Update dependency erlang to v29.0.2 #169
No reviewers
Labels
No labels
Area
Editor
Area
Micropub
Compat
Breaking
Kind
Bug
Kind
Documentation
Kind
Enhancement
Kind
Feature
Kind
Infra
Kind
Security
Kind
Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
inhji/hajur!169
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/erlang-29.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
29.0.1→29.0.2Release Notes
erlang/otp (erlang)
v29.0.2: OTP 29.0.2Compare Source
Check out the git tag OTP-29.0.2, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
dialyzer-6.0.1
The dialyzer-6.0.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fix native record bugs in Dialyzer
Own Id: OTP-20178
Related Id(s): PR-11199
diameter-2.7.1
The diameter-2.7.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed return value documentation of
diameter:service_info(SvcName, statistics)Own Id: OTP-20150
Related Id(s): GH-11105, PR-11146
erl_interface-5.8.1
The erl_interface-5.8.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed stack overflow in
ei_s_print_termfor very big integer terms (> 2000 hexadecimal digits long).Own Id: OTP-20160
Related Id(s): GH-SA-xcxj-5pg2-v72j, PR-11193, CVE-2026-49760
erts-17.0.2
The erts-17.0.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
A buffer overflow error when parsing SCTP ERROR or ABORT chunks has been fixed.
This could lead to stack corruption and VM crash, but ultimately with hard work by an attacker be refined into maybe even remote code execution.
Own Id: OTP-20165
Related Id(s): GH-SA-6f4f-chj5-5g97, PR-1234, CVE-2026-49759
ftp-1.2.6
The ftp-1.2.6 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
FTP client default connections that use the so called passive mode of FTP fails to properly validating the response IP of the server, hence a malicious or compromised FTP server could redirect the data connection to an arbitrary host, enabling s server-side request forgery (SSRF) and FTP bounce attacks.
Own Id: OTP-20166
Related Id(s): GH-SA-24cv-hwgr-37fq, PR-11186, CVE-2026-48858
inets-9.7.1
The inets-9.7.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
The HTTP client (httpc) now removes Authorization, Proxy-Authorization, Cookie, Referer, and Origin headers when following a redirect to a different host or port. Previously these headers were forwarded verbatim, potentially leaking credentials to unintended targets.
This follows the requirements of RFC 9110 §15.4.
Own Id: OTP-20155
Related Id(s): GH-SA-m75x-4vwg-ggjh, PR-11212, CVE-2026-48856
kernel-11.0.2
The kernel-11.0.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
gen_tcp_socket accept should explicitly inherit the same options as plain gen_tcp.
Own Id: OTP-20057
mnesia-4.26.1
The mnesia-4.26.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed docs of
mnesia:write/3to clarify when a transaction can terminate.Own Id: OTP-20149
Related Id(s): GH-11104, PR-11145
public_key-1.21.2
The public_key-1.21.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Add missing macro reference for legacy algorithms md5 and sha224. This mainly improves error handling.
Own Id: OTP-20172
Related Id(s): PR-11195
ssh-6.0.1
The ssh-6.0.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed a timing-based username enumeration vulnerability during password authentication with the user_passwords option. A dummy PBKDF2 computation is now performed for invalid usernames to match the response time of valid ones.
Own Id: OTP-20153
Related Id(s): GH-SA-3w6p-vwhf-wvp4, PR-11157, CVE-2026-48859
Fixed SSH_FXP_READLINK handler in ssh_sftpd to strip the backend root prefix from symlink targets before returning them to the client, preventing disclosure of the server's absolute filesystem path when the root option is configured.
Own Id: OTP-20162
Related Id(s): GH-SA-pv7g-pjrq-x2fh, PR-11192, CVE-2026-48855
Fixed a race condition where SSH keep-alive responses could consume pending channel open requests, causing channel setup to fail silently.
Own Id: OTP-20181
Related Id(s): PR-11205
ssl-11.7.2
Note! The ssl-11.7.2 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.
Fixed Bugs and Malfunctions
Fix miscellanies issues that could cause unnecessary memory consumption and in some less common scenarios or configurations cause connection failures.
Own Id: OTP-20154
Related Id(s): PR-11148
Erlang distribution over TLS run with the kernel 'check_ip' flag now properly enforce connecting nodes to be on the same LAN.
Own Id: OTP-20156
Related Id(s): GH-SA-gp7x-mfv6-52cv, PR-11181, CVE-2026-48860
Enhance error message, by fixing typo of atom in new error message related to `public_key` CVE-2026-42790 solution.
Own Id: OTP-20161
Related Id(s): PR-11148
Corrected SNI handling for TLS-1.3 only server, could cause connection failures if supported signature algorithms where changed by SNI option update.
Own Id: OTP-20174
Related Id(s): PR-27384
stdlib-8.0.1
The stdlib-8.0.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fix a bug where a tuple record operation within a native record anonymous update can crash.
Own Id: OTP-20151
Related Id(s): PR-11141
Fixed some bugs in
io_lib:bformat/2and native record printing.Own Id: OTP-20170
Related Id(s): PR-11154
tools-4.2.1
The tools-4.2.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Xref could crash instead of returning an appropriate error tuple when asked to open a BEAM file without debug information but with a
moduledoc(false)attribute.Own Id: OTP-20163
Related Id(s): GH-11152, PR-11168
Thanks to
John Downey, Jonatan Männchen
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
Update dependency erlang to v29.0.2to chore(deps): update dependency erlang to v29.0.2chore(deps): update dependency erlang to v29.0.2to Update dependency erlang to v29.0.2Update dependency erlang to v29.0.2to chore(deps): update dependency erlang to v29.0.2chore(deps): update dependency erlang to v29.0.2to Update dependency erlang to v29.0.2View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.