Erlang/OTP 28.3 released

Erlang News & Announcements Erlang News
,
1

OTP 28.3

Erlang/OTP 28.3 is the second maintenance patch package for OTP 28, with mostly bug fixes as well as improvements.

POTENTIAL INCOMPATIBILITIES

  • Adjustment in ssh_file module allowing inclusion of Erlang/OTP license in test files containing keys.

HIGHLIGHTS

ssl

  • Support for MLKEM hybrid algorithms x25519mlkem768, secp384r1mlkem1024, secp256r1mlkem768 in TLS-1.3

ssl, public_key

  • Added support in public_key and ssl for post quantum algorithm SLH-DSA.

erts, kernel

  • Support for the socket options TCP_KEEPCNT, TCP_KEEPIDLE, and TCP_KEEPINTVL have been implemented for gen_tcp, as well as TCP_USER_TIMEOUT for both gen_tcp and socket.

OTP

  • Publish OpenVEX statements in OpenVEX Documents for Maintained OTP Releases

    OpenVEX statements contain the same information as the OTP advisories, with the addition of vendor CVEs for which Erlang/OTP is not affected. This is important to silence vulnerability scanners that may claim Erlang/OTP to be vulnerable to vendor dependency projects, e.g., openssl.

    OpenVEX statements will be published in OpenVEX Documents for Maintained OTP Releases where there will be an OTP file per release, e.g., https://erlang.org/download/vex/otp-28.openvex.json.

    Erlang/OTP publishes OpenVEX statements for all supported releases, that is, as of today, OTP-26, OTP-27, and OTP-28.

    The source SBOM tooling (oss-review-toolkit) has been updated to produce source SBOM in SPDX v2.3 format, and the source SBOM now links OpenVEX statements to a security external reference. This means that by simply analyzing the source SBOM, everyone can further read the location of the OpenVEX statements and further process them.

For details about bugfixes and potential incompatibilities see
the Erlang 28.3 README

The Erlang/OTP source can also be found at GitHub on the official Erlang repository,

Download links for this and previous versions are found here:

7 Likes