[renovate]

This PR contains the following updates:

Package	Update	Change
rebar	minor	3.25.0 → 3.28.0

---

Release Notes

erlang/rebar3 (rebar)

v3.28.0

Compare Source

Few interface changes, but some significant behavioural ones:

• Remove Certifi dependency and rely on root store
• Bump vendored hex_core to 0.20.1
• Improve description of rebar3 ct --dir option

Note that both the hex_core update and the certifi update are required for security. The removal of Certifi switches Rebar3 to use your operating system's root store, which may cause issues in some limited devices. However, since distrusted intermediary certificates are currently still in Certifi's hex package, we consider it safer to rely on operating system root stores.

If your device does not comply with the expected root store, you can configure one with {ssl_cacerts_path, "/path/to/cacerts.pem"}.

v3.27.3

Compare Source

• Bump vendored hex_core to 0.20

v3.27.2

Compare Source

• Fix for CVE-2026-103060

v3.27.1

Compare Source

• Support missing no_proxy option
• Keep quoting in zsh completion descriptions
• Remove redundant droplast implementation
• Implement Hex Auth
• Fix SIGQUIT (Ctrl+) producing a core dump in rebar3 shell
• Upgrade hex_core to 0.18.0

v3.27.0

Compare Source

• Vendor hex_core 0.12.2
• prepare for OTP-29 by defaulting to warn_deprecated_catch
• fix bogus timestamps when creating escripts
• Add precision flag (and config) to control output percentage precision
• Add middlebox_comp_mode to global options
• Ignore optional Hex package dependencies

v3.26.0

Compare Source

• fix rebar_app_info:source/1 spec
• fix the version range parser to support and/or version constraints
• IPv6 support for getting Hex packages
• CT: disable cth_readable_failonly hook when verbose option is set
• relx: do not discard command line parameters when parameter is not in config
• Support env variable substitution with defaults in rebar shell
• Improve documentation
• Return manifest macros as objects
• Expand extra src dirs recursively in manifests
• Make xref recognize apps again

v3.25.1

Compare Source

Two fixes for Windows:

• Update escriptize hook to work with newer Windows versions
  • The regex used to match hooks for Rebar3's own escript location relied on the win32 part of the architecture description line. Newer Windows versions now return a windows pattern instead
• Bump erlware_commons to 1.8.0 (fixes hanging resource fetches on Windows on OTP-28)

There are also a couple of minor improvements:

• Add file completion support for bash completion, fixing autocompletion of common command arguments that are file names
• Support resources of arbitrary size in rebar3, allowing fancier custom dependency plugins

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.