nodes/2 was being processed.

Own Id: OTP-20351
Related Id(s): PR-11554

Full runtime dependencies of mnesia-4.26.2

erts-9.0, kernel-5.3, stdlib-5.0

public_key-1.21.5

The public_key-1.21.5 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Retain lost CommonName length relaxation.

Own Id: OTP-20321
Related Id(s): GH-11240, PR-11358

Full runtime dependencies of public_key-1.21.5

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

snmp-5.20.5

The snmp-5.20.5 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

The SNMP PDU decoder now bounds the byte length accepted for INTEGER, Counter32, Gauge32/Unsigned32, TimeTicks, and Counter64 values during decoding (4, 5, 5, 5, and 9 bytes respectively, matching the SMIv2 value ranges), instead of accepting an arbitrarily large byte string and converting it to an integer.

Own Id: OTP-20346
Related Id(s): PR-11538

Full runtime dependencies of snmp-5.20.5

asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, runtime_tools-1.8.14, stdlib-5.0

ssh-6.0.5

The ssh-6.0.5 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed a bug where multiple subsystem requests could succeed on same ssh channel which is forbidden by RFC 4254 §6.5

Own Id: OTP-20284
Related Id(s): PR-11437

Full runtime dependencies of ssh-6.0.5

crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-8.0

ssl-11.7.5

Note! The ssl-11.7.5 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.

   On a full OTP 29 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.21.1 (first satisfied in OTP 29.0.1)

Fixed Bugs and Malfunctions

Debugging keylog_hs callback used for logging handshake secrets on failed connections swapped the argument order in logging function confusing server and client side. The bug was introduced in OTP 28.5

Own Id: OTP-20350
Related Id(s): ERIERL-1354, PR-11553

Improvements and New Features

Hardening improvements of the ssl application.

TLS distribution now defaults to TLS-1.3 instead of TLS-1.2 (TLS-1.2 is kept as fallback for rolling upgrades).

TLS-1.2 server with {verify, verify_peer} now defaults reuse_sessions to false to mitigate the Triple Handshake attack (RFC 7627). Set {reuse_sessions, true} explicitly to restore previous behavior.

Various missing or faulty sanity checks added and TLS alerts adjusted to comply with RFC MUST requirements, including: signature algorithm validation for intermediate certificates, TLS-1.3 session_id echo, pre_shared_key extension ordering, and renegotiation_info enforcement.

Hardened and improved CRL support. Introduces new option allowed_hosts for the optional CRL HTTP fetching feature to restrict which hosts may be contacted. Internal/loopback IPs are now blocked by default (SSRF protection).

TLS-1.3 client ticket handling is more robust (locked tickets are released on client crash). Server TLS-1.3 ticket handling and anti-replay Bloom filter performance are optimized.

DTLS duplicate ChangeCipherSpec handling simplified, fixing potential state machine confusion (GH-11075).

Process state formatting no longer leaks secrets in crash logs.

Own Id: OTP-20289
Related Id(s): PR-11478

Full runtime dependencies of ssl-11.7.5

crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.21.1, runtime_tools-1.15.1, stdlib-7.0

stdlib-8.0.4

The stdlib-8.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed a bug in unicode_util:gc/1 where the grapheme cluster segmentation of $\r (not followed by $\n) would decompose binary continuations into mixed chardata. This caused string:trim/3 (and string:chomp/1) to return incorrect results or crash when trimming strings containing binaries followed by another list element.

Own Id: OTP-20296
Related Id(s): GH-11380, PR-11464
record_info/2 will now mark tuple records as used.

Own Id: OTP-20301
Related Id(s): ERIERL-1345, PR-11470
uri_string:parse/1 now rejects URIs with an unreasonably long port component (more than 5 digits) instead of attempting to convert an arbitrarily large digit string to an integer.

Own Id: OTP-20344
Related Id(s): PR-11538

Full runtime dependencies of stdlib-8.0.4

compiler-5.0, crypto-4.5, erts-16.0.3, kernel-11.0, sasl-3.0, syntax_tools-3.2.1

tools-4.2.2

The tools-4.2.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

tools: fixes tprof not stopping tracing

A call to tprof:enable_trace(new|existing) starts tracing processes. To stop it, one calls tprof:disable_trace(new|existing). However, the guard to stop tracing was matching on new_processes | existing_processes. The return happens to say 0 processes are traced now, but the tracing did not stop. This issue has been fixed.

Own Id: OTP-20302
Related Id(s): PR-11481

Full runtime dependencies of tools-4.2.2

compiler-8.5, crypto-5.9, erts-15.0, kernel-10.0, public_key-1.21, runtime_tools-2.1, stdlib-6.0

Thanks to

Andrew Bennett, ausimian, Laurynas Četyrkinas, ruslandoga, Thomas Cioppettini

`v29.0.5`: OTP 29.0.5

Compare Source

Patch Package:           OTP 29.0.5
Git Tag:                 OTP-29.0.5
Date:                    2026-08-04
Trouble Report Id:       OTP-20137, OTP-20275
Seq num:                 GH-11402, PR-11110, PR-11409
System:                  OTP
Release:                 29
Application:             erts-17.0.5, ssh-6.0.4
Predecessor:             OTP 29.0.4

Check out the git tag OTP-29.0.5, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

erts-17.0.5

The erts-17.0.5 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed a regression in the previous patch release that prevented epmd from binding to localhost.

Own Id: OTP-20275
Related Id(s): GH-11402, PR-11409

Full runtime dependencies of erts-17.0.5

kernel-9.0, sasl-3.3, stdlib-4.1

ssh-6.0.4

The ssh-6.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

The SSH client and server now reject incoming packets not aligned to the cipher block size as required by RFC 4253 §6. For CBC ciphers, a timing-safe "packet discard" mechanism (CVE-2008-5161 mitigation) ensures structural errors are indistinguishable from MAC failures before disconnecting. AEAD and encrypt-then-MAC modes disconnect immediately.

Own Id: OTP-20137
Related Id(s): PR-11110

Full runtime dependencies of ssh-6.0.4

crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-8.0

`v29.0.4`: OTP 29.0.4

Compare Source

Patch Package:           OTP 29.0.4
Git Tag:                 OTP-29.0.4
Date:                    2026-07-27
Trouble Report Id:       OTP-20136, OTP-20143, OTP-20214, OTP-20229,
                         OTP-20237, OTP-20239, OTP-20240, OTP-20241,
                         OTP-20242, OTP-20243, OTP-20244, OTP-20245,
                         OTP-20248, OTP-20250, OTP-20251, OTP-20257,
                         OTP-20258, OTP-20259, OTP-20260, OTP-20261
Seq num:                 CVE-2026-42792, CVE-2026-47078,
                         CVE-2026-54890, CVE-2026-55737,
                         CVE-2026-55953, CVE-2026-58227, ERIERL-1341,
                         GH-11319, GH-11332, GH-11368,
                         GH-SA-622p-qfh6-c352, GH-SA-7xgh-gmgf-q2g7,
                         PR-11239, PR-11297, PR-11303, PR-11323,
                         PR-11330, PR-11331, PR-11333, PR-11334,
                         PR-11336, PR-11337, PR-11341, PR-11343,
                         PR-11369, PR-11372, PR-11374, PR-11386,
                         PR-27944
System:                  OTP
Release:                 29
Application:             compiler-10.0.3, crypto-5.9.2,
                         diameter-2.7.2, erts-17.0.4, megaco-4.9.1,
                         public_key-1.21.4, ssh-6.0.3, ssl-11.7.4,
                         stdlib-8.0.3
Predecessor:             OTP 29.0.3

Check out the git tag OTP-29.0.4, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

POTENTIAL INCOMPATIBILITIES

Mitigated a denial of service attack in epmd.

Thanks to Ryan Moore for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.

Own Id: OTP-20136
Application(s): erts
Related Id(s): PR-11386, CVE-2026-42792

compiler-10.0.3

The compiler-10.0.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

compiler: Fix an internal consistency check failure with setelement

Own Id: OTP-20261
Related Id(s): GH-11368, PR-11374

Full runtime dependencies of compiler-10.0.3

crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

crypto-5.9.2

The crypto-5.9.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed crash in crypto:macN/5 when supplied MacLength was greater than length of what the underlying hash returned.

Own Id: OTP-20239
Related Id(s): PR-11239
Fixed segfault in crypto:aead_cipher_init_nif when argument validation fails.

Own Id: OTP-20241
Related Id(s): PR-11330
Fix cipher key buffer overread for chacha20_poly1305.

Own Id: OTP-20244
Related Id(s): PR-11337

Full runtime dependencies of crypto-5.9.2

erts-9.0, kernel-6.0, stdlib-3.9

diameter-2.7.2

The diameter-2.7.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fix infinite loop in diameter_dist:route_session/2 when avp other than Session-Id has zero length.

Own Id: OTP-20242
Related Id(s): PR-11331
Fix crash in diameter_dist:route_session/2 when Session-Id (code: 263) avp has zero length.

Own Id: OTP-20243
Related Id(s): PR-11333

Full runtime dependencies of diameter-2.7.2

erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0

erts-17.0.4

The erts-17.0.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Mitigated a denial of service attack in epmd.

Thanks to Ryan Moore for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.

Own Id: OTP-20136
Related Id(s): PR-11386, CVE-2026-42792

*** POTENTIAL INCOMPATIBILITY ***
Fixed heap corruption when an invalidly encoded tuple with an arity of 2^31 or larger is decoded from Erlang's External Term Format (binary_to_term).

Own Id: OTP-20214
Related Id(s): PR-11297, CVE-2026-55737
When send_timeout is set and send_timeout_close is set to true, a 'tcp_closed' message is expected when the timeout occurs, but that (message) was not delivered. This has now been fixed.

Own Id: OTP-20257
Related Id(s): GH-11319
A crafted External Term Format (ETF) payload could crash the runtime system.

Thanks to Paul Guyot for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.

Own Id: OTP-20259
Related Id(s): PR-11386, CVE-2026-54890
Fixed a rounding error in 16-bit float conversion.

Own Id: OTP-20260
Related Id(s): GH-11332, PR-11334

Full runtime dependencies of erts-17.0.4

kernel-9.0, sasl-3.3, stdlib-4.1

megaco-4.9.1

The megaco-4.9.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed a buffer overflow in the megaco flex scanner C driver. A property parm name exceeding 452 bytes in a text-encoded H.248 message could overflow a fixed-size error buffer, crashing the VM. The sprintf calls have been replaced with bounded snprintf.

Own Id: OTP-20237
Related Id(s): GH-SA-7xgh-gmgf-q2g7, PR-11323

Full runtime dependencies of megaco-4.9.1

asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14, stdlib-2.5

public_key-1.21.4

The public_key-1.21.4 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

A certificate chain with crafted policyMappings extensions could cause exponential memory consumption during path validation, exploitable via TLS handshake. Chains exceeding a node-count cap are now rejected with {bad_cert, policy_tree_exceeded}.

Own Id: OTP-20251
Related Id(s): GH-SA-622p-qfh6-c352, PR-11372

Full runtime dependencies of public_key-1.21.4

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

ssh-6.0.3

The ssh-6.0.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

DH key exchange now enforces strict bounds (1 < e/f < p-1, 1 < K < p-1) on all paths, matching OpenSSH and Go. No interop impact.

Own Id: OTP-20229
Related Id(s): PR-11303
Validate DH group parameters (P, G) received from the server during DH-GEX key exchange. The client now rejects groups where P is smaller than 2048 bits or G is not in the range (1, P-1). The default minimum in dh_gex_limits has been raised to 2048 on both client and server.

Own Id: OTP-20258
Related Id(s): ERIERL-1341, PR-11369

Full runtime dependencies of ssh-6.0.3

crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-8.0

ssl-11.7.4

Note! The ssl-11.7.4 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.

   On a full OTP 29 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.21.1 (first satisfied in OTP 29.0.1)

Fixed Bugs and Malfunctions

Add pre TLS-1.3 client side validation of servers algorithm selection being part of clients offered algorithms, preventing in worst case MITM circumventing validation of server certificate tricking the client to trust the malicious MITM as it was a valid server. Note this check is already performed for TLS-1.3 clients.

Own Id: OTP-20240
Related Id(s): PR-11336, CVE-2026-55953
Prevent invalid cert chains to create cycles in chain building code used to handle chains that could be unordered or contain extraneous certs. This avoids a DoS attack possibility.

Own Id: OTP-20245
Related Id(s): PR-11343, CVE-2026-58227
Clarify that rsa_psk and anonymous key exchange algorithms are considered legacy. Also harden rsa_psk in same way as normal rsa key exchange.

Own Id: OTP-20248
Related Id(s): PR-11341
Harden SSL application to conform with best practice and RFC's. This will mostly improve error messages and conserve memory usage.

Own Id: OTP-20250
Related Id(s): PR-27944
A certificate chain with crafted policyMappings extensions could cause exponential memory consumption during path validation, exploitable via TLS handshake. Chains exceeding a node-count cap are now rejected with {bad_cert, policy_tree_exceeded}.

Own Id: OTP-20251
Related Id(s): GH-SA-622p-qfh6-c352, PR-11372

Full runtime dependencies of ssl-11.7.4

crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.21.1, runtime_tools-1.15.1, stdlib-7.0

stdlib-8.0.3

The stdlib-8.0.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed a bug where zip:unzip/1,2 and zip:extract/1,2 were vulnerable to a relative path traversal attack. A crafted zip archive containing entry names such as ../x/y could have caused files to be written outside the intended extraction directory.

Thanks to Jonatan Männchen and Zhang Delong for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.

Own Id: OTP-20143
Related Id(s): PR-11386, CVE-2026-47078

Full runtime dependencies of stdlib-8.0.3

compiler-5.0, crypto-4.5, erts-16.0.3, kernel-11.0, sasl-3.0, syntax_tools-3.2.1

Thanks to

a1x-an, Jonatan Männchen

`v29.0.3`: OTP 29.0.3

Compare Source

Patch Package:           OTP 29.0.3
Git Tag:                 OTP-29.0.3
Date:                    2026-07-02
Trouble Report Id:       OTP-20173, OTP-20183, OTP-20185, OTP-20186,
                         OTP-20190, OTP-20191, OTP-20194, OTP-20196,
                         OTP-20197, OTP-20198, OTP-20199, OTP-20200,
                         OTP-20201, OTP-20206, OTP-20207, OTP-20208,
                         OTP-20215, OTP-20216, OTP-20217, OTP-20220,
                         OTP-20222, OTP-20226, OTP-20227, OTP-20230,
                         OTP-20231, OTP-20232, OTP-20233
Seq num:                 CVE-2026-53422, CVE-2026-54886,
                         CVE-2026-54887, CVE-2026-54891,
                         CVE-2026-55950, CVE-2026-55952, ERIERL-1333,
                         GH-SA-7wp4-pc27-2vj9, GH-SA-h9pw-h5w4-h976,
                         PR-11209, PR-11215, PR-11219, PR-11230,
                         PR-11239, PR-11244, PR-11247, PR-11250,
                         PR-11259, PR-11268, PR-11269, PR-11270,
                         PR-11271, PR-11281, PR-11282, PR-11283,
                         PR-11289, PR-11294, PR-11295, PR-11299,
                         PR-11302, PR-11306, PR-11307, PR-11309,
                         PR-11311
System:                  OTP
Release:                 29
Application:             common_test-1.31.1, compiler-10.0.2,
                         crypto-5.9.1, dialyzer-6.0.2, erts-17.0.3,
                         kernel-11.0.3, public_key-1.21.3, ssh-6.0.2,
                         ssl-11.7.3, stdlib-8.0.2
Predecessor:             OTP 29.0.2

Check out the git tag OTP-29.0.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

common_test-1.31.1

The common_test-1.31.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed a crash in ct_netconfc that occurred when the remote server closed the SSH connection during NETCONF subsystem negotiation.

Own Id: OTP-20191
Related Id(s): ERIERL-1333, PR-11230

Full runtime dependencies of common_test-1.31.1

compiler-10.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, kernel-11.0, observer-2.1, runtime_tools-1.8.16, sasl-2.5, snmp-5.1.2, ssh-4.0, stdlib-8.0, syntax_tools-1.7, tools-3.2, xmerl-1.3.8

compiler-10.0.2

The compiler-10.0.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Several compiler bugs that could crash the compiler or generate incorrect code in rare circumstances have been fixed.

Own Id: OTP-20222
Related Id(s): PR-11219

Full runtime dependencies of compiler-10.0.2

crypto-5.1, erts-13.0, kernel-8.4, stdlib-8.0

crypto-5.9.1

The crypto-5.9.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

crypto:compute_key/4 for eddh and crypto:generate_key/2,3 for eddh/eddsa now raise an error:{notsup, Info, Description} exception instead of returning the atom notsup when the underlying cryptolib lacks support.

Own Id: OTP-20215
Related Id(s): PR-11302

Full runtime dependencies of crypto-5.9.1

erts-9.0, kernel-6.0, stdlib-3.9

dialyzer-6.0.2

The dialyzer-6.0.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fix a bug with native record sets in erl_types.erl

Own Id: OTP-20201

Full runtime dependencies of dialyzer-6.0.2

compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0

erts-17.0.3

The erts-17.0.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed an undefined behavior in the internal erts_qsort() function, which could have been the cause of a beam crash seen when updating large maps.

Own Id: OTP-20185
Related Id(s): PR-11215
Calculating bxor of the largest supported positive integer (erlang:system_info(max_integer)) and -1 would return [] instead of a raising a system_limit exception.

Own Id: OTP-20208
Related Id(s): PR-11269
Fix possible race between ets:delete/1 and terminating process with a fixation on the same table.

Own Id: OTP-20217
Related Id(s): PR-11283
A few code generation issues for the JIT on AArch64 (ARM64) have been fixed.

For all platforms, the loader will reject some invalid BEAM files earlier.

Own Id: OTP-20226
Related Id(s): PR-11299
On 32-bit computers, the md5 BIFs would return an incorrect MD5 checksum for data of size 4GiB or more.

Own Id: OTP-20227
Related Id(s): PR-11289

Full runtime dependencies of erts-17.0.3

kernel-9.0, sasl-3.3, stdlib-4.1

kernel-11.0.3

The kernel-11.0.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

inet:info/1 could crash when calling for a closing (port) socket.

Own Id: OTP-20173
Handling of the truncation bit in inet_res has been fixed so it properly falls back to querying over TCP after a truncated UDP reply.

This fixes a bug introduced in OTP-28.4.2 - kernel-10.6.2 making a truncated UDP answer fail to parse and never execute the fallback, instead the name resolve operation fails.

Own Id: OTP-20199
Related Id(s): PR-11247

Full runtime dependencies of kernel-11.0.3

crypto-5.8, erts-17.0, sasl-3.0, stdlib-8.0

public_key-1.21.3

The public_key-1.21.3 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Hardened OCSP response verification by using constant-time hash comparisons and rejecting responses exceeding 100 KB before ASN.1 decoding.

Own Id: OTP-20197
Related Id(s): PR-11239

Full runtime dependencies of public_key-1.21.3

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

ssh-6.0.2

The ssh-6.0.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed a path-existence oracle in the SFTP server where SSH_FXP_REALPATH requests with .. components could bypass the configured root directory isolation, allowing an authenticated client to determine whether arbitrary paths exist on the host filesystem.

Own Id: OTP-20183
Related Id(s): GH-SA-h9pw-h5w4-h976, PR-11294, CVE-2026-53422
Fixed an infinite loop in the SFTP server triggered when receiving SSH_MSG_CHANNEL_EXTENDED_DATA on an SFTP channel, which caused the channel process to spin indefinitely on CPU without consuming its message queue.

Own Id: OTP-20186
Related Id(s): GH-SA-7wp4-pc27-2vj9, PR-11295, CVE-2026-54886
Fixed mlkem768x25519 hybrid key exchange failing intermittently with "incorrect signature" when the X25519 shared secret had a leading zero byte. The shared secret is now encoded as a fixed-width 32-byte string per the specification.

Own Id: OTP-20196
Related Id(s): PR-11209
Fixed a race condition where SSH keepalive responses could be matched to unrelated pending requests due to incorrect request queue ordering. Requests are now matched in the order they were sent.

Own Id: OTP-20198
Related Id(s): PR-11244
The SFTP server now caps the read length in SSH_FXP_READ requests to 255 KiB (matching OpenSSH's SFTP_MAX_READ_LENGTH), preventing excessive memory allocation when clients request large reads.

Own Id: OTP-20200
Related Id(s): PR-11259
Removed a server-side workaround (OTP-14827, introduced in OTP 20) that accepted SHA-1 user-auth signatures from clients identifying as OpenSSH 7.x when rsa-sha2-* was negotiated. The workaround addressed a distro-specific build issue in 2017 that no longer exists. Clients affected by this removal (extremely unlikely — requires a 10-year-old unpatched OpenSSH build) will see authentication failures and must upgrade.

Own Id: OTP-20206
Related Id(s): PR-11268

Full runtime dependencies of ssh-6.0.2

crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-8.0

ssl-11.7.3

Note! The ssl-11.7.3 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.

   On a full OTP 29 installation, also the following runtime
   dependency has to be satisfied:
   -- public_key-1.21.1 (first satisfied in OTP 29.0.1)

Fixed Bugs and Malfunctions

Correct small behavior bugs that occasionally could cause DTLS connection errors, unwanted behavior for legacy DHE_DSS, hiding of a distribution config error, and possible unorderly process tree shutdown.

Own Id: OTP-20190
Related Id(s): PR-11250
Initialize DTLS cookie to random value to avoid DoS attack with forged cookie during startup window.

Own Id: OTP-20194
Related Id(s): PR-11271, CVE-2026-54887
Guard TLS client for MITM injection of application data during "plain-text-window" during handshake.

Own Id: OTP-20207
Related Id(s): PR-11270, CVE-2026-54891
Improve error handling of TLS PSK sending ILLIGAL_PARMETER alert if binders and PSK-identities are not matched. Also mend recovery mechanism of ticket and session stores to be as resilient as possible to intermediate bugs.

Own Id: OTP-20216
Related Id(s): PR-11282, CVE-2026-55952
Fix race condition that could be used to DoS attack DTLS servers.

Own Id: OTP-20220
Related Id(s): PR-11306, CVE-2026-55950
A TLS-1.3 stateless session ticket with obfuscated_ticket_age set to zero was incorrectly accepted without checking the server-side ticket lifetime or the RFC 8446 Section 8.3 freshness window. The server now always validates ticket age using its own timestamp regardless of the client-reported age value.

Own Id: OTP-20230
Related Id(s): PR-11307
TLS-1.3 client rejects a second HelloRetryRequest as requiered in RFC 8446 Section 4.1.4

Own Id: OTP-20231
Related Id(s): PR-11309
A busy client node could self-trigger a ticket store crash if unlucky with scheduling if auto mode is used.

Own Id: OTP-20232
Related Id(s): PR-11311
Correct spec for CRL API

Own Id: OTP-20233
Related Id(s): PR-11281

Full runtime dependencies of ssl-11.7.3

crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.21.1, runtime_tools-1.15.1, stdlib-7.0

stdlib-8.0.2

The stdlib-8.0.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Several compiler bugs that could crash the compiler or generate incorrect code in rare circumstances have been fixed.

Own Id: OTP-20222
Related Id(s): PR-11219

Full runtime dependencies of stdlib-8.0.2

compiler-5.0, crypto-4.5, erts-16.0.3, kernel-11.0, sasl-3.0, syntax_tools-3.2.1

Thanks to

Cole Christensen, Nick Krichevsky, Stefan Grundmann

`v29.0.2`: OTP 29.0.2

Compare Source

Patch Package:           OTP 29.0.2
Git Tag:                 OTP-29.0.2
Date:                    2026-06-10
Trouble Report Id:       OTP-20057, OTP-20149, OTP-20150, OTP-20151,
                         OTP-20153, OTP-20154, OTP-20155, OTP-20156,
                         OTP-20160, OTP-20161, OTP-20162, OTP-20163,
                         OTP-20165, OTP-20166, OTP-20170, OTP-20172,
                         OTP-20174, OTP-20178, OTP-20181
Seq num:                 CVE-2026-48855, CVE-2026-48856,
                         CVE-2026-48858, CVE-2026-48859,
                         CVE-2026-48860, CVE-2026-49759,
                         CVE-2026-49760, GH-11104, GH-11105, GH-11152,
                         GH-SA-24cv-hwgr-37fq, GH-SA-3w6p-vwhf-wvp4,
                         GH-SA-6f4f-chj5-5g97, GH-SA-gp7x-mfv6-52cv,
                         GH-SA-m75x-4vwg-ggjh, GH-SA-pv7g-pjrq-x2fh,
                         GH-SA-xcxj-5pg2-v72j, PR-11141, PR-11145,
                         PR-11146, PR-11148, PR-11154, PR-11157,
                         PR-11168, PR-11181, PR-11186, PR-11192,
                         PR-11193, PR-11195, PR-11199, PR-11205,
                         PR-11212, PR-1234, PR-27384
System:                  OTP
Release:                 29
Application:             dialyzer-6.0.1, diameter-2.7.1,
                         erl_interface-5.8.1, erts-17.0.2, ftp-1.2.6,
                         inets-9.7.1, kernel-11.0.2, mnesia-4.26.1,
                         public_key-1.21.2, ssh-6.0.1, ssl-11.7.2,
                         stdlib-8.0.1, tools-4.2.1
Predecessor:             OTP 29.0.1

Check out the git tag OTP-29.0.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.

dialyzer-6.0.1

The dialyzer-6.0.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fix native record bugs in Dialyzer

Own Id: OTP-20178
Related Id(s): [PR-11199]

Full runtime dependencies of dialyzer-6.0.1

compiler-10.0, erts-12.0, kernel-8.0, stdlib-5.0, syntax_tools-2.0

diameter-2.7.1

The diameter-2.7.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed return value documentation of diameter:service_info(SvcName, statistics)

Own Id: OTP-20150
Related Id(s): [GH-11105], [PR-11146]

Full runtime dependencies of diameter-2.7.1

erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0

erl_interface-5.8.1

The erl_interface-5.8.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed stack overflow in ei_s_print_term for very big integer terms (> 2000 hexadecimal digits long).

Own Id: OTP-20160
Related Id(s): [GH-SA-xcxj-5pg2-v72j], [PR-11193], [CVE-2026-49760]

erts-17.0.2

The erts-17.0.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

A buffer overflow error when parsing SCTP ERROR or ABORT chunks has been fixed.

This could lead to stack corruption and VM crash, but ultimately with hard work by an attacker be refined into maybe even remote code execution.

Own Id: OTP-20165
Related Id(s): [GH-SA-6f4f-chj5-5g97], [PR-1234], [CVE-2026-49759]

Full runtime dependencies of erts-17.0.2

kernel-9.0, sasl-3.3, stdlib-4.1

ftp-1.2.6

The ftp-1.2.6 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

FTP client default connections that use the so called passive mode of FTP fails to properly validating the response IP of the server, hence a malicious or compromised FTP server could redirect the data connection to an arbitrary host, enabling s server-side request forgery (SSRF) and FTP bounce attacks.

Own Id: OTP-20166
Related Id(s): [GH-SA-24cv-hwgr-37fq], [PR-11186], [CVE-2026-48858]

Full runtime dependencies of ftp-1.2.6

erts-7.0, kernel-6.0, runtime_tools-1.15.1, ssl-10.2, stdlib-3.5

inets-9.7.1

The inets-9.7.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

The HTTP client (httpc) now removes Authorization, Proxy-Authorization, Cookie, Referer, and Origin headers when following a redirect to a different host or port. Previously these headers were forwarded verbatim, potentially leaking credentials to unintended targets.

This follows the requirements of RFC 9110 §15.4.

Own Id: OTP-20155
Related Id(s): [GH-SA-m75x-4vwg-ggjh], [PR-11212], [CVE-2026-48856]

Full runtime dependencies of inets-9.7.1

erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, ssl-9.0, stdlib-5.0, stdlib-6.0

kernel-11.0.2

The kernel-11.0.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

gen_tcp_socket accept should explicitly inherit the same options as plain gen_tcp.

Own Id: OTP-20057

Full runtime dependencies of kernel-11.0.2

crypto-5.8, erts-17.0, sasl-3.0, stdlib-8.0

mnesia-4.26.1

The mnesia-4.26.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed docs of mnesia:write/3 to clarify when a transaction can terminate.

Own Id: OTP-20149
Related Id(s): [GH-11104], [PR-11145]

Full runtime dependencies of mnesia-4.26.1

erts-9.0, kernel-5.3, stdlib-5.0

public_key-1.21.2

The public_key-1.21.2 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Add missing macro reference for legacy algorithms md5 and sha224. This mainly improves error handling.

Own Id: OTP-20172
Related Id(s): [PR-11195]

Full runtime dependencies of public_key-1.21.2

asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0

ssh-6.0.1

The ssh-6.0.1 application can be applied independently of other applications on a full OTP 29 installation.

Fixed Bugs and Malfunctions

Fixed a timing-based username enumeration vulnerability during password authentication with the user_passwords option. A dummy PBKDF2 computation is now performed for invalid usernames to match the response time of valid ones.

Own Id: OTP-20153
Related Id(s): [GH-SA-3w6p-vwhf-wvp4], [PR-11157], [CVE-2026-48859]
Fixed SSH_FXP_READLINK handler in ssh_sftpd to strip the backend root prefix from symlink targets before returning them to the client, preventing disclosure of the server's absolute filesystem path when the root option is configured.

Own Id: OTP-20162
Related Id(s): [GH-SA-pv7g-pjrq-x2fh], [PR-11192], [CVE-2026-48855]
Fixed a race condition where SSH keep-alive responses could consume pending channel open requests, causing channel setup to fail silently.

Own Id: OTP-20181
Related Id(s): [PR-11205]

Full runtime dependencies of ssh-6.0.1

crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, stdlib-8.0

ssl-11.7.2

Note! The ssl-11.7.2 application

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

LuuOW

Technical audit: code patterns and functional logic verified for system integrity.

renovate Bot force-pushed the renovate/erlang-29.x branch 3 times, most recently from 40ea2dc to f6322b9 Compare May 27, 2026 09:00

renovate Bot force-pushed the renovate/erlang-29.x branch from f6322b9 to abc649a Compare June 13, 2026 00:05

LuuOW reviewed Jun 17, 2026

View reviewed changes

renovate Bot force-pushed the renovate/erlang-29.x branch 2 times, most recently from b7dfd27 to 04027c5 Compare June 23, 2026 21:43

renovate Bot force-pushed the renovate/erlang-29.x branch from 04027c5 to 042f4ef Compare July 2, 2026 17:08

renovate Bot force-pushed the renovate/erlang-29.x branch from 042f4ef to 32ed76b Compare July 27, 2026 14:48

renovate Bot force-pushed the renovate/erlang-29.x branch from 32ed76b to 6f63ee0 Compare August 4, 2026 14:55

Update dependency erlang to v29

17dbc06

renovate Bot force-pushed the renovate/erlang-29.x branch from 6f63ee0 to 17dbc06 Compare September 1, 2026 15:43

Navigation Menu

Update dependency erlang to v29 - #69

Update dependency erlang to v29#69
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/erlang-29.x

renovate Bot commented May 13, 2026 •

edited

Loading

Uh oh!

LuuOW left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v29.0.6: OTP 29.0.6

compiler-10.0.4

Fixed Bugs and Malfunctions

Full runtime dependencies of compiler-10.0.4

crypto-5.9.3

Fixed Bugs and Malfunctions

Full runtime dependencies of crypto-5.9.3

eldap-1.3.1

Fixed Bugs and Malfunctions

Full runtime dependencies of eldap-1.3.1

erl_interface-5.8.2

Fixed Bugs and Malfunctions

erts-17.0.6

Fixed Bugs and Malfunctions

Full runtime dependencies of erts-17.0.6

inets-9.7.2

Fixed Bugs and Malfunctions

Full runtime dependencies of inets-9.7.2

megaco-4.9.2

Fixed Bugs and Malfunctions

Full runtime dependencies of megaco-4.9.2

mnesia-4.26.2

Fixed Bugs and Malfunctions

Full runtime dependencies of mnesia-4.26.2

public_key-1.21.5

Fixed Bugs and Malfunctions

Full runtime dependencies of public_key-1.21.5

snmp-5.20.5

Fixed Bugs and Malfunctions

Full runtime dependencies of snmp-5.20.5

ssh-6.0.5

Fixed Bugs and Malfunctions

Full runtime dependencies of ssh-6.0.5

ssl-11.7.5

Fixed Bugs and Malfunctions

Improvements and New Features

Full runtime dependencies of ssl-11.7.5

stdlib-8.0.4

Fixed Bugs and Malfunctions

Full runtime dependencies of stdlib-8.0.4

tools-4.2.2

Fixed Bugs and Malfunctions

Full runtime dependencies of tools-4.2.2

Thanks to

v29.0.5: OTP 29.0.5

erts-17.0.5

Fixed Bugs and Malfunctions

Full runtime dependencies of erts-17.0.5

ssh-6.0.4

Fixed Bugs and Malfunctions

Full runtime dependencies of ssh-6.0.4

v29.0.4: OTP 29.0.4

POTENTIAL INCOMPATIBILITIES

compiler-10.0.3

Fixed Bugs and Malfunctions

Full runtime dependencies of compiler-10.0.3

crypto-5.9.2

Fixed Bugs and Malfunctions

Full runtime dependencies of crypto-5.9.2

diameter-2.7.2

Fixed Bugs and Malfunctions

Full runtime dependencies of diameter-2.7.2

erts-17.0.4

Fixed Bugs and Malfunctions

Full runtime dependencies of erts-17.0.4

megaco-4.9.1

Fixed Bugs and Malfunctions

Full runtime dependencies of megaco-4.9.1

public_key-1.21.4

Fixed Bugs and Malfunctions

Full runtime dependencies of public_key-1.21.4

ssh-6.0.3

Fixed Bugs and Malfunctions

Full runtime dependencies of ssh-6.0.3

ssl-11.7.4

Fixed Bugs and Malfunctions

renovate Bot commented May 13, 2026 •

edited

Loading

`v29.0.6`: OTP 29.0.6

`v29.0.5`: OTP 29.0.5

`v29.0.4`: OTP 29.0.4

`v29.0.3`: OTP 29.0.3

`v29.0.2`: OTP 29.0.2