Patch Package: OTP 28.4 Git Tag: OTP-28.4 Date: 2026-03-04 Trouble Report Id: OTP-16607, OTP-19824, OTP-19860, OTP-19886, OTP-19892, OTP-19901, OTP-19904, OTP-19905, OTP-19907, OTP-19908, OTP-19911, OTP-19913, OTP-19914, OTP-19920, OTP-19923, OTP-19928, OTP-19937, OTP-19939, OTP-19940, OTP-19941, OTP-19948, OTP-19950, OTP-19951, OTP-19952, OTP-19959, OTP-19972, OTP-19973, OTP-19974, OTP-19976, OTP-19977, OTP-19979, OTP-19987, OTP-19988, OTP-19989, OTP-19990, OTP-19992, OTP-19998, OTP-20006 Seq num: ERIERL-1251, ERIERL-1264, ERIERL-1283, GH-10351, GH-10371, GH-10470, GH-10474, GH-10494, GH-10495, GH-10501, GH-10513, GH-10567, GH-10652, GH-10698, GH-10705, GH-9681, OTP-16608, PR-10271, PR-10385, PR-10434, PR-10438, PR-10451, PR-10469, PR-10484, PR-10486, PR-10496, PR-10512, PR-10521, PR-10522, PR-10536, PR-10537, PR-10546, PR-10550, PR-10576, PR-10583, PR-10586, PR-10588, PR-10599, PR-10602, PR-10623, PR-10624, PR-10625, PR-10630, PR-10655, PR-10665, PR-10668, PR-10672, PR-10673, PR-10675, PR-10678, PR-10684, PR-10708, PR-10714, PR-10723, PR-10752, PR-9695 System: OTP Release: 28 Application: asn1-5.4.3, common_test-1.30, compiler-9.0.5, crypto-5.8.2, diameter-2.6.1, erl_interface-5.6.4, erts-16.3, et-1.7.3, eunit-2.10.2, inets-9.6, kernel-10.6, megaco-4.8.3, mnesia-4.25.2, observer-2.18.2, odbc-2.16.1, parsetools-2.7.1, public_key-1.20.2, reltool-1.0.3, runtime_tools-2.3.1, sasl-4.3.1, snmp-5.20.1, ssh-5.5, ssl-11.5.2, stdlib-7.3, syntax_tools-4.0.3, tools-4.1.4, wx-2.5.4, xmerl-2.1.9 Predecessor: OTP 28.3.3 Check out the git tag OTP-28.4, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below. # HIGHLIGHTS - Added support for the PQC key exchange (kex) algorithm mlkem768x25519-sha256, a hybrid quantum-resistant algorithm combining ML-KEM-768 with X25519. Own Id: OTP-19824 Application(s): ssh Related Id(s): PR-10512, PR-10655 - Added persistent_term:put_new/2 that will quickly do nothing if a term with the given name and value already exists, and raise a `badarg` exception if the term exists with a different value. Own Id: OTP-19908 Application(s): erts Related Id(s): GH-9681, PR-9695 # POTENTIAL INCOMPATIBILITIES - Added a new HttpOption `{autoretry, timeout()}` to `httpc:request/4,5`. This option allows the client to decide how to act upon receiving a Retry-After response header. The default behavior changes, as now only one retry is made before returning the error code, instead of retrying infinitely. Own Id: OTP-19892 Application(s): inets Related Id(s): ERIERL-1283, PR-10469 # OTP-28.4 ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 - The GH Actions CI forbids non-maintainers to commit `*.beam` files to the Erlang/OTP repo Own Id: OTP-19923 Related Id(s): PR-10550 - Updated `openssl` from `3.6.0` to `3.6.1`. This change does not perform any changes in the `md5` vendor implementation from `openssl`. The change merges upstream cosmetic changes from `openssl`. This is necessary to automatically migrate cleanly to the next `openssl` version without conflicts with upstream. Own Id: OTP-19959 Related Id(s): PR-10630 - The removal of the `slave` and `slave` modules have been postponed to Erlang/OTP 31. The partial removal of the archive feature has been postponed to Erlang/OTP 30. Own Id: OTP-19989 Related Id(s): PR-10714 # asn1-5.4.3 The asn1-5.4.3 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of asn1-5.4.3 > > erts-14.0, kernel-9.0, stdlib-5.0 # common_test-1.30 The common_test-1.30 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Added documentation about the behavior of ct:comment/1 and ct:comment/2 when executed from processes other than the process running test functions. Own Id: OTP-19913 Related Id(s): ERIERL-1264, PR-10271 ## Improvements and New Features - Updated jquery to 4.0.0 Own Id: OTP-19972 Related Id(s): PR-10623, PR-10624, PR-10625, PR-10665 - The removal of the `slave` and `slave` modules have been postponed to Erlang/OTP 31. The partial removal of the archive feature has been postponed to Erlang/OTP 30. Own Id: OTP-19989 Related Id(s): PR-10714 > #### Full runtime dependencies of common_test-1.30 > > compiler-6.0, crypto-4.5, debugger-4.1, erts-7.0, ftp-1.0, inets-6.0, > kernel-8.4, observer-2.1, runtime_tools-1.8.16, sasl-2.5, snmp-5.1.2, ssh-4.0, > stdlib-4.0, syntax_tools-1.7, tools-3.2, xmerl-1.3.8 # compiler-9.0.5 The compiler-9.0.5 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed a compiler alias analysis bug that could generate unsafe code for repeated binary segments. Own Id: OTP-19951 Related Id(s): PR-10588 > #### Full runtime dependencies of compiler-9.0.5 > > crypto-5.1, erts-13.0, kernel-8.4, stdlib-6.0 # crypto-5.8.2 The crypto-5.8.2 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed crypto:crypto_one_time_aead/4, which could crash the runtime system if invoked in parallel with the same state. Own Id: OTP-19973 Related Id(s): GH-10652, PR-10668 > #### Full runtime dependencies of crypto-5.8.2 > > erts-9.0, kernel-6.0, stdlib-3.9 # diameter-2.6.1 The diameter-2.6.1 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of diameter-2.6.1 > > erts-10.0, kernel-3.2, ssl-9.0, stdlib-5.0 # erl_interface-5.6.4 The erl_interface-5.6.4 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Updated `openssl` from `3.6.0` to `3.6.1`. This change does not perform any changes in the `md5` vendor implementation from `openssl`. The change merges upstream cosmetic changes from `openssl`. This is necessary to automatically migrate cleanly to the next `openssl` version without conflicts with upstream. Own Id: OTP-19959 Related Id(s): PR-10630 ## Known Bugs and Problems - The `ei` API for decoding/encoding terms is not fully 64-bit compatible since terms that have a representation on the external term format larger than 2 GB cannot be handled. Own Id: OTP-16607 Related Id(s): OTP-16608 # erts-16.3 The erts-16.3 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed a documentation build warning when one or more applications failed their configure step and were skipped. Own Id: OTP-19914 Related Id(s): ERIERL-1251, PR-10537 - The (IPv6) flowinfo control message header was not properly supported. Own Id: OTP-19977 - Fixed NetBSD thread naming, using `pthread_setname_np()`; used for debugging. Own Id: OTP-19987 Related Id(s): PR-10684 ## Improvements and New Features - The erlang:link_option/0 type is now exported. Own Id: OTP-19904 Related Id(s): PR-10451 - Added persistent_term:put_new/2 that will quickly do nothing if a term with the given name and value already exists, and raise a `badarg` exception if the term exists with a different value. Own Id: OTP-19908 Related Id(s): GH-9681, PR-9695 *** HIGHLIGHT *** - The `manifest.xml` file for the Windows build now has version numbers updated to correctly report OS versions on Windows 10, 11, Server 2016, 2019, 2022. Own Id: OTP-19920 Related Id(s): GH-10371, PR-10546 - Improved yielding inside `re:run`. Regular expressions searching for _one_ specific byte character could spin in `memchr()` without any yielding or reduction counting. Own Id: OTP-19950 Related Id(s): PR-10486 - Updated `openssl` from `3.6.0` to `3.6.1`. This change does not perform any changes in the `md5` vendor implementation from `openssl`. The change merges upstream cosmetic changes from `openssl`. This is necessary to automatically migrate cleanly to the next `openssl` version without conflicts with upstream. Own Id: OTP-19959 Related Id(s): PR-10630 - Updated `ryu` implementation used to convert floats to strings. Own Id: OTP-19974 Related Id(s): PR-10672 - Upgraded `asmjit` to `v1.18` Own Id: OTP-19979 Related Id(s): PR-10675 - Updated zlib to version 1.3.2. Own Id: OTP-19998 Related Id(s): PR-10752 > #### Full runtime dependencies of erts-16.3 > > kernel-9.0, sasl-3.3, stdlib-4.1 # et-1.7.3 The et-1.7.3 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of et-1.7.3 > > erts-9.0, kernel-5.3, runtime_tools-1.10, stdlib-3.4, wx-1.2 # eunit-2.10.2 The eunit-2.10.2 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of eunit-2.10.2 > > erts-9.0, kernel-5.3, stdlib-6.0 # inets-9.6 The inets-9.6 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 - Added a new HttpOption `{autoretry, timeout()}` to `httpc:request/4,5`. This option allows the client to decide how to act upon receiving a Retry-After response header. The default behavior changes, as now only one retry is made before returning the error code, instead of retrying infinitely. Own Id: OTP-19892 Related Id(s): ERIERL-1283, PR-10469 *** POTENTIAL INCOMPATIBILITY *** - Httpc will not add a Content-Length header for requests, that do not have defined semantics for request content in RFC9110 and do not include content. The list includes methods: `GET, HEAD, OPTIONS, TRACE, DELETE`. The behavior for `headers_as_is` option remains unchanged. Own Id: OTP-19928 Related Id(s): GH-10513, PR-10521 - Improved documentation and specs for `do/1` callback in httpd module. Own Id: OTP-19952 Related Id(s): GH-10501, PR-10602 > #### Full runtime dependencies of inets-9.6 > > erts-14.0, kernel-9.0, mnesia-4.12, public_key-1.13, runtime_tools-1.8.14, > ssl-9.0, stdlib-5.0, stdlib-6.0 # kernel-10.6 The kernel-10.6 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - The built in DNS resolver `inet_res` has been fixed to do a final request assuming that the request name is absolute, as customary for many DNS resolver client libraries. Own Id: OTP-19937 Related Id(s): GH-10494, PR-10576 ## Improvements and New Features - Added support for `zstd` compression in the `file` module. Own Id: OTP-19860 Related Id(s): PR-10385 - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of kernel-10.6 > > crypto-5.0, erts-15.2.5, sasl-3.0, stdlib-7.0 # megaco-4.8.3 The megaco-4.8.3 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of megaco-4.8.3 > > asn1-3.0, debugger-4.0, erts-12.0, et-1.5, kernel-8.0, runtime_tools-1.8.14, > stdlib-2.5 # mnesia-4.25.2 The mnesia-4.25.2 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of mnesia-4.25.2 > > erts-9.0, kernel-5.3, stdlib-5.0 # observer-2.18.2 The observer-2.18.2 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of observer-2.18.2 > > erts-15.0, et-1.5, kernel-10.0, runtime_tools-2.1, stdlib-5.0, wx-2.3 # odbc-2.16.1 The odbc-2.16.1 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Corrected specs to eliminate Dialyzer warnings for applications. Own Id: OTP-19992 Related Id(s): PR-10678 > #### Full runtime dependencies of odbc-2.16.1 > > erts-6.0, kernel-3.0, stdlib-2.0 # parsetools-2.7.1 The parsetools-2.7.1 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - The documentation for the `token/3` and `tokens/3` functions was corrected. The return value when there were too few characters is `{more,Cont}`. Own Id: OTP-19901 Related Id(s): PR-10484 > #### Full runtime dependencies of parsetools-2.7.1 > > erts-6.0, kernel-3.0, stdlib-3.4 # public_key-1.20.2 Note! The public_key-1.20.2 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- crypto-5.8 (first satisfied in OTP 28.3) ## Fixed Bugs and Malfunctions - Added missing mapping for der_encode/decode to handle 'OCSPRequest'. Own Id: OTP-19905 Related Id(s): GH-10474, PR-10522 - public_key:pkix_crl_verify/2 now handles certificates with EdDSA keys correctly instead of causing a runtime error. Own Id: OTP-19907 Related Id(s): GH-10495, PR-10496 > #### Full runtime dependencies of public_key-1.20.2 > > asn1-5.0, crypto-5.8, erts-13.0, kernel-8.0, stdlib-4.0 # reltool-1.0.3 The reltool-1.0.3 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of reltool-1.0.3 > > erts-15.0, kernel-9.0, sasl-4.2.1, stdlib-5.0, tools-2.6.14, wx-2.3 # runtime_tools-2.3.1 The runtime_tools-2.3.1 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of runtime_tools-2.3.1 > > erts-16.0, kernel-10.0, mnesia-4.12, stdlib-6.0 # sasl-4.3.1 The sasl-4.3.1 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of sasl-4.3.1 > > erts-15.0, kernel-6.0, stdlib-4.0, tools-2.6.14 # snmp-5.20.1 The snmp-5.20.1 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of snmp-5.20.1 > > asn1-5.4, crypto-4.6, erts-12.0, kernel-8.0, mnesia-4.12, > runtime_tools-1.8.14, stdlib-5.0 # ssh-5.5 Note! The ssh-5.5 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- crypto-5.7 (first satisfied in OTP 28.1) ## Fixed Bugs and Malfunctions - The type specification for the `CbInitArgs` parameter in ssh_client_channel:start/4 and ssh_client_channel:start_link/4 has been relaxed from `term()` to `term()`. This eliminates false Dialyzer warnings when passing non-list arguments (such as maps or atoms) to these functions. This change is backward compatible as `term()` includes `term()`. Own Id: OTP-19976 Related Id(s): GH-10351, PR-10673 ## Improvements and New Features - Added support for the PQC key exchange (kex) algorithm mlkem768x25519-sha256, a hybrid quantum-resistant algorithm combining ML-KEM-768 with X25519. Own Id: OTP-19824 Related Id(s): PR-10512, PR-10655 *** HIGHLIGHT *** > #### Full runtime dependencies of ssh-5.5 > > crypto-5.7, erts-14.0, kernel-10.3, public_key-1.6.1, runtime_tools-1.15.1, > stdlib-5.0, stdlib-6.0 # ssl-11.5.2 Note! The ssl-11.5.2 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. On a full OTP 28 installation, also the following runtime dependencies have to be satisfied: -- crypto-5.8 (first satisfied in OTP 28.3) -- public_key-1.18.3 (first satisfied in OTP 28.1) ## Fixed Bugs and Malfunctions - TLS servers that have `early_data` disabled will no longer include the `early_data` extension in its session tickets. Own Id: OTP-19940 Related Id(s): GH-10567, PR-10583 - ssl:connection_information/2 will now return correct information for TLS-1.2 session resumption. Own Id: OTP-19941 Related Id(s): GH-10470, PR-10586 - When performing renegotiation, in TLS-1.2 or earlier, \`max_frag_length\` will no longer be renegotiated. Instead, the connection will adhere to its originally negotiated value, and if a value was not negotiated it will not be negotiated. Own Id: OTP-19948 Related Id(s): PR-10599 - The NSS Keylogging refactoring mixed up of Read and Write connection states, could cause wrong NSS keylog labels, or `{error, closed}` returned without keylog. Own Id: OTP-19990 Related Id(s): GH-10698, PR-10723 ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of ssl-11.5.2 > > crypto-5.8, erts-16.0, inets-5.10.7, kernel-10.3, public_key-1.18.3, > runtime_tools-1.15.1, stdlib-7.0 # stdlib-7.3 Note! The stdlib-7.3 application _cannot_ be applied independently of other applications on an arbitrary OTP 28 installation. On a full OTP 28 installation, also the following runtime dependency has to be satisfied: -- erts-16.0.3 (first satisfied in OTP 28.0.3) ## Fixed Bugs and Malfunctions - Fixed functions ets:init_table/2, `ets:tab2file/2,3`, `ets:table/1,2`, `ets:i/0,1`, dets:from_ets/2, and dets:to_ets/2 to resolve named table arguments only once. This will prevent strange effects if the named table is deleted and recreated by a concurrent process. Own Id: OTP-19911 Related Id(s): PR-10536 - Corrected the `af_zip_generator()` type in the parser and `syntax_tools`. Own Id: OTP-19939 - For a function that started with a bracket-only pattern (such as `[]`), the `?FUNCTION_ARITY` macro would evaluate to one less than the actual arity. Own Id: OTP-19988 Related Id(s): GH-10705, PR-10708 ## Improvements and New Features - Added support for `zstd` compression in the `file` module. Own Id: OTP-19860 Related Id(s): PR-10385 - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 - The removal of the `slave` and `slave` modules have been postponed to Erlang/OTP 31. The partial removal of the archive feature has been postponed to Erlang/OTP 30. Own Id: OTP-19989 Related Id(s): PR-10714 > #### Full runtime dependencies of stdlib-7.3 > > compiler-5.0, crypto-4.5, erts-16.0.3, kernel-10.0, sasl-3.0, > syntax_tools-3.2.1 # syntax_tools-4.0.3 The syntax_tools-4.0.3 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Corrected the `af_zip_generator()` type in the parser and `syntax_tools`. Own Id: OTP-19939 ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of syntax_tools-4.0.3 > > compiler-9.0, erts-16.0, kernel-10.3, stdlib-7.0 # tools-4.1.4 The tools-4.1.4 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of tools-4.1.4 > > compiler-8.5, erts-15.0, erts-15.0, kernel-10.0, runtime_tools-2.1, stdlib-6.0 # wx-2.5.4 The wx-2.5.4 application can be applied independently of other applications on a full OTP 28 installation. ## Improvements and New Features - Release applications, tests, and documentation are now placed in their respective directories. Source SBOM with more packages. A `make release` application places only the necessary code in the release folder. The main change is that the documentation and examples are not part of the release folder anymore. `make release_docs` places the documentation in the released code under the `doc` folder. `make release_tests` places the tests in their own directory. It used to be the case that some source code was mixed with the tests, and this should not happen anymore. The Software Bill of Materials places the examples folders as if they are part of the `SPDX-otp--doc` packge, instead of placing examples as if they were running source code. Overall, this change cleans up many things that were not quite correct by definition, and everything should still continue to work as expected. To test a release, one can still run `./Install -minimal \`pwd\``and add the release to the`PATH`. After that, one can run tests as usual, going into the released tests directory, entering `test_server` and running the emulator. Improves the source Software-Bill-of-Materials - The improvements adds new SPDX relations for `asmjit` and `zlib` to be `optional_components_of` the Erlang/OTP project. - The `autoconf` scripts in `make` and `erts` have now been categorised as `build_tool_of` the Erlang/OTP project. - All remaining `configure`, `configure.ac`, `config.h.in`, `Makefile.in`, `Makefile.src`, `EMakefile`, and `GNUMakefile` are now part of a specific SPDX package with relation `build_tool_of` the Erlang/OTP project. Own Id: OTP-19886 Related Id(s): PR-10434 > #### Full runtime dependencies of wx-2.5.4 > > erts-12.0, kernel-8.0, stdlib-5.0 # xmerl-2.1.9 The xmerl-2.1.9 application can be applied independently of other applications on a full OTP 28 installation. ## Fixed Bugs and Malfunctions - Fixed license headers and links in documentation. Own Id: OTP-20006 Related Id(s): PR-10438 > #### Full runtime dependencies of xmerl-2.1.9 > > erts-6.0, kernel-8.4, stdlib-2.5 # Thanks to Benjamin Philip, Dmytro Lytovchenko, Jan Uhlig, Jonatan Männchen, Luke Bakken, Maria Scott, Mend Renovate, Nelson Vides, Robert Gionea, ryan-duve, Stavros Aronis, Stefan Grundmann, wallacegibbon