Merge branch 'maint' into master

* maint:
  Updated OTP version
  Prepare release
  Update copyright year

Author: lucioleKi

erts/doc/notes.md

@@ -393,6 +393,47 @@ This document describes the changes made to the ERTS application.
 [PR-11004]: https://github.com/erlang/otp/pull/11004
 [PR-10929]: https://github.com/erlang/otp/pull/10929
 
+## Erts 16.4.0.4
+
+### Fixed Bugs and Malfunctions
+
+- Mitigated a denial of service attack in epmd.
+  
+  Thanks to Ryan Moore for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
+
+  *** POTENTIAL INCOMPATIBILITY ***
+
+  Own Id: OTP-20136 Aux Id: [CVE-2026-42792], [PR-11386]
+
+- Fixed heap corruption when an invalidly encoded tuple with an arity of 2^31 or larger is decoded from Erlang's External Term Format (binary_to_term).
+
+  Own Id: OTP-20214 Aux Id: [PR-11297], [CVE-2026-55737]
+
+- When send_timeout is set and send_timeout_close is set to true, a 'tcp_closed' message is expected when the timeout occurs, but that (message) was not delivered.
+  This has now been fixed.
+
+  Own Id: OTP-20257 Aux Id: [GH-11319]
+
+- A crafted External Term Format (ETF) payload could crash the runtime system.
+  
+  Thanks to Paul Guyot for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
+
+  Own Id: OTP-20259 Aux Id: [CVE-2026-54890], [PR-11386]
+
+- Fixed a rounding error in 16-bit float conversion.
+
+  Own Id: OTP-20260 Aux Id: [GH-11332], [PR-11334]
+
+[CVE-2026-42792]: https://nvd.nist.gov/vuln/detail/2026-42792
+[PR-11386]: https://github.com/erlang/otp/pull/11386
+[PR-11297]: https://github.com/erlang/otp/pull/11297
+[CVE-2026-55737]: https://nvd.nist.gov/vuln/detail/2026-55737
+[GH-11319]: https://github.com/erlang/otp/issues/11319
+[CVE-2026-54890]: https://nvd.nist.gov/vuln/detail/2026-54890
+[PR-11386]: https://github.com/erlang/otp/pull/11386
+[GH-11332]: https://github.com/erlang/otp/issues/11332
+[PR-11334]: https://github.com/erlang/otp/pull/11334
+
 ## Erts 16.4.0.3
 
 ### Fixed Bugs and Malfunctions

lib/crypto/doc/notes.md

@@ -97,6 +97,26 @@ This document describes the changes made to the Crypto application.
 [PR-10839]: https://github.com/erlang/otp/pull/10839
 [PR-10993]: https://github.com/erlang/otp/pull/10993
 
+## Crypto 5.8.3.2
+
+### Fixed Bugs and Malfunctions
+
+- Fixed crash in `crypto:macN/5` when supplied `MacLength` was greater than length of what the underlying hash returned.
+
+  Own Id: OTP-20239 Aux Id: [PR-11239]
+
+- Fixed segfault in `crypto:aead_cipher_init_nif` when argument validation fails.
+
+  Own Id: OTP-20241 Aux Id: [PR-11330]
+
+- Fix cipher key buffer overread for `chacha20_poly1305`.
+
+  Own Id: OTP-20244 Aux Id: [PR-11337]
+
+[PR-11239]: https://github.com/erlang/otp/pull/11239
+[PR-11330]: https://github.com/erlang/otp/pull/11330
+[PR-11337]: https://github.com/erlang/otp/pull/11337
+
 ## Crypto 5.8.3.1
 
 ### Fixed Bugs and Malfunctions

lib/diameter/doc/notes.md

@@ -77,6 +77,21 @@ Releases are listed in reverse chronological order, most recent first.
 [PR-10730]: https://github.com/erlang/otp/pull/10730
 [PR-10839]: https://github.com/erlang/otp/pull/10839
 
+## diameter 2.6.1.2
+
+### Fixed Bugs and Malfunctions
+
+- Fix infinite loop in `diameter_dist:route_session/2` when avp other than `Session-Id` has zero length.
+
+  Own Id: OTP-20242 Aux Id: [PR-11331]
+
+- Fix crash in `diameter_dist:route_session/2` when `Session-Id` (code: 263) avp has zero length.
+
+  Own Id: OTP-20243 Aux Id: [PR-11333]
+
+[PR-11331]: https://github.com/erlang/otp/pull/11331
+[PR-11333]: https://github.com/erlang/otp/pull/11333
+
 ## diameter 2.6.1.1
 
 ### Fixed Bugs and Malfunctions

lib/megaco/doc/notes.md

@@ -59,6 +59,16 @@ is the version number of Megaco.
 
 [PR-10839]: https://github.com/erlang/otp/pull/10839
 
+## Megaco 4.8.3.1
+
+### Fixed Bugs and Malfunctions
+
+- Fixed a buffer overflow in the megaco flex scanner C driver. A property parm name exceeding 452 bytes in a text-encoded H.248 message could overflow a fixed-size error buffer, crashing the VM. The sprintf calls have been replaced with bounded snprintf.
+
+  Own Id: OTP-20237 Aux Id: [PR-11323], GHSA-7xgh-gmgf-q2g7
+
+[PR-11323]: https://github.com/erlang/otp/pull/11323
+
 ## Megaco 4.8.3
 
 ### Improvements and New Features

lib/public_key/doc/notes.md

@@ -117,6 +117,16 @@ limitations under the License.
 [PR-10839]: https://github.com/erlang/otp/pull/10839
 [PR-10993]: https://github.com/erlang/otp/pull/10993
 
+## Public_Key 1.20.3.4
+
+### Fixed Bugs and Malfunctions
+
+- A certificate chain with crafted policyMappings extensions could cause exponential memory consumption during path validation, exploitable via TLS handshake. Chains exceeding a node-count cap are now rejected with {bad_cert, policy_tree_exceeded}.
+
+  Own Id: OTP-20251 Aux Id: [PR-11372], GHSA-622p-qfh6-c352
+
+[PR-11372]: https://github.com/erlang/otp/pull/11372
+
 ## Public_Key 1.20.3.3
 
 ### Fixed Bugs and Malfunctions

lib/ssh/doc/notes.md

@@ -228,6 +228,21 @@ limitations under the License.
 [PR-11010]: https://github.com/erlang/otp/pull/11010
 [PR-11012]: https://github.com/erlang/otp/pull/11012
 
+## Ssh 5.5.2.3
+
+### Fixed Bugs and Malfunctions
+
+- DH key exchange now enforces strict bounds (1 < e/f < p-1, 1 < K < p-1) on all paths, matching OpenSSH and Go. No interop impact.
+
+  Own Id: OTP-20229 Aux Id: [PR-11303]
+
+- Validate DH group parameters (P, G) received from the server during DH-GEX key exchange. The client now rejects groups where P is smaller than 2048 bits or G is not in the range (1, P-1). The default minimum in dh_gex_limits has been raised to 2048 on both client and server.
+
+  Own Id: OTP-20258 Aux Id: ERIERL-1341, [PR-11369]
+
+[PR-11303]: https://github.com/erlang/otp/pull/11303
+[PR-11369]: https://github.com/erlang/otp/pull/11369
+
 ## Ssh 5.5.2.2
 
 ### Fixed Bugs and Malfunctions

lib/ssl/doc/notes.md

@@ -226,6 +226,39 @@ This document describes the changes made to the SSL application.
 [PR-10979]: https://github.com/erlang/otp/pull/10979
 [PR-11019]: https://github.com/erlang/otp/pull/11019
 
+## SSL 11.6.0.4
+
+### Fixed Bugs and Malfunctions
+
+- Add pre TLS-1.3 client side validation of servers algorithm selection being part of clients offered algorithms, preventing in worst case MITM circumventing validation of server certificate tricking the client to trust the malicious MITM as it was a valid server. Note this check is already performed for TLS-1.3 clients.
+
+  Own Id: OTP-20240 Aux Id: [PR-11336], [CVE-2026-55953]
+
+- Prevent invalid cert chains to create cycles in chain building code used to handle 
+  chains that could be unordered or contain  extraneous certs. This avoids a DoS attack possibility.
+
+  Own Id: OTP-20245 Aux Id: [PR-11343], [CVE-2026-58227]
+
+- Clarify that rsa_psk and anonymous key exchange algorithms are considered legacy. Also harden rsa_psk in same way as normal rsa key exchange.
+
+  Own Id: OTP-20248 Aux Id: [PR-11341]
+
+- Harden SSL application to conform with best practice and RFC's. This will mostly improve error messages and conserve memory usage.
+
+  Own Id: OTP-20250 Aux Id: [PR-27944]
+
+- A certificate chain with crafted policyMappings extensions could cause exponential memory consumption during path validation, exploitable via TLS handshake. Chains exceeding a node-count cap are now rejected with {bad_cert, policy_tree_exceeded}.
+
+  Own Id: OTP-20251 Aux Id: [PR-11372], GHSA-622p-qfh6-c352
+
+[PR-11336]: https://github.com/erlang/otp/pull/11336
+[CVE-2026-55953]: https://nvd.nist.gov/vuln/detail/2026-55953
+[PR-11343]: https://github.com/erlang/otp/pull/11343
+[CVE-2026-58227]: https://nvd.nist.gov/vuln/detail/2026-58227
+[PR-11341]: https://github.com/erlang/otp/pull/11341
+[PR-27944]: https://github.com/erlang/otp/pull/27944
+[PR-11372]: https://github.com/erlang/otp/pull/11372
+
 ## SSL 11.6.0.3
 
 ### Fixed Bugs and Malfunctions

lib/stdlib/doc/notes.md

@@ -402,6 +402,19 @@ This document describes the changes made to the STDLIB application.
 [PR-10938]: https://github.com/erlang/otp/pull/10938
 [PR-10948]: https://github.com/erlang/otp/pull/10948
 
+## STDLIB 7.3.0.1
+
+### Fixed Bugs and Malfunctions
+
+- Fixed a bug where zip:unzip/1,2 and zip:extract/1,2 were vulnerable to a relative path traversal attack. A crafted zip archive containing entry names such as ../x/y could have caused files to be written outside the intended extraction directory.
+  
+  Thanks to Jonatan Männchen and Zhang Delong for finding and responsibly disclosing this vulnerability to the Erlang/OTP project.
+
+  Own Id: OTP-20143 Aux Id: [CVE-2026-47078], [PR-11386]
+
+[CVE-2026-47078]: https://nvd.nist.gov/vuln/detail/2026-47078
+[PR-11386]: https://github.com/erlang/otp/pull/11386
+
 ## STDLIB 7.3
 
 ### Fixed Bugs and Malfunctions

otp_versions.table

@@ -3,6 +3,7 @@ OTP-29.0.3 : common_test-1.31.1 compiler-10.0.2 crypto-5.9.1 dialyzer-6.0.2 erts
 OTP-29.0.2 : dialyzer-6.0.1 diameter-2.7.1 erl_interface-5.8.1 erts-17.0.2 ftp-1.2.6 inets-9.7.1 kernel-11.0.2 mnesia-4.26.1 public_key-1.21.2 ssh-6.0.1 ssl-11.7.2 stdlib-8.0.1 tools-4.2.1 # asn1-5.5 common_test-1.31 compiler-10.0.1 crypto-5.9 debugger-7.0 edoc-1.5 eldap-1.3 et-1.8 eunit-2.11 jinterface-1.16 megaco-4.9 observer-2.19 odbc-2.17 os_mon-2.12 parsetools-2.8 reltool-1.1 runtime_tools-2.4 sasl-4.4 snmp-5.20.4 syntax_tools-4.1 tftp-1.3 wx-2.6 xmerl-2.2 :
 OTP-29.0.1 : compiler-10.0.1 erts-17.0.1 kernel-11.0.1 public_key-1.21.1 snmp-5.20.4 ssl-11.7.1 # asn1-5.5 common_test-1.31 crypto-5.9 debugger-7.0 dialyzer-6.0 diameter-2.7 edoc-1.5 eldap-1.3 erl_interface-5.8 et-1.8 eunit-2.11 ftp-1.2.5 inets-9.7 jinterface-1.16 megaco-4.9 mnesia-4.26 observer-2.19 odbc-2.17 os_mon-2.12 parsetools-2.8 reltool-1.1 runtime_tools-2.4 sasl-4.4 ssh-6.0 stdlib-8.0 syntax_tools-4.1 tftp-1.3 tools-4.2 wx-2.6 xmerl-2.2 :
 OTP-29.0 : asn1-5.5 common_test-1.31 compiler-10.0 crypto-5.9 debugger-7.0 dialyzer-6.0 diameter-2.7 edoc-1.5 eldap-1.3 erl_interface-5.8 erts-17.0 et-1.8 eunit-2.11 ftp-1.2.5 inets-9.7 jinterface-1.16 kernel-11.0 megaco-4.9 mnesia-4.26 observer-2.19 odbc-2.17 os_mon-2.12 parsetools-2.8 public_key-1.21 reltool-1.1 runtime_tools-2.4 sasl-4.4 snmp-5.20.3 ssh-6.0 ssl-11.7 stdlib-8.0 syntax_tools-4.1 tftp-1.3 tools-4.2 wx-2.6 xmerl-2.2 # :
+OTP-28.5.0.4 : crypto-5.8.3.2 diameter-2.6.1.2 erts-16.4.0.4 megaco-4.8.3.1 public_key-1.20.3.4 ssh-5.5.2.3 ssl-11.6.0.4 stdlib-7.3.0.1 # asn1-5.4.3 common_test-1.30.0.1 compiler-9.0.6.1 debugger-6.0.3 dialyzer-5.4.0.1 edoc-1.4.1 eldap-1.2.16 erl_interface-5.7.0.1 et-1.7.3 eunit-2.10.3 ftp-1.2.4.1 inets-9.6.2.2 jinterface-1.15 kernel-10.6.3.3 mnesia-4.25.3.1 observer-2.18.2 odbc-2.16.1 os_mon-2.11.2 parsetools-2.7.1 reltool-1.0.3 runtime_tools-2.3.1 sasl-4.3.2 snmp-5.20.2.1 syntax_tools-4.0.3 tftp-1.2.4 tools-4.1.4 wx-2.5.4.1 xmerl-2.1.9 :
 OTP-28.5.0.3 : common_test-1.30.0.1 crypto-5.8.3.1 erts-16.4.0.3 kernel-10.6.3.3 public_key-1.20.3.3 ssh-5.5.2.2 ssl-11.6.0.3 # asn1-5.4.3 compiler-9.0.6.1 debugger-6.0.3 dialyzer-5.4.0.1 diameter-2.6.1.1 edoc-1.4.1 eldap-1.2.16 erl_interface-5.7.0.1 et-1.7.3 eunit-2.10.3 ftp-1.2.4.1 inets-9.6.2.2 jinterface-1.15 megaco-4.8.3 mnesia-4.25.3.1 observer-2.18.2 odbc-2.16.1 os_mon-2.11.2 parsetools-2.7.1 reltool-1.0.3 runtime_tools-2.3.1 sasl-4.3.2 snmp-5.20.2.1 stdlib-7.3 syntax_tools-4.0.3 tftp-1.2.4 tools-4.1.4 wx-2.5.4.1 xmerl-2.1.9 :
 OTP-28.5.0.2 : dialyzer-5.4.0.1 diameter-2.6.1.1 erl_interface-5.7.0.1 erts-16.4.0.2 ftp-1.2.4.1 inets-9.6.2.2 kernel-10.6.3.2 mnesia-4.25.3.1 public_key-1.20.3.2 ssh-5.5.2.1 ssl-11.6.0.2 # asn1-5.4.3 common_test-1.30 compiler-9.0.6.1 crypto-5.8.3 debugger-6.0.3 edoc-1.4.1 eldap-1.2.16 et-1.7.3 eunit-2.10.3 jinterface-1.15 megaco-4.8.3 observer-2.18.2 odbc-2.16.1 os_mon-2.11.2 parsetools-2.7.1 reltool-1.0.3 runtime_tools-2.3.1 sasl-4.3.2 snmp-5.20.2.1 stdlib-7.3 syntax_tools-4.0.3 tftp-1.2.4 tools-4.1.4 wx-2.5.4.1 xmerl-2.1.9 :
 OTP-28.5.0.1 : compiler-9.0.6.1 erts-16.4.0.1 inets-9.6.2.1 kernel-10.6.3.1 public_key-1.20.3.1 snmp-5.20.2.1 ssl-11.6.0.1 wx-2.5.4.1 # asn1-5.4.3 common_test-1.30 crypto-5.8.3 debugger-6.0.3 dialyzer-5.4 diameter-2.6.1 edoc-1.4.1 eldap-1.2.16 erl_interface-5.7 et-1.7.3 eunit-2.10.3 ftp-1.2.4 jinterface-1.15 megaco-4.8.3 mnesia-4.25.3 observer-2.18.2 odbc-2.16.1 os_mon-2.11.2 parsetools-2.7.1 reltool-1.0.3 runtime_tools-2.3.1 sasl-4.3.2 ssh-5.5.2 stdlib-7.3 syntax_tools-4.0.3 tftp-1.2.4 tools-4.1.4 xmerl-2.1.9 :