Erlang/OTP 29.0

Erlang/OTP 29.0 has been officially released, introducing new language features, security enhancements, and compiler warnings that impact developers and system administrators.

The release includes support for -unsafe attributes, enabling marking functions as unsafe, with the compiler generating warnings for unsafe calls. The SSH daemon now defaults to disabled for shell and exec services, aligning with the ‘secure by default’ principle, and the SFTP subsystem is no longer enabled by default. In SSL, the hybrid post-quantum algorithm x25519mlkem768 is now the preferred key exchange group. The module io_ansi allows for terminal styling, and the new ct_doctest module facilitates testing documentation examples. The default working directory placement has shifted, and there are no longer 32-bit Windows builds available.

Language enhancements include native records, considered experimental, and the new is_integer/3 guard for range checks. Multi-valued comprehensions are supported, allowing more complex data manipulations. The compiler now provides several default warnings, including deprecated catch operator use, variable export warnings, and obsolete guard tests, which will be removed in OTP 30. The standard library has added functions for list permutation, and the SSH key exchange algorithm defaults to a hybrid quantum-resistant protocol, mlkem768x25519-sha256, offering enhanced security against quantum attacks.

Why It Matters

This update is significant for Erlang developers and system administrators because it enhances language capabilities, improves security defaults, and introduces compiler warnings that promote better coding practices. The default disabling of SSH services reduces attack surfaces, aligning with security best practices. Support for quantum-resistant algorithms marks a critical step in preparing Erlang systems for future cryptographic challenges.

Background

Erlang/OTP 29.0 follows previous releases focused on performance and security improvements. The introduction of native records and multi-valued comprehensions reflects ongoing language evolution. The shift to default security settings in SSH aligns with industry standards. Historically, Erlang has prioritized system reliability and security, and this release continues that trend with notable enhancements.

“Erlang/OTP 29.0 introduces significant language features and security improvements, reinforcing Erlang’s commitment to robust, secure systems.”

— Erlang/OTP team

“The default disabling of SSH services and the adoption of post-quantum algorithms reflect our focus on security and future-proofing.”

— Erlang/OTP project lead

What Remains Unclear

Details about the full impact of native records’ stability and adoption are still emerging, as they are marked experimental. Compatibility issues with older systems or tools are yet to be fully assessed, and the long-term effects of new compiler warnings are still being observed.

What’s Next

Next steps include monitoring community feedback on native records and security defaults, as well as tracking adoption of the new features in production environments. Further updates may address any issues arising from this release, and documentation will evolve accordingly.

Key Questions

What are native records in Erlang/OTP 29.0?

Native records are a new data type introduced as an alternative to traditional tuple-based records, considered experimental in this release, offering improved type safety and performance.

How does the security default change in SSH impact users?

By default, the SSH daemon disables shell and exec services, reducing potential attack vectors. Users must explicitly enable these services if needed, enhancing system security.

What is the significance of the new post-quantum algorithm?

The default key exchange algorithm, mlkem768x25519-sha256, provides resistance against quantum computer attacks, ensuring cryptographic security for the future.

Are there any major backward compatibility concerns?

Some incompatibilities are possible due to deprecated features like the catch operator warning and changes in default behaviors. Developers should review the release notes for detailed guidance.