This release is mostly bug fixes, and repairs prior broken builds of elixir dependencies, but also includes a couple of useful features.

New Features:

• Add escript_incl_priv so escriptize priv dir inclusion works with _checkouts and profiles
• Added SSL cacert patch to support Corporate MITM Proxies

Bug fixes:

• rebar3 release to honour the ignore-xref attribute
• Bump relx to 4.5.0
  • use copied erts dir when tar'ing even when the user sets the erts
  • improve error message when a symlink creation fails
  • State extended with a filter method to filter xref_warnings
  • Do not require logger
  • Add default time warp mode of multi
  • optionally allow static node name prefixes
  • use random:uniform instead of os:pid when constructing node name in nodetool
  • Fix eval command to use ERL_DIST_PORT, consistency with rpc command
  • Fix bin script arguments to erlexec
• Give compiler hints when handling run-time deps in parse_transforms
• Make rebar_file_utils:system_tmpdir/1 take TMPDIR env var into account on *nix
• Handle abstract code starting with a non-file attribute
• Prefer erlang app to mix project
• Drop bootstrap URI handling functions warnings
• Prevent crashes on recursive src_dir definitions in deps
• Fix ssl check hostname options for wildcard certificate
• {xref_ignores} now properly works on module,
• Normalize Dialyzer PLT paths
• Fix optimistic registry update of plugins being upgraded

Security release. See https://ferd.ca/you-ve-got-to-upgrade-rebar3.html

Major security fix around TLS validation. See https://ferd.ca/you-ve-got-to-upgrade-rebar3.html

Also:

• local upgrade: extract vsn of rebar3 from downloaded escript

Major security fix around TLS validation. See https://ferd.ca/you-ve-got-to-upgrade-rebar3.html

This release drops multiple OTP versions as officially supported. We're aligning rebar3 development with the OTP team's compatibility guarantees, as some deprecations from OTP-21 were removed in OTP-24 and we just could not maintain compatible code bases. We're using the breakage opportunity to change just how much we support to something more sustainable.

The release also contains extra fixes that should prove useful.

• Only support 3 newest OTP versions
• add support to configure application resource naming
• Support ERL_LIBS libraries in escript building
• Fix CLI arg order in makefile template
• Increase OTP 24 readiness + move to OTP 20 min.
• Bump erlware_commons and certifi
• Treat applications and included_applications the same way when builing Dialyzer PLTs
• Strip CLI args from provider hooks
• Fix plugins upgrade for non-tuple specification

• Fix bad compiler path nesting

• Make dialyzer output file format configurable
• Fix DAG resolving for recursive directories
• Add EUnit support for sys_config options
• Catch and report missing escript dependency
• Relay unexpected relx return values
• Bump Relx and cth_readable
  • relx_resolve:to_app raise error with .app file pathname
  • Concurrent Builds - xref interactions refinement
  • Add richer return values for nodetool rpc
  • add exports of RELEASE_NAME, RELEASE_VERSION and RELEASE_PROG to script
• add an option to select the application to build an escript for
• Do not discard parameters --system_libs and --include-erts
• Have "rebar3 plugins upgrade" work without specifying plugin name
• rebar3 shell: implement various modes to print "booted" message
• More path juggling fixes in the compiler
• Fix OTP24 complaining about underscored variables
• Handle OTP-24 function location in xref
• pass no_spawn_compiler_process to compile:file/2

This is a point release containing various bug fixes, some performance enhancements, and adding support for OTP-24.

• Common test: make group paths work for --group "[g1,g2],g3" option
• Adapt to upcoming OTP 24 dialyzer output
• Sanitize repo configuration in DEBUG output
• Modify algorithm to decide compilation order between apps to resolve header dependencies
• Use rebar_packages_cdn for fetching package resource
• bump relx to 4.3.0
• Compile nothing if there are no extra virtual apps (performance increase)
• Print actural download repo in DEBUG output
• bump cth readable to 1.5.0
• Make sure dialyzer static analysis is performed at least once, in CI
• Use "git rev-list --count" to count refs (performance increase)
• OTP-24 Readiness
• fix injection of cth_readable to allow for hook configuration
• Fixed link to list of plugins.
• rebar_compiler: fix DAG and speed-up analysis for large repositories
• use newest certifi release

• bump relx to v4.2.0
  • See changes in relx v4.2.0 here
• Add support for relx config file

Here's all the changes that may impact some behaviour:

• Lots of Relx-related fixes as 4.x stabilizes, including:
  • fixes in handling of system_libs
  • bringing back start and attach commands (with warnings)
  • additional bugfixes for embedded, NixOS, and windows systems
• Rework DEBUG=1 mode to be user-centric output and introduce separate DIAGNOSTIC=1 mode for implementer-level logging (see also: Reworking more of the DEBUG output to be friendly)
• Trigger rebuilds when OTP compiler version changes (also includes fixes to plugins using checkout directories)
• Fix endless recursion in del_dep overrides
• Fix lock file not being generated when no deps are present in the config
• Change xref paths to only those of runtime deps
• Fix compile issue on windows when OS language is not english
• fix logger reset for the shell provider
• Re-vendor hex_core in at 0.7.x
• Fix relup command arguments and add validation
• Add checkouts location back to rebar3 path
• Support pre-fetched deps for nix
• set explicit encoding when reading and writing hex config
• Update references to changed API elements
• Remove verbosity option that was taken out in relx 4.x
• Run pkg updates on plugin upgrades (see also: Fixup plugin upgrade autoupdate)
• Make rebar3 templates check for name clashes
• Patch rebar_base_compiler to handle extensions with no leading dot (legacy compiler interface)
• Handle unicode in author's name in templates
• Specify dependencies for MIB files
• Ignore global and default in empty profiles warning for as
• Use infinity timeout for rebar_compiler_epp resolve call
• Add alias to example rebar.config.sample
• Fix dialyzer warning output for option unknown
• Add xref_ignores to sample config file
• Prevent xref crash when function deemed undefined has no local context
• Output relative paths in Dialyzer output (now controlled by the compiler_source_format option)

And some Internal Changes:

• Prevent dialyzer warnings on OTP 23
• Add a docker recipe for rebar3 itself
• Fix spec for download callback
• Add rebar_hex_repos:remove_from_auth_config/2
• Bumping cth_readable version and other small cleanups
• Add regression test for dep override infinite loop
• Fix README (see also: Update README.md and Update README with supported Erlang/OTP versions)
• Update link for Rebar 2.x to Rebar3
• use 'aws cp' when copying escript to s3

Contributions from 17 people are part of this release, and the project health is starting to look better; thanks to everyone involved!