Attn: Development Editor, Latest OCaml Weekly News
Alan Schmitt <[email protected]> Tue, 21 Jul 2026 18:02:49 +0200
| Newsgroups | gmane.comp.lang.caml.inria |
|---|---|
| Message-ID | <[email protected]> |
--===-=-=
Content-Type: multipart/mixed; boundary="=-=-="
--=-=-=
Content-Type: multipart/alternative; boundary="==-=-="
--==-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Hello
Here is the latest OCaml Weekly News, for the week of July 14 to 21,
2026.
Table of Contents
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=
=80
ocamlgrep 0.1.1
MirageOS on Unikraft
ppx_deriving_melange 0.1.0 - eq, ord, show, map, iter derivers for Melange
hegel 0.12.1
A small extension of Bigarray.Genarray adding iteration, mapping and folding
OCaml Security Team, report for first half of 2026
Dune Package Management Updates
opam 2.6.0~alpha1
The little type that could too much
Old CWN
ocamlgrep 0.1.1
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90
Archive: <https://discuss.ocaml.org/t/ann-ocamlgrep-0-1-1/18350/1>
Nicolas Ojeda Bar announced
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=
=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=
=E2=94=80=E2=94=80
We are happy to announce the first public release of `ocamlgrep', a
tool for structural grepping of OCaml code.
This tool has existed within the walls of LexiFi for a long time and
we were keen on open-sourcing it, but it was not in a form that could
be used by the wider public. Now, thanks to the work of @mjambon, we
are able to to finally do so.
<https://github.com/LexiFi/ocamlgrep/releases/tag/0.1.1>
To install:
=E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=82 $ opam install ocamlgrep
=E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80
The idea behind the tool is simple: you call it from within your Dune
project[^1] with a query (after having built all `.cmt~/'.cmti~
artifacts, eg by doing `dune build @check'), and the tool returns the
list of matches it can find in the source tree. A _query_ is
syntactically an OCaml expression, possibly with _holes_ `__' in
it. Some examples follow to give an idea of how the tool is used in
practice.
The following query searches for the anti-pattern `List.rev e1 @ e2'
(where `e1' and `e2' are arbitrary expressions.
=E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=82 $ ocamlgrep 'List.rev __ @ __`
=E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80
NoteNote that as the tool works at the level of the OCaml AST, it will
also match expressions of the form `(@) (e1 |> List.rev) e2', since
they produce the same AST.
The syntax of type constraints `(e : ty)' is overloaded to impose a
type condition on the search term. For example, the following search
query looks for function calls where the first argument is an `int'
and the second one a `string'.
=E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=82 $ ocamlgrep '__ (__ : int) (__ : string)'
=E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80
The _holes_ can be numbered, `__1', `__2', etc, to express repetitions
of the same term. For example, the following query searches for a
pattern matching on an option that sends `Some x' to `Some x' (ie
reconstructing the same value):
=E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=82 $ ocamlgrep 'match __ with Some __1 -> Some __1 | None -> __'
=E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80
We can also look for applications of the polymorphic operator `=3D'
applied to `float' arguments:
=E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=82 $ ocamlgrep '(__ : float) =3D __'
=E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80
Historically, this tool has been useful for large-scale refactorings
and linting of our codebase. Nowadays, such refactorings can often be
done using AI agents. However, the tool is still able to do things
that seem a bit beyond of what AI agents can do today, eg to look for
applications of polymorphic functions where one of the arguments is of
a specific type. This was for example useful when [migrating] our
codebase to `no-flat-float-array' mode, where we wanted to make sure
that polymorphic array operations were not being applied to `float
array' values.
Happy grepping!
Cheers, Nicolas
[^1]: Only Dune projects are supported for now. Adding support for
other build systems should not be very hard, issues and/or PRs are
welcome.
[migrating] <https://www.lexifi.com/blog/ocaml/floatarray-migration/>
MirageOS on Unikraft
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=
=90=E2=95=90=E2=95=90=E2=95=90
Archive: <https://discuss.ocaml.org/t/mirageos-on-unikraft/16975/3>
Continuing this thread, shym announced
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=
=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80
I=E2=80=99m happy to announce that OCaml/Unikraft 1.2.0 [has been release=
d]
with:
=E2=80=A2 support for OCaml 5.4.1 and 5.5.0,
=E2=80=A2 a way to use fine-tuned Unikraft configurations when that=E2=80=
=99s needed,
=E2=80=A2 a new version number scheme for some of the packages, to combin=
e the
OCaml/Unikraft version with the underlying Unikraft version.
Happy unikerneling!
[has been released]
<https://github.com/ocaml/opam-repository/pull/30209>
ppx_deriving_melange 0.1.0 - eq, ord, show, map, iter derivers for Melange
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=
=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=
=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=
=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90
Archive:
<https://discuss.ocaml.org/t/ann-ppx-deriving-melange-0-1-0-eq-ord-show-m=
ap-iter-derivers-for-melange/18352/1>
Atlas07 announced
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=
=80
Hi everyone,
I'm happy to announce the first release of *ppx_deriving_melange*, a
Melange-compatible subset of `ppx_deriving':
<https://github.com/ahrefs/ppx_deriving_melange>
Why
=E2=95=8C=E2=95=8C=E2=95=8C
The original `ppx_deriving' can't support Melange: it predates dune's
Melange integration =E2=80=94 it is distributed through findlib META file=
s,
and its generated code depends on a runtime library that isn't built
in Melange mode. Melange can only link libraries that dune builds for
it, so common patterns like `\[@@deriving eq, show\]' were off the
table when writing frontend OCaml.
`ppx_deriving_melange' fills that gap: same derivers, same naming
conventions and attributes, implemented on ppxlib and tested against
Melange =E2=80=94 and its generated code is self-contained, so nothing ex=
tra
needs to link into your bundle.
A key use case is *universal code* =E2=80=94 libraries compiled both nati=
vely
and to JavaScript. Put your shared types in a library with `(modes
:standard melange)', derive once, and the exact same
`equal~/~compare~/~show' functions run on the server and in the
browser. (This is how the project tests itself: one test-case library
exercised by OUnit natively and by node on the Melange side.)
What you get
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C
=E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=82 type user =3D {
=E2=94=82=20
=E2=94=82 name : string;
=E2=94=82=20
=E2=94=82 roles : string list;
=E2=94=82=20
=E2=94=82 }
=E2=94=82=20
=E2=94=82 [@@deriving eq, ord, show]
=E2=94=82=20
=E2=94=82=20
=E2=94=82=20
=E2=94=82 (* generates:
=E2=94=82=20
=E2=94=82 val equal_user : user -> user -> bool
=E2=94=82=20
=E2=94=82 val compare_user : user -> user -> int
=E2=94=82=20
=E2=94=82 val pp_user : Format.formatter -> user -> unit
=E2=94=82=20
=E2=94=82 val show_user : user -> string *)
=E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80
Supported derivers in 0.1.0: `eq', `iter', `map', `ord', and `show',
following the native `ppx_deriving' conventions =E2=80=94 including the
`equal', `compare', and `printer' attribute overrides, the `with_path'
option for `show', tuples, records, (polymorphic) variants, options,
lists, arrays, results, type parameters, and recursive type
groups. The README documents the exact supported scope of each
deriver.
Two design points worth calling out:
=E2=80=A2 *Self-contained generated code.* There is no runtime library: t=
he
generated functions only use the stdlib, so the ppx is a build-time
dependency only.
=E2=80=A2 *Bundle-size-aware `show'.* Melange compiles `Stdlib.Format' in=
to a
lot of JavaScript, so `show' builds its string directly and only
falls back to `Format' where the type requires it (custom printers,
etc.). Code that only calls `show' doesn't pull Format into your
bundle; `pp' stays fully Format-based and native-compatible.
What's not there (yet)
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=
=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C
Some `ppx_deriving' derivers aren't implemented yet (`enum', `fold',
`make', =E2=80=A6), and a few type shapes are out of scope for now (`ref',
`lazy_t', `nativeint', functor-applied types). If you need one of
these =E2=80=94 or hit anything that behaves differently from native
`ppx_deriving' =E2=80=94 please open an issue; that's exactly the feedback
that will drive what gets built next.
Using it
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C
=E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=82 opam install ppx_deriving_melange
=E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=82 (library
=E2=94=82=20
=E2=94=82 (name my_frontend_lib)
=E2=94=82=20
=E2=94=82 (modes melange)
=E2=94=82=20
=E2=94=82 (preprocess
=E2=94=82=20
=E2=94=82 (pps ppx_deriving_melange)))
=E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80
Thanks to the `ppx_deriving' authors =E2=80=94 this project follows their
design and behavior closely, and includes their license attribution =E2=
=80=94
and to [davesnx] for reviews and encouragement along the way.
Feedback, issues, and deriver requests very welcome!
[davesnx] <https://github.com/davesnx>
hegel 0.12.1
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90
Archive: <https://discuss.ocaml.org/t/ann-hegel-0-12-1/18358/1>
Ethan Chou announced
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=
=80=E2=94=80=E2=94=80=E2=94=80
Hello! I work at [Antithesis], a deterministic simulation testing
startup.
Recently, we released Hegel for OCaml.
Hegel is a family of PBT libraries based on Hypothesis, providing
powerful, ergonomic property-based testing for many different
languages. Hegel lets you declare data generation inline with your
test code, and provides native support for stateful testing.
The installation instructions can be found at the Github repository
[here]. Click on the link in the about section in the repository to
see the documentation sorry, I can't post more than two links yet). We
encourage people to contribute!
Here's an example Hegel test:
=E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=82 let bad_map _ xs =3D xs
=E2=94=82=20
=E2=94=82 let%hegel_test bad_map_vs_map tc =3D
=E2=94=82 let int_gen =3D integers () in
=E2=94=82 let int_fn_gen =3D functions ~sexp_of_arg:Core.Int.sexp_of_t =
~returns:int_gen () in
=E2=94=82 let f =3D draw_silent tc int_fn_gen
=E2=94=82 and xs =3D draw tc (lists int_gen ()) in
=E2=94=82 require_equal
=E2=94=82 tc
=E2=94=82 (Core.List.sexp_of_t Core.Int.sexp_of_t)
=E2=94=82 (bad_map f xs) (List.map f xs)
=E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80
prints (with colors in the terminal):
=E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=82 --- Failure: bad_map_vs_map (examples/higher_order.ml:20) -----=
---------
=E2=94=82 Falsified after 2 test cases (0 discarded):
=E2=94=82=20
=E2=94=82 xs =3D (0)
=E2=94=82 f 0 =3D 1
=E2=94=82 require_equal: values differ (- lhs / + rhs):
=E2=94=82 (0) (1)
=E2=94=82=20
=E2=94=82 Exception: Failure("require_equal: values differ")
=E2=94=82 rerun with: [@@failure_blobs [ "AAQAAAABAQAKAQAAAAABAAAKAQAAAAE=
=3D" ]]
=E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80
Happy testing!
[Antithesis] <https://antithesis.com>
[here] <https://github.com/hegeldev/hegel-ocaml>
A small extension of Bigarray.Genarray adding iteration, mapping and folding
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=
=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=
=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=
=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=
=E2=95=90
Archive:
<https://discuss.ocaml.org/t/ann-a-small-extension-of-bigarray-genarray-a=
dding-iteration-mapping-and-folding/15005/7>
Continuing this thread, NAlec announced
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=
=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80
Just to let you know, it is now available as [GenArrayIter] opam
package. PR welcome of course. Documentation [here]
[GenArrayIter] <https://ocaml.org/p/GenArrayIter/latest>
[here]
<https://heyji2.github.io/GenArrayIter/GenArrayIter/GenArrayIter/Iter/index=
.html>
OCaml Security Team, report for first half of 2026
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=
=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=
=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90
Archive:
<https://discuss.ocaml.org/t/ocaml-security-team-report-for-first-half-of=
-2026/18366/1>
Hannes Mehnert announced
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=
=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80
Throughout the first half of 2026, the security team has worked on
security advisories: the publishing pipeline (from report over
communication and fixes, to the security vulnerability database -
these days osv.dev and CVE).
The team consists of:
=E2=80=A2 Hannes Mehnert - @hannesm - individual, robur.coop
=E2=80=A2 Mindy Preston - @yomimono - individual
=E2=80=A2 Joe - @cfcs - individual
=E2=80=A2 Edwin T=C3=B6r=C3=B6k - @edwintorok - individual, Tarides
=E2=80=A2 Nicol=C3=A1s Ojeda B=C3=A4r - @nojb - LexiFi
=E2=80=A2 Louis Roch=C3=A9 - @Khady - ahrefs
=E2=80=A2 Boning Dong - @bn-d - Bloomberg
Vulnerability Database
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=
=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C
The public vulnerability database
(<https://github.com/ocaml/security-advisories>) is established, and
filled as well with old security advisories (from the MirageOS
project, etc.). There is tooling via CI which generates a branch
"generated-osv", which is a source for the Open Source Vulnerability
database (<https://osv.dev>), run by Google. The direct link for all
security advisories of the OCaml Security team is [here].
The tooling is available from <https://github.com/hannesm/advisories>.
[here] <https://osv.dev/list?ecosystem=3Dopam>
Audit Tooling
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C
Another utility to check your "opam switch" for installed vulnerable
packages (using the above mentioned vulnerability database), has been
developed - available at <https://github.com/hannesm/opam-audit>.
Public Meetings
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C
On March 19th a public OCaml security meeting took place with 10
attendees. The meeting notes are available at
<https://pad.data.coop/7-Ic5rG6ToynsW02hJsndg>
Modification Policy of the opam-repository
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=
=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=
=8C
The Security Team proposed to make the immutability policy stricter
(see <https://github.com/ocaml/opam-repository/pull/29072>) - which
has been merged. So, any published opam package must not modify its
sources (change tarball, add patches, modify build instructions,
=E2=80=A6). Instead, a new version must be published. This makes the pack=
age
URL (<https://github.com/package-url/purl-spec>) sensible and point to
a precise source.
Grant Proposals
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C
A call for contributions was opened until end of March 2026. The
Security Team is impressed by the amount and quality of the
proposals. Evaluation and finding funding for proposals is still
ongoing. We have some preliminary decisions and will reach out to the
applicants by the end of July 2026.
Advisories
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C
So far, there have been 10 advisories (OSEC-2026-01 until
OSEC-2026-10) published, and some more are worked on. Our primary
communication channel is email, and we reach out to reports that we
received GitHub by email. A [public mailing list] is available where
security advisories are announced.
They range from issues in the OCaml runtime (Marshal buffer over-read
OSEC-2026-01 CVE-2026-28364, Bigarray.reshape interger overflow
OSEC-2026-04 CVE-2026-34353, command injection on Windows via filename
OSEC-2026-05 CVE-2026-41083), opam sandbox escape (OSEC-2026-03
CVE-2026-41082, OSEC-2026-10 CVE-2026-57825), insufficient certificate
property checks (in tls, OSEC-2026-06 CVE-2026-45388, OSEC-2026-07
CVE-2026-45389), path traversal (in tar, OSEC-2026-08 CVE-2026-45390),
memory exhaustion (unbounded memory usage in arp, OSEC-2026-02,
infinite loop in albatross-console, OSEC-2026-09).
The variety of reporters - 8 different people in 10 reports - is
amazing. Thanks to all reporters, as well as the upstream
developers. It has been a pleasure to coordinate the vulnerabilities.
[public mailing list]
<https://sympa.inria.fr/sympa/info/ocsf-ocaml-security-announcements>
Future Plans
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C
The Security Team also hopes to publish security guides for OCaml
programmers and project maintainers.
Acknowledgements
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C
The Security Team is an initiative of the OCaml Software Foundation
and is grateful to the OCSF and its sponsors for their support.
Dune Package Management Updates
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=
=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90
Archive:
<https://discuss.ocaml.org/t/dune-package-management-updates/18023/2>
Continuing this thread, Shon announced
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=
=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80
Hello! We have just made our roadmap for dune package management
available on the wiki for dune:
<https://github.com/ocaml/dune/wiki/Dune-Pkg-Roadmap>.
About the roadmap
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=
=8C
This living document aims to set out and explain the current status
and the planned trajectory of our ongoing work. It should help to
convey both what what we are working on and why we think it is
important. It is not heavy on technical details, but aims to give a
high level view of the project trajectory. For technical details,
please click thru to the tracking issues: they are are in varying
stages of discovery, but some are very well developed or provide a
view into the history of completed work on the milestone.
We will keep this document up to date and it will be revised as
needed, to keep our projections in line with our emerging
understanding, and to incorporate feedback and guidance from
interested stakeholders.
Support for the relocatable compiler in dune package management is now avai=
lable in dune 3.24
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=
=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=
=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=
=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=
=8C=E2=95=8C
As you will see on the roadmap, a substantial course of work led by
@Alizter, and supported by @ElectreAAS (among others), has made the
relocatable compiler available by default in dune package management,
building on even more substantial prior work by @dra27's. This makes
use of David's overlay compiler packages to provide relocatability for
previous recent compiler versions.
In my personal experience, this has made a decisive improvement in the
the UX of setting up projects with dune package management, and came
along with many additional fixes improving opam package compatibility.
As a very welcome bonus, dune package management now supports the
installation of packages that use symlinks in their sources!
Input and contributions
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=
=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C
Please feel free to share any input or raise any questions! Input can
be shared in this thread, or through our [documented channels for
feedback].
[documented channels for feedback]
<https://github.com/ocaml/dune/blob/main/CONTRIBUTING.md#sharing-feedback>
opam 2.6.0~alpha1
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=
=90
Archive: <https://discuss.ocaml.org/t/ann-opam-2-6-0-alpha1/18372/1>
Kate announced
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80
Hi everyone,
We are happy to announce the first alpha release of opam 2.6.0. This
is the culmination of 2 years of team work requiring large internal
changes, we hope you'll enjoy it.
This version is an alpha, we invite users to test it to spot
previously unnoticed bugs as we head towards the stable release.
What=E2=80=99s new? Some highlights:
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=
=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=
=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=
=E2=95=8C=E2=95=8C=E2=95=8C
=E2=80=A2 :money_bag: For people using the shell hooks, this release chan=
ged
the way `PATH' is kept up-to-date from opam taking priority over any
other elements of `PATH' by making sure to always be in front, to
replacing the directory managed by opam in-place, keeping the order
asked by the user. To benefit from this, make sure `opam init
--reinit -ni' was ran once after upgrading to this version
(automatically done by our install script if it detects an existing
opam installation). ([#6859], [#6815]). /Thanks to [@gridbugs] for
this contribution./
=E2=80=A2 :wastebasket: Reduce the disk space usage of opam by removing t=
he
`build' directory as soon as possible and removing redundant archive
caches. While the disk usage used by opam can be reduced over time
while simply reinstalling packages, you can liberate some free GB in
one go using `opam clean --all-switches'. ([#6440], [#4056],
[#5448])
=E2=80=A2 :high_speed_train: Improve performance drastically on certain
file-systems (e.g. NTFS on Windows or IO constrained machines) by
changing the format HTTP repositories such as opam.ocaml.org are
stored in internally. ([#6625], [#5346], [#5741], [#5648], [#5484],
[#5559], [#3050], [#6974]).
=E2=80=A2 :envelope_with_arrow: Add `root' and `rootexec' sections to
`.install' files to install files from the root prefix ([#6938],
[#6919]). *Thanks to [@WardBrian] for this contribution.*
=E2=80=A2 :woman_technologist: Add a new `--ignore-available-on' argument=
to
allow ignoring the `available:' field of certain packages ([#6836],
[#5283]). *Thanks once-again to [@WardBrian] for this contribution.*
=E2=80=A2 :ocean: Many more UI additions and improvements, bug fixes, =E2=
=80=A6
:open_book: You can read our [blog post] for more information about
these changes and more, and for even more details you can take a look
at the [release note] or the [changelog].
[#6859] <https://github.com/ocaml/opam/pull/6859>
[#6815] <https://github.com/ocaml/opam/issues/6815>
[@gridbugs] <https://github.com/gridbugs>
[#6440] <https://github.com/ocaml/opam/pull/6440>
[#4056] <https://github.com/ocaml/opam/issues/4056>
[#5448] <https://github.com/ocaml/opam/issues/5448>
[#6625] <https://github.com/ocaml/opam/pull/6625>
[#5346] <https://github.com/ocaml/opam/issues/5346>
[#5741] <https://github.com/ocaml/opam/issues/5741>
[#5648] <https://github.com/ocaml/opam/issues/5648>
[#5484] <https://github.com/ocaml/opam/issues/5484>
[#5559] <https://github.com/ocaml/opam/issues/5559>
[#3050] <https://github.com/ocaml/opam/issues/3050>
[#6974] <https://github.com/ocaml/opam/issues/6974>
[#6938] <https://github.com/ocaml/opam/pull/6938>
[#6919] <https://github.com/ocaml/opam/issues/6919>
[@WardBrian] <https://github.com/WardBrian>
[#6836] <https://github.com/ocaml/opam/pull/6836>
[#5283] <https://github.com/ocaml/opam/issues/5283>
[blog post] <https://opam.ocaml.org/blog/opam-2-6-0-alpha1/>
[release note] <https://github.com/ocaml/opam/releases/tag/2.6.0-alpha1>
[changelog] <https://github.com/ocaml/opam/blob/2.6.0-alpha1/CHANGES>
Try it!
=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C
The upgrade instructions are unchanged:
For Unix systems
=E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=82 bash -c "sh <(curl -fsSL https://opam.ocaml.org/install.sh) --v=
ersion 2.6.0~alpha1"
=E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80
or from PowerShell for Windows systems
=E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80
=E2=94=82 Invoke-Expression "& { $(Invoke-RestMethod https://opam.ocaml.o=
rg/install.ps1) } -Version 2.6.0~alpha1"
=E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80
Please report any issues to the [bug-tracker].
Happy hacking, <> <> The opam team <> <> :camel:
=E2=80=94 /Special thanks to the Haematology department and Bone Marrow
Transplant Unit of the NHS Greater Glasgow for making this release
possible <3/
[bug-tracker] <https://github.com/ocaml/opam/issues>
The little type that could too much
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=
=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=
=95=90=E2=95=90
Archive:
<https://discuss.ocaml.org/t/blog-the-little-type-that-could-too-much/183=
75/1>
Rapha=C3=ABl Proust announced
=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=
=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=
=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80
I wrote a small blog post about how some types are intended for
multiple use cases and it's not always grerat. It uses the Stdlib as a
small example in the intro, but the real focus is on Lwt.
<https://tech.ahrefs.com/the-little-type-that-could-too-much-3f21c2e80430>
Feedback (on the post or on the points of Lwt that are discussed) is
very welcome. I'll probably start working on improving the Lwt bits
soon so let me know what you think.
Old CWN
=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90
If you happen to miss a CWN, you can [send me a message] and I'll mail
it to you, or go take a look at [the archive] or the [RSS feed of the
archives].
If you also wish to receive it every week by mail, you may subscribe
to the [caml-list].
[Alan Schmitt]
[send me a message] <mailto:[email protected]>
[the archive] <https://alan.petitepomme.net/cwn/>
[RSS feed of the archives] <https://alan.petitepomme.net/cwn/cwn.rss>
[caml-list] <https://sympa.inria.fr/sympa/info/caml-list>
[Alan Schmitt] <https://alan.petitepomme.net/>
--==-=-=
Content-Type: text/html; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
<?xml version=3D"1.0" encoding=3D"utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns=3D"http://www.w3.org/1999/xhtml" lang=3D"en" xml:lang=3D"en">
<head>
<!-- 2026-07-21 Tue 18:01 -->
<meta http-equiv=3D"Content-Type" content=3D"text/html;charset=3Dutf-8" />
<meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=3D1"=
/>
<title>OCaml Weekly News</title>
<meta name=3D"generator" content=3D"Org Mode" />
<style type=3D"text/css">
#content { max-width: 60em; margin: auto; }
.title { text-align: center;
margin-bottom: .2em; }
.subtitle { text-align: center;
font-size: medium;
font-weight: bold;
margin-top:0; }
.todo { font-family: monospace; color: red; }
.done { font-family: monospace; color: green; }
.priority { font-family: monospace; color: orange; }
.tag { background-color: #eee; font-family: monospace;
padding: 2px; font-size: 80%; font-weight: normal; }
.timestamp { color: #bebebe; }
.timestamp-kwd { color: #5f9ea0; }
.org-right { margin-left: auto; margin-right: 0px; text-align: right; }
.org-left { margin-left: 0px; margin-right: auto; text-align: left; }
.org-center { margin-left: auto; margin-right: auto; text-align: center; }
.underline { text-decoration: underline; }
#postamble p, #preamble p { font-size: 90%; margin: .2em; }
p.verse { margin-left: 3%; }
pre {
border: 1px solid #e6e6e6;
border-radius: 3px;
background-color: #f2f2f2;
padding: 8pt;
font-family: monospace;
overflow: auto;
margin: 1.2em;
}
pre.src {
position: relative;
overflow: auto;
}
pre.src:before {
display: none;
position: absolute;
top: -8px;
right: 12px;
padding: 3px;
color: #555;
background-color: #f2f2f299;
}
pre.src:hover:before { display: inline; margin-top: 14px;}
/* Languages per Org manual */
pre.src-asymptote:before { content: 'Asymptote'; }
pre.src-awk:before { content: 'Awk'; }
pre.src-authinfo::before { content: 'Authinfo'; }
pre.src-c:before { content: 'C'; }
pre.src-C:before { content: 'C'; }
/* pre.src-C++ doesn't work in CSS */
pre.src-clojure:before { content: 'Clojure'; }
pre.src-css:before { content: 'CSS'; }
pre.src-D:before { content: 'D'; }
pre.src-ditaa:before { content: 'ditaa'; }
pre.src-dot:before { content: 'Graphviz'; }
pre.src-calc:before { content: 'Emacs Calc'; }
pre.src-emacs-lisp:before { content: 'Emacs Lisp'; }
pre.src-fortran:before { content: 'Fortran'; }
pre.src-gnuplot:before { content: 'gnuplot'; }
pre.src-haskell:before { content: 'Haskell'; }
pre.src-hledger:before { content: 'hledger'; }
pre.src-java:before { content: 'Java'; }
pre.src-js:before { content: 'JavaScript'; }
pre.src-latex:before { content: 'LaTeX'; }
pre.src-ledger:before { content: 'Ledger'; }
pre.src-lisp:before { content: 'Lisp'; }
pre.src-lilypond:before { content: 'Lilypond'; }
pre.src-lua:before { content: 'Lua'; }
pre.src-matlab:before { content: 'MATLAB'; }
pre.src-mscgen:before { content: 'Mscgen'; }
pre.src-ocaml:before { content: 'Objective Caml'; }
pre.src-octave:before { content: 'Octave'; }
pre.src-org:before { content: 'Org mode'; }
pre.src-oz:before { content: 'OZ'; }
pre.src-plantuml:before { content: 'Plantuml'; }
pre.src-processing:before { content: 'Processing.js'; }
pre.src-python:before { content: 'Python'; }
pre.src-R:before { content: 'R'; }
pre.src-ruby:before { content: 'Ruby'; }
pre.src-sass:before { content: 'Sass'; }
pre.src-scheme:before { content: 'Scheme'; }
pre.src-screen:before { content: 'Gnu Screen'; }
pre.src-sed:before { content: 'Sed'; }
pre.src-sh:before { content: 'shell'; }
pre.src-sql:before { content: 'SQL'; }
pre.src-sqlite:before { content: 'SQLite'; }
/* additional languages in org.el's org-babel-load-languages alist */
pre.src-forth:before { content: 'Forth'; }
pre.src-io:before { content: 'IO'; }
pre.src-J:before { content: 'J'; }
pre.src-makefile:before { content: 'Makefile'; }
pre.src-maxima:before { content: 'Maxima'; }
pre.src-perl:before { content: 'Perl'; }
pre.src-picolisp:before { content: 'Pico Lisp'; }
pre.src-scala:before { content: 'Scala'; }
pre.src-shell:before { content: 'Shell Script'; }
pre.src-ebnf2ps:before { content: 'ebfn2ps'; }
/* additional language identifiers per "defun org-babel-execute"
in ob-*.el */
pre.src-cpp:before { content: 'C++'; }
pre.src-abc:before { content: 'ABC'; }
pre.src-coq:before { content: 'Coq'; }
pre.src-groovy:before { content: 'Groovy'; }
/* additional language identifiers from org-babel-shell-names in
ob-shell.el: ob-shell is the only babel language using a lambda to put
the execution function name together. */
pre.src-bash:before { content: 'bash'; }
pre.src-csh:before { content: 'csh'; }
pre.src-ash:before { content: 'ash'; }
pre.src-dash:before { content: 'dash'; }
pre.src-ksh:before { content: 'ksh'; }
pre.src-mksh:before { content: 'mksh'; }
pre.src-posh:before { content: 'posh'; }
/* Additional Emacs modes also supported by the LaTeX listings package */
pre.src-ada:before { content: 'Ada'; }
pre.src-asm:before { content: 'Assembler'; }
pre.src-caml:before { content: 'Caml'; }
pre.src-delphi:before { content: 'Delphi'; }
pre.src-html:before { content: 'HTML'; }
pre.src-idl:before { content: 'IDL'; }
pre.src-mercury:before { content: 'Mercury'; }
pre.src-metapost:before { content: 'MetaPost'; }
pre.src-modula-2:before { content: 'Modula-2'; }
pre.src-pascal:before { content: 'Pascal'; }
pre.src-ps:before { content: 'PostScript'; }
pre.src-prolog:before { content: 'Prolog'; }
pre.src-simula:before { content: 'Simula'; }
pre.src-tcl:before { content: 'tcl'; }
pre.src-tex:before { content: 'TeX'; }
pre.src-plain-tex:before { content: 'Plain TeX'; }
pre.src-verilog:before { content: 'Verilog'; }
pre.src-vhdl:before { content: 'VHDL'; }
pre.src-xml:before { content: 'XML'; }
pre.src-nxml:before { content: 'XML'; }
/* add a generic configuration mode; LaTeX export needs an additional
(add-to-list 'org-latex-listings-langs '(conf " ")) in .emacs */
pre.src-conf:before { content: 'Configuration File'; }
table { border-collapse:collapse; }
caption.t-above { caption-side: top; }
caption.t-bottom { caption-side: bottom; }
td, th { vertical-align:top; }
th.org-right { text-align: center; }
th.org-left { text-align: center; }
th.org-center { text-align: center; }
td.org-right { text-align: right; }
td.org-left { text-align: left; }
td.org-center { text-align: center; }
dt { font-weight: bold; }
.footpara { display: inline; }
.footdef { margin-bottom: 1em; }
.figure { padding: 1em; }
.figure p { text-align: center; }
.equation-container {
display: table;
text-align: center;
width: 100%;
}
.equation {
vertical-align: middle;
}
.equation-label {
display: table-cell;
text-align: right;
vertical-align: middle;
}
.inlinetask {
padding: 10px;
border: 2px solid gray;
margin: 10px;
background: #ffffcc;
}
#org-div-home-and-up
{ text-align: right; font-size: 70%; white-space: nowrap; }
textarea { overflow-x: auto; }
.linenr {
font-size: smaller;
@supports (content: attr(data-linenr)) {
visibility: hidden;
&::before { content: attr(data-linenr); visibility: visible; }
}
}
.code-highlighted { background-color: #ffff00; }
.org-info-js_info-navigation { border-style: none; }
#org-info-js_console-label
{ font-size: 10px; font-weight: bold; white-space: nowrap; }
.org-info-js_search-highlight
{ background-color: #ffff00; color: #000000; font-weight: bold; }
.org-svg { }
</style>
<style type=3D"text/css">#table-of-contents h2 { display: none } .title { d=
isplay: none } .authorname { text-align: right }</style>
<style type=3D"text/css">.outline-2 {border-top: 1px solid black;}</style>
</head>
<body>
<div id=3D"content" class=3D"content">
<h1 class=3D"title">OCaml Weekly News</h1>
<p>
<a href=3D"https://alan.petitepomme.net/cwn/2026.07.14.html">Previous Week<=
/a> <a href=3D"https://alan.petitepomme.net/cwn/index.html">Up</a> <a href=
=3D"https://alan.petitepomme.net/cwn/2026.07.28.html">Next Week</a>
</p>
<p>
Hello
</p>
<p>
Here is the latest OCaml Weekly News, for the week of July 14 to 21, 2026.
</p>
<div id=3D"table-of-contents" role=3D"doc-toc">
<h2>Table of Contents</h2>
<div id=3D"text-table-of-contents" role=3D"doc-toc">
<ul>
<li><a href=3D"#1">ocamlgrep 0.1.1</a></li>
<li><a href=3D"#2">MirageOS on Unikraft</a></li>
<li><a href=3D"#3">ppx_deriving_melange 0.1.0 - eq, ord, show, map, iter de=
rivers for Melange</a></li>
<li><a href=3D"#4">hegel 0.12.1</a></li>
<li><a href=3D"#5">A small extension of Bigarray.Genarray adding iteration,=
mapping and folding</a></li>
<li><a href=3D"#6">OCaml Security Team, report for first half of 2026</a></=
li>
<li><a href=3D"#7">Dune Package Management Updates</a></li>
<li><a href=3D"#8">opam 2.6.0~alpha1</a></li>
<li><a href=3D"#9">The little type that could too much</a></li>
<li><a href=3D"#orgb4b9601">Old CWN</a></li>
</ul>
</div>
</div>
<div id=3D"outline-container-1" class=3D"outline-2">
<h2 id=3D"1">ocamlgrep 0.1.1</h2>
<div class=3D"outline-text-2" id=3D"text-1">
<p>
Archive: <a href=3D"https://discuss.ocaml.org/t/ann-ocamlgrep-0-1-1/18350/1=
">https://discuss.ocaml.org/t/ann-ocamlgrep-0-1-1/18350/1</a>
</p>
</div>
<div id=3D"outline-container-org50f6d62" class=3D"outline-3">
<h3 id=3D"org50f6d62">Nicolas Ojeda Bar announced</h3>
<div class=3D"outline-text-3" id=3D"text-org50f6d62">
<p>
We are happy to announce the first public release of <code>ocamlgrep</code>=
, a tool for structural grepping of OCaml code.
</p>
<p>
This tool has existed within the walls of LexiFi for a long time and we wer=
e keen on open-sourcing it, but it was not in a form that could be used by =
the wider public. Now, thanks to the work of @mjambon, we are able to to fi=
nally do so.
</p>
<p>
<a href=3D"https://github.com/LexiFi/ocamlgrep/releases/tag/0.1.1">https://=
github.com/LexiFi/ocamlgrep/releases/tag/0.1.1</a>
</p>
<p>
To install:
</p>
<pre class=3D"example" id=3D"org327ec60">
$ opam install ocamlgrep
</pre>
<p>
The idea behind the tool is simple: you call it from within your Dune proje=
ct[^1] with a query (after having built all <code>.cmt~/</code>.cmti~ artif=
acts, eg by doing <code>dune build @check</code>), and the tool returns the=
list of matches it can find in the source tree. A <span class=3D"underline=
">query</span> is syntactically an OCaml expression, possibly with <span cl=
ass=3D"underline">holes</span> <code>__</code> in it. Some examples follow =
to give an idea of how the tool is used in practice.
</p>
<p>
The following query searches for the anti-pattern <code>List.rev e1 @ e2</c=
ode> (where <code>e1</code> and <code>e2</code> are arbitrary expressions.
</p>
<pre class=3D"example" id=3D"org5ed574d">
$ ocamlgrep 'List.rev __ @ __`
</pre>
<p>
NoteNote that as the tool works at the level of the OCaml AST, it will also=
match expressions of the form <code>(@) (e1 |> List.rev) e2</code>, sin=
ce they produce the same AST.
</p>
<p>
The syntax of type constraints <code>(e : ty)</code> is overloaded to impos=
e a type condition on the search term. For example, the following search qu=
ery looks for function calls where the first argument is an <code>int</code=
> and the second one a <code>string</code>.
</p>
<pre class=3D"example" id=3D"orgd45ef73">
$ ocamlgrep '__ (__ : int) (__ : string)'
</pre>
<p>
The <span class=3D"underline">holes</span> can be numbered, <code>__1</code=
>, <code>__2</code>, etc, to express repetitions of the same term. For exam=
ple, the following query searches for a pattern matching on an option that =
sends <code>Some x</code> to <code>Some x</code> (ie reconstructing the sam=
e value):
</p>
<pre class=3D"example" id=3D"orgd70c3d8">
$ ocamlgrep 'match __ with Some __1 -> Some __1 | None -> __'
</pre>
<p>
We can also look for applications of the polymorphic operator <code>=3D</co=
de> applied to <code>float</code> arguments:
</p>
<pre class=3D"example" id=3D"orgf4e3e89">
$ ocamlgrep '(__ : float) =3D __'
</pre>
<p>
Historically, this tool has been useful for large-scale refactorings and li=
nting of our codebase. Nowadays, such refactorings can often be done using =
AI agents. However, the tool is still able to do things that seem a bit bey=
ond of what AI agents can do today, eg to look for applications of polymorp=
hic functions where one of the arguments is of a specific type. This was fo=
r example useful when <a href=3D"https://www.lexifi.com/blog/ocaml/floatarr=
ay-migration/">migrating</a> our codebase to <code>no-flat-float-array</cod=
e> mode, where we wanted to make sure that polymorphic array operations wer=
e not being applied to <code>float array</code> values.
</p>
<p>
Happy grepping!
</p>
<p>
Cheers,
Nicolas
</p>
<p>
[^1]: Only Dune projects are supported for now. Adding support for other bu=
ild systems should not be very hard, issues and/or PRs are welcome.
</p>
</div>
</div>
</div>
<div id=3D"outline-container-2" class=3D"outline-2">
<h2 id=3D"2">MirageOS on Unikraft</h2>
<div class=3D"outline-text-2" id=3D"text-2">
<p>
Archive: <a href=3D"https://discuss.ocaml.org/t/mirageos-on-unikraft/16975/=
3">https://discuss.ocaml.org/t/mirageos-on-unikraft/16975/3</a>
</p>
</div>
<div id=3D"outline-container-org6490197" class=3D"outline-3">
<h3 id=3D"org6490197">Continuing this thread, shym announced</h3>
<div class=3D"outline-text-3" id=3D"text-org6490197">
<p>
I=E2=80=99m happy to announce that OCaml/Unikraft 1.2.0 <a href=3D"https://=
github.com/ocaml/opam-repository/pull/30209">has been released</a> with:
</p>
<ul class=3D"org-ul">
<li>support for OCaml 5.4.1 and 5.5.0,</li>
<li>a way to use fine-tuned Unikraft configurations when that=E2=80=99s nee=
ded,</li>
<li>a new version number scheme for some of the packages, to combine the OC=
aml/Unikraft version with the underlying Unikraft version.</li>
</ul>
<p>
Happy unikerneling!
</p>
</div>
</div>
</div>
<div id=3D"outline-container-3" class=3D"outline-2">
<h2 id=3D"3">ppx_deriving_melange 0.1.0 - eq, ord, show, map, iter derivers=
for Melange</h2>
<div class=3D"outline-text-2" id=3D"text-3">
<p>
Archive: <a href=3D"https://discuss.ocaml.org/t/ann-ppx-deriving-melange-0-=
1-0-eq-ord-show-map-iter-derivers-for-melange/18352/1">https://discuss.ocam=
l.org/t/ann-ppx-deriving-melange-0-1-0-eq-ord-show-map-iter-derivers-for-me=
lange/18352/1</a>
</p>
</div>
<div id=3D"outline-container-orgda169eb" class=3D"outline-3">
<h3 id=3D"orgda169eb">Atlas07 announced</h3>
<div class=3D"outline-text-3" id=3D"text-orgda169eb">
<p>
Hi everyone,
</p>
<p>
I'm happy to announce the first release of <b>ppx_deriving_melange</b>, a M=
elange-compatible subset of <code>ppx_deriving</code>: <a href=3D"https://g=
ithub.com/ahrefs/ppx_deriving_melange">https://github.com/ahrefs/ppx_derivi=
ng_melange</a>
</p>
</div>
<div id=3D"outline-container-orga372e5b" class=3D"outline-4">
<h4 id=3D"orga372e5b">Why</h4>
<div class=3D"outline-text-4" id=3D"text-orga372e5b">
<p>
The original <code>ppx_deriving</code> can't support Melange: it predates d=
une's Melange integration =E2=80=94 it is distributed through findlib META =
files, and its generated code depends on a runtime library that isn't built=
in Melange mode. Melange can only link libraries that dune builds for it, =
so common patterns like <code>\[@@deriving eq, show\]</code> were off the t=
able when writing frontend OCaml.
</p>
<p>
<code>ppx_deriving_melange</code> fills that gap: same derivers, same namin=
g conventions and attributes, implemented on ppxlib and tested against Mela=
nge =E2=80=94 and its generated code is self-contained, so nothing extra ne=
eds to link into your bundle.
</p>
<p>
A key use case is <b>universal code</b> =E2=80=94 libraries compiled both n=
atively and to JavaScript. Put your shared types in a library with <code>(m=
odes :standard melange)</code>, derive once, and the exact same <code>equal=
~/~compare~/~show</code> functions run on the server and in the browser. (T=
his is how the project tests itself: one test-case library exercised by OUn=
it natively and by node on the Melange side.)
</p>
</div>
</div>
<div id=3D"outline-container-org4c79d8e" class=3D"outline-4">
<h4 id=3D"org4c79d8e">What you get</h4>
<div class=3D"outline-text-4" id=3D"text-org4c79d8e">
<div class=3D"org-src-container">
<pre class=3D"src src-ocaml"><code><span style=3D"color: #242521; font-weig=
ht: bold;">type</span> <span style=3D"color: #444fcf; font-weight: bold;">u=
ser</span> =3D {
name : string;
roles : string list;
}
<span style=3D"color: #a7601f;">[@@deriving eq, ord, show]</span>
<span style=3D"color: #8f6f4a; font-style: italic;">(* </span><span style=
=3D"color: #8f6f4a; font-style: italic;">generates:</span>
<span style=3D"color: #8f6f4a; font-style: italic;"> val equal_user : use=
r -> user -> bool</span>
<span style=3D"color: #8f6f4a; font-style: italic;"> val compare_user : u=
ser -> user -> int</span>
<span style=3D"color: #8f6f4a; font-style: italic;"> val pp_user : Format=
.formatter -> user -> unit</span>
<span style=3D"color: #8f6f4a; font-style: italic;"> val show_user : user=
-> string</span><span style=3D"color: #8f6f4a; font-style: italic;"> *)=
</span>
</code></pre>
</div>
<p>
Supported derivers in 0.1.0: <code>eq</code>, <code>iter</code>, <code>map<=
/code>, <code>ord</code>, and <code>show</code>, following the native <code=
>ppx_deriving</code> conventions =E2=80=94 including the <code>equal</code>=
, <code>compare</code>, and <code>printer</code> attribute overrides, the <=
code>with_path</code> option for <code>show</code>, tuples, records, (polym=
orphic) variants, options, lists, arrays, results, type parameters, and rec=
ursive type groups. The README documents the exact supported scope of each =
deriver.
</p>
<p>
Two design points worth calling out:
</p>
<ul class=3D"org-ul">
<li><b>Self-contained generated code.</b> There is no runtime library: the =
generated functions only use the stdlib, so the ppx is a build-time depende=
ncy only.</li>
<li><b>Bundle-size-aware <code>show</code>.</b> Melange compiles <code>Stdl=
ib.Format</code> into a lot of JavaScript, so <code>show</code> builds its =
string directly and only falls back to <code>Format</code> where the type r=
equires it (custom printers, etc.). Code that only calls <code>show</code> =
doesn't pull Format into your bundle; <code>pp</code> stays fully Format-ba=
sed and native-compatible.</li>
</ul>
</div>
</div>
<div id=3D"outline-container-org93c20b4" class=3D"outline-4">
<h4 id=3D"org93c20b4">What's not there (yet)</h4>
<div class=3D"outline-text-4" id=3D"text-org93c20b4">
<p>
Some <code>ppx_deriving</code> derivers aren't implemented yet (<code>enum<=
/code>, <code>fold</code>, <code>make</code>, …), and a few type sha=
pes are out of scope for now (<code>ref</code>, <code>lazy_t</code>, <code>=
nativeint</code>, functor-applied types). If you need one of these =E2=80=
=94 or hit anything that behaves differently from native <code>ppx_deriving=
</code> =E2=80=94 please open an issue; that's exactly the feedback that wi=
ll drive what gets built next.
</p>
</div>
</div>
<div id=3D"outline-container-orgaef545c" class=3D"outline-4">
<h4 id=3D"orgaef545c">Using it</h4>
<div class=3D"outline-text-4" id=3D"text-orgaef545c">
<pre class=3D"example" id=3D"org637a624">
opam install ppx_deriving_melange
</pre>
<pre class=3D"example" id=3D"org76b55b8">
(library
(name my_frontend_lib)
(modes melange)
(preprocess
(pps ppx_deriving_melange)))
</pre>
<p>
Thanks to the <code>ppx_deriving</code> authors =E2=80=94 this project foll=
ows their design and behavior closely, and includes their license attributi=
on =E2=80=94 and to <a href=3D"https://github.com/davesnx">davesnx</a> for =
reviews and encouragement along the way.
</p>
<p>
Feedback, issues, and deriver requests very welcome!
</p>
</div>
</div>
</div>
</div>
<div id=3D"outline-container-4" class=3D"outline-2">
<h2 id=3D"4">hegel 0.12.1</h2>
<div class=3D"outline-text-2" id=3D"text-4">
<p>
Archive: <a href=3D"https://discuss.ocaml.org/t/ann-hegel-0-12-1/18358/1">h=
ttps://discuss.ocaml.org/t/ann-hegel-0-12-1/18358/1</a>
</p>
</div>
<div id=3D"outline-container-orgc7e2a41" class=3D"outline-3">
<h3 id=3D"orgc7e2a41">Ethan Chou announced</h3>
<div class=3D"outline-text-3" id=3D"text-orgc7e2a41">
<p>
Hello! I work at <a href=3D"https://antithesis.com">Antithesis</a>, a deter=
ministic simulation testing startup.
</p>
<p>
Recently, we released Hegel for OCaml.
</p>
<p>
Hegel is a family of PBT libraries based on Hypothesis, providing powerful,=
ergonomic property-based testing for many different languages. Hegel lets =
you declare data generation inline with your test code, and provides native=
support for stateful testing.
</p>
<p>
The installation instructions can be found at the Github repository <a href=
=3D"https://github.com/hegeldev/hegel-ocaml">here</a>. Click on the link in=
the about section in the repository to see the documentation sorry, I can'=
t post more than two links yet). We encourage people to contribute!
</p>
<p>
Here's an example Hegel test:
</p>
<div class=3D"org-src-container">
<pre class=3D"src src-ocaml"><code><span style=3D"color: #242521; font-weig=
ht: bold;">let</span> <span style=3D"color: #a7601f;">bad_map</span> <span =
style=3D"color: #007a9f;">_</span> <span style=3D"color: #007a9f;">xs</span=
> =3D xs
<span style=3D"color: #242521; font-weight: bold;">let</span><span style=3D=
"color: #a7601f;">%hegel_test</span> <span style=3D"color: #a7601f;">bad_ma=
p_vs_map</span> <span style=3D"color: #007a9f;">tc</span> =3D
<span style=3D"color: #242521; font-weight: bold;">let</span> <span style=
=3D"color: #007a9f;">int_gen</span> =3D integers () <span style=3D"color: #=
242521; font-weight: bold;">in</span>
<span style=3D"color: #242521; font-weight: bold;">let</span> <span style=
=3D"color: #007a9f;">int_fn_gen</span> =3D functions <span style=3D"color: =
#444fcf; font-weight: bold;">~sexp_of_arg</span>:<span style=3D"color: #557=
400; font-weight: bold;">Core.Int.</span>sexp_of_t <span style=3D"color: #4=
44fcf; font-weight: bold;">~returns</span>:int_gen () <span style=3D"color:=
#242521; font-weight: bold;">in</span>
<span style=3D"color: #242521; font-weight: bold;">let</span> <span style=
=3D"color: #007a9f;">f</span> =3D draw_silent tc int_fn_gen
<span style=3D"color: #242521; font-weight: bold;">and</span> <span style=
=3D"color: #007a9f;">xs</span> =3D draw tc (lists int_gen ()) <span style=
=3D"color: #242521; font-weight: bold;">in</span>
require_equal
tc
(<span style=3D"color: #557400; font-weight: bold;">Core.List.</span>se=
xp_of_t <span style=3D"color: #557400; font-weight: bold;">Core.Int.</span>=
sexp_of_t)
(bad_map f xs) (<span style=3D"color: #557400; font-weight: bold;">List=
.</span>map f xs)
</code></pre>
</div>
<p>
prints (with colors in the terminal):
</p>
<pre class=3D"example" id=3D"org229cc5a">
=2D-- Failure: bad_map_vs_map (examples/higher_order.ml:20) --------------
Falsified after 2 test cases (0 discarded):
xs =3D (0)
f 0 =3D 1
require_equal: values differ (- lhs / + rhs):
(0) (1)
Exception: Failure("require_equal: values differ")
rerun with: [@@failure_blobs [ "AAQAAAABAQAKAQAAAAABAAAKAQAAAAE=3D" ]]
</pre>
<p>
Happy testing!
</p>
</div>
</div>
</div>
<div id=3D"outline-container-5" class=3D"outline-2">
<h2 id=3D"5">A small extension of Bigarray.Genarray adding iteration, mappi=
ng and folding</h2>
<div class=3D"outline-text-2" id=3D"text-5">
<p>
Archive: <a href=3D"https://discuss.ocaml.org/t/ann-a-small-extension-of-bi=
garray-genarray-adding-iteration-mapping-and-folding/15005/7">https://discu=
ss.ocaml.org/t/ann-a-small-extension-of-bigarray-genarray-adding-iteration-=
mapping-and-folding/15005/7</a>
</p>
</div>
<div id=3D"outline-container-org265bcb7" class=3D"outline-3">
<h3 id=3D"org265bcb7">Continuing this thread, NAlec announced</h3>
<div class=3D"outline-text-3" id=3D"text-org265bcb7">
<p>
Just to let you know, it is now available as <a href=3D"https://ocaml.org/p=
/GenArrayIter/latest">GenArrayIter</a> opam package. PR welcome of course.=
=20
Documentation <a href=3D"https://heyji2.github.io/GenArrayIter/GenArrayIter=
/GenArrayIter/Iter/index.html">here</a>
</p>
</div>
</div>
</div>
<div id=3D"outline-container-6" class=3D"outline-2">
<h2 id=3D"6">OCaml Security Team, report for first half of 2026</h2>
<div class=3D"outline-text-2" id=3D"text-6">
<p>
Archive: <a href=3D"https://discuss.ocaml.org/t/ocaml-security-team-report-=
for-first-half-of-2026/18366/1">https://discuss.ocaml.org/t/ocaml-security-=
team-report-for-first-half-of-2026/18366/1</a>
</p>
</div>
<div id=3D"outline-container-org6cac63f" class=3D"outline-3">
<h3 id=3D"org6cac63f">Hannes Mehnert announced</h3>
<div class=3D"outline-text-3" id=3D"text-org6cac63f">
<p>
Throughout the first half of 2026, the security team has worked on security=
advisories: the publishing pipeline (from report over communication and fi=
xes, to the security vulnerability database - these days osv.dev and CVE).
</p>
<p>
The team consists of:
</p>
<ul class=3D"org-ul">
<li>Hannes Mehnert - @hannesm - individual, robur.coop</li>
<li>Mindy Preston - @yomimono - individual</li>
<li>Joe - @cfcs - individual</li>
<li>Edwin T=C3=B6r=C3=B6k - @edwintorok - individual, Tarides</li>
<li>Nicol=C3=A1s Ojeda B=C3=A4r - @nojb - LexiFi</li>
<li>Louis Roch=C3=A9 - @Khady - ahrefs</li>
<li>Boning Dong - @bn-d - Bloomberg</li>
</ul>
</div>
<div id=3D"outline-container-orgf43519b" class=3D"outline-4">
<h4 id=3D"orgf43519b">Vulnerability Database</h4>
<div class=3D"outline-text-4" id=3D"text-orgf43519b">
<p>
The public vulnerability database (<a href=3D"https://github.com/ocaml/secu=
rity-advisories">https://github.com/ocaml/security-advisories</a>) is estab=
lished, and filled as well with old security advisories (from the MirageOS =
project, etc.). There is tooling via CI which generates a branch "generated=
-osv", which is a source for the Open Source Vulnerability database (<a hre=
f=3D"https://osv.dev">https://osv.dev</a>), run by Google. The direct link =
for all security advisories of the OCaml Security team is <a href=3D"https:=
//osv.dev/list?ecosystem=3Dopam">here</a>.
</p>
<p>
The tooling is available from <a href=3D"https://github.com/hannesm/advisor=
ies">https://github.com/hannesm/advisories</a>.
</p>
</div>
</div>
<div id=3D"outline-container-org88c0da9" class=3D"outline-4">
<h4 id=3D"org88c0da9">Audit Tooling</h4>
<div class=3D"outline-text-4" id=3D"text-org88c0da9">
<p>
Another utility to check your "opam switch" for installed vulnerable packag=
es (using the above mentioned vulnerability database), has been developed -=
available at <a href=3D"https://github.com/hannesm/opam-audit">https://git=
hub.com/hannesm/opam-audit</a>.
</p>
</div>
</div>
<div id=3D"outline-container-org89330ee" class=3D"outline-4">
<h4 id=3D"org89330ee">Public Meetings</h4>
<div class=3D"outline-text-4" id=3D"text-org89330ee">
<p>
On March 19th a public OCaml security meeting took place with 10 attendees.=
The meeting notes are available at <a href=3D"https://pad.data.coop/7-Ic5r=
G6ToynsW02hJsndg">https://pad.data.coop/7-Ic5rG6ToynsW02hJsndg</a>
</p>
</div>
</div>
<div id=3D"outline-container-org4213413" class=3D"outline-4">
<h4 id=3D"org4213413">Modification Policy of the opam-repository</h4>
<div class=3D"outline-text-4" id=3D"text-org4213413">
<p>
The Security Team proposed to make the immutability policy stricter (see <a=
href=3D"https://github.com/ocaml/opam-repository/pull/29072">https://githu=
b.com/ocaml/opam-repository/pull/29072</a>) - which has been merged. So, an=
y published opam package must not modify its sources (change tarball, add p=
atches, modify build instructions, …). Instead, a new version must b=
e published. This makes the package URL (<a href=3D"https://github.com/pack=
age-url/purl-spec">https://github.com/package-url/purl-spec</a>) sensible a=
nd point to a precise source.
</p>
</div>
</div>
<div id=3D"outline-container-orgff9da31" class=3D"outline-4">
<h4 id=3D"orgff9da31">Grant Proposals</h4>
<div class=3D"outline-text-4" id=3D"text-orgff9da31">
<p>
A call for contributions was opened until end of March 2026. The Security T=
eam is impressed by the amount and quality of the proposals. Evaluation and=
finding funding for proposals is still ongoing. We have some preliminary d=
ecisions and will reach out to the applicants by the end of July 2026.
</p>
</div>
</div>
<div id=3D"outline-container-orgbc91378" class=3D"outline-4">
<h4 id=3D"orgbc91378">Advisories</h4>
<div class=3D"outline-text-4" id=3D"text-orgbc91378">
<p>
So far, there have been 10 advisories (OSEC-2026-01 until OSEC-2026-10) pub=
lished, and some more are worked on. Our primary communication channel is e=
mail, and we reach out to reports that we received GitHub by email. A <a hr=
ef=3D"https://sympa.inria.fr/sympa/info/ocsf-ocaml-security-announcements">=
public mailing list</a> is available where security advisories are announce=
d.
</p>
<p>
They range from issues in the OCaml runtime (Marshal buffer over-read OSEC-=
2026-01 CVE-2026-28364, Bigarray.reshape interger overflow OSEC-2026-04 CVE=
-2026-34353, command injection on Windows via filename OSEC-2026-05 CVE-202=
6-41083), opam sandbox escape (OSEC-2026-03 CVE-2026-41082, OSEC-2026-10 CV=
E-2026-57825), insufficient certificate property checks (in tls, OSEC-2026-=
06 CVE-2026-45388, OSEC-2026-07 CVE-2026-45389), path traversal (in tar, OS=
EC-2026-08 CVE-2026-45390), memory exhaustion (unbounded memory usage in ar=
p, OSEC-2026-02, infinite loop in albatross-console, OSEC-2026-09).
</p>
<p>
The variety of reporters - 8 different people in 10 reports - is amazing. T=
hanks to all reporters, as well as the upstream developers. It has been a p=
leasure to coordinate the vulnerabilities.
</p>
</div>
</div>
<div id=3D"outline-container-orgf7ef2c3" class=3D"outline-4">
<h4 id=3D"orgf7ef2c3">Future Plans</h4>
<div class=3D"outline-text-4" id=3D"text-orgf7ef2c3">
<p>
The Security Team also hopes to publish security guides for OCaml programme=
rs and project maintainers.
</p>
</div>
</div>
<div id=3D"outline-container-org5fef0d3" class=3D"outline-4">
<h4 id=3D"org5fef0d3">Acknowledgements</h4>
<div class=3D"outline-text-4" id=3D"text-org5fef0d3">
<p>
The Security Team is an initiative of the OCaml Software Foundation and is =
grateful to the OCSF and its sponsors for their support.
</p>
</div>
</div>
</div>
</div>
<div id=3D"outline-container-7" class=3D"outline-2">
<h2 id=3D"7">Dune Package Management Updates</h2>
<div class=3D"outline-text-2" id=3D"text-7">
<p>
Archive: <a href=3D"https://discuss.ocaml.org/t/dune-package-management-upd=
ates/18023/2">https://discuss.ocaml.org/t/dune-package-management-updates/1=
8023/2</a>
</p>
</div>
<div id=3D"outline-container-orga26a901" class=3D"outline-3">
<h3 id=3D"orga26a901">Continuing this thread, Shon announced</h3>
<div class=3D"outline-text-3" id=3D"text-orga26a901">
<p>
Hello! We have just made our roadmap for dune package management available =
on the wiki for dune: <a href=3D"https://github.com/ocaml/dune/wiki/Dune-Pk=
g-Roadmap">https://github.com/ocaml/dune/wiki/Dune-Pkg-Roadmap</a>.
</p>
</div>
<div id=3D"outline-container-org52d6831" class=3D"outline-4">
<h4 id=3D"org52d6831">About the roadmap</h4>
<div class=3D"outline-text-4" id=3D"text-org52d6831">
<p>
This living document aims to set out and explain the current status and the=
planned trajectory of our ongoing work. It should help to convey both what=
what we are working on and why we think it is important. It is not heavy o=
n technical details, but aims to give a high level view of the project traj=
ectory. For technical details, please click thru to the tracking issues: th=
ey are are in varying stages of discovery, but some are very well developed=
or provide a view into the history of completed work on the milestone.
</p>
<p>
We will keep this document up to date and it will be revised as needed, to =
keep our projections in line with our emerging understanding, and to incorp=
orate feedback and guidance from interested stakeholders.
</p>
</div>
</div>
<div id=3D"outline-container-org580f926" class=3D"outline-4">
<h4 id=3D"org580f926">Support for the relocatable compiler in dune package =
management is now available in dune 3.24</h4>
<div class=3D"outline-text-4" id=3D"text-org580f926">
<p>
As you will see on the roadmap, a substantial course of work led by @Alizte=
r, and supported by @ElectreAAS (among others), has made the relocatable co=
mpiler available by default in dune package management, building on even mo=
re substantial prior work by @dra27's. This makes use of David's overlay c=
ompiler packages to provide relocatability for previous recent compiler ver=
sions.=20
</p>
<p>
In my personal experience, this has made a decisive improvement in the the =
UX of setting up projects with dune package management, and came along with=
many additional fixes improving opam package compatibility.
</p>
<p>
As a very welcome bonus, dune package management now supports the installat=
ion of packages that use symlinks in their sources!
</p>
</div>
</div>
<div id=3D"outline-container-org91963af" class=3D"outline-4">
<h4 id=3D"org91963af">Input and contributions</h4>
<div class=3D"outline-text-4" id=3D"text-org91963af">
<p>
Please feel free to share any input or raise any questions! Input can be sh=
ared in this thread, or through our <a href=3D"https://github.com/ocaml/dun=
e/blob/main/CONTRIBUTING.md#sharing-feedback">documented channels for feedb=
ack</a>.
</p>
</div>
</div>
</div>
</div>
<div id=3D"outline-container-8" class=3D"outline-2">
<h2 id=3D"8">opam 2.6.0~alpha1</h2>
<div class=3D"outline-text-2" id=3D"text-8">
<p>
Archive: <a href=3D"https://discuss.ocaml.org/t/ann-opam-2-6-0-alpha1/18372=
/1">https://discuss.ocaml.org/t/ann-opam-2-6-0-alpha1/18372/1</a>
</p>
</div>
<div id=3D"outline-container-org5eb653a" class=3D"outline-3">
<h3 id=3D"org5eb653a">Kate announced</h3>
<div class=3D"outline-text-3" id=3D"text-org5eb653a">
<p>
Hi everyone,
</p>
<p>
We are happy to announce the first alpha release of opam 2.6.0. This is the=
culmination of 2 years of team work requiring large internal changes, we h=
ope you'll enjoy it.
</p>
<p>
This version is an alpha, we invite users to test it to spot previously unn=
oticed bugs as we head towards the stable release.
</p>
</div>
<div id=3D"outline-container-org2325d6a" class=3D"outline-4">
<h4 id=3D"org2325d6a">What=E2=80=99s new? Some highlights:</h4>
<div class=3D"outline-text-4" id=3D"text-org2325d6a">
<ul class=3D"org-ul">
<li>:money_bag: For people using the shell hooks, this release changed the =
way <code>PATH</code> is kept up-to-date from opam taking priority over any=
other elements of <code>PATH</code> by making sure to always be in front, =
to replacing the directory managed by opam in-place, keeping the order aske=
d by the user. To benefit from this, make sure <code>opam init --reinit -ni=
</code> was ran once after upgrading to this version (automatically done by=
our install script if it detects an existing opam installation). (<a href=
=3D"https://github.com/ocaml/opam/pull/6859">#6859</a>, <a href=3D"https://=
github.com/ocaml/opam/issues/6815">#6815</a>). <i>Thanks to <a href=3D"http=
s://github.com/gridbugs">@gridbugs</a> for this contribution.</i></li>
<li>:wastebasket: Reduce the disk space usage of opam by removing the <code=
>build</code> directory as soon as possible and removing redundant archive =
caches. While the disk usage used by opam can be reduced over time while si=
mply reinstalling packages, you can liberate some free GB in one go using <=
code>opam clean --all-switches</code>. (<a href=3D"https://github.com/ocaml=
/opam/pull/6440">#6440</a>, <a href=3D"https://github.com/ocaml/opam/issues=
/4056">#4056</a>, <a href=3D"https://github.com/ocaml/opam/issues/5448">#54=
48</a>)</li>
<li>:high_speed_train: Improve performance drastically on certain file-syst=
ems (e.g. NTFS on Windows or IO constrained machines) by changing the forma=
t HTTP repositories such as opam.ocaml.org are stored in internally. (<a hr=
ef=3D"https://github.com/ocaml/opam/pull/6625">#6625</a>, <a href=3D"https:=
//github.com/ocaml/opam/issues/5346">#5346</a>, <a href=3D"https://github.c=
om/ocaml/opam/issues/5741">#5741</a>, <a href=3D"https://github.com/ocaml/o=
pam/issues/5648">#5648</a>, <a href=3D"https://github.com/ocaml/opam/issues=
/5484">#5484</a>, <a href=3D"https://github.com/ocaml/opam/issues/5559">#55=
59</a>, <a href=3D"https://github.com/ocaml/opam/issues/3050">#3050</a>, <a=
href=3D"https://github.com/ocaml/opam/issues/6974">#6974</a>).</li>
<li>:envelope_with_arrow: Add <code>root</code> and <code>rootexec</code> s=
ections to <code>.install</code> files to install files from the root prefi=
x (<a href=3D"https://github.com/ocaml/opam/pull/6938">#6938</a>, <a href=
=3D"https://github.com/ocaml/opam/issues/6919">#6919</a>). <b>Thanks to <a =
href=3D"https://github.com/WardBrian">@WardBrian</a> for this contribution.=
</b></li>
<li>:woman_technologist: Add a new <code>--ignore-available-on</code> argum=
ent to allow ignoring the <code>available:</code> field of certain packages=
(<a href=3D"https://github.com/ocaml/opam/pull/6836">#6836</a>, <a href=3D=
"https://github.com/ocaml/opam/issues/5283">#5283</a>). <b>Thanks once-agai=
n to <a href=3D"https://github.com/WardBrian">@WardBrian</a> for this contr=
ibution.</b></li>
<li>:ocean: Many more UI additions and improvements, bug fixes, =E2=80=A6</=
li>
</ul>
<p>
:open_book: You can read our <a href=3D"https://opam.ocaml.org/blog/opam-2-=
6-0-alpha1/">blog post</a> for more information about these changes and mor=
e, and for even more details you can take a look at the <a href=3D"https://=
github.com/ocaml/opam/releases/tag/2.6.0-alpha1">release note</a> or the <a=
href=3D"https://github.com/ocaml/opam/blob/2.6.0-alpha1/CHANGES">changelog=
</a>.
</p>
</div>
</div>
<div id=3D"outline-container-org7226000" class=3D"outline-4">
<h4 id=3D"org7226000">Try it!</h4>
<div class=3D"outline-text-4" id=3D"text-org7226000">
<p>
The upgrade instructions are unchanged:
</p>
<p>
For Unix systems
</p>
<pre class=3D"example" id=3D"orgd825088">
bash -c "sh <(curl -fsSL https://opam.ocaml.org/install.sh) --version 2.=
6.0~alpha1"
</pre>
<p>
or from PowerShell for Windows systems
</p>
<pre class=3D"example" id=3D"org536f96b">
Invoke-Expression "& { $(Invoke-RestMethod https://opam.ocaml.org/insta=
ll.ps1) } -Version 2.6.0~alpha1"
</pre>
<p>
Please report any issues to the <a href=3D"https://github.com/ocaml/opam/is=
sues">bug-tracker</a>.
</p>
<p>
Happy hacking,
<> <> The opam team <> <> :camel:
</p>
<p>
—
<i>Special thanks to the Haematology department and Bone Marrow Transplant =
Unit of the NHS Greater Glasgow for making this release possible <3</i>
</p>
</div>
</div>
</div>
</div>
<div id=3D"outline-container-9" class=3D"outline-2">
<h2 id=3D"9">The little type that could too much</h2>
<div class=3D"outline-text-2" id=3D"text-9">
<p>
Archive: <a href=3D"https://discuss.ocaml.org/t/blog-the-little-type-that-c=
ould-too-much/18375/1">https://discuss.ocaml.org/t/blog-the-little-type-tha=
t-could-too-much/18375/1</a>
</p>
</div>
<div id=3D"outline-container-org13f2bcd" class=3D"outline-3">
<h3 id=3D"org13f2bcd">Rapha=C3=ABl Proust announced</h3>
<div class=3D"outline-text-3" id=3D"text-org13f2bcd">
<p>
I wrote a small blog post about how some types are intended for multiple us=
e cases and it's not always grerat. It uses the Stdlib as a small example i=
n the intro, but the real focus is on Lwt.
</p>
<p>
<a href=3D"https://tech.ahrefs.com/the-little-type-that-could-too-much-3f21=
c2e80430">https://tech.ahrefs.com/the-little-type-that-could-too-much-3f21c=
2e80430</a>
</p>
<p>
Feedback (on the post or on the points of Lwt that are discussed) is very w=
elcome. I'll probably start working on improving the Lwt bits soon so let m=
e know what you think.
</p>
</div>
</div>
</div>
<div id=3D"outline-container-orgb4b9601" class=3D"outline-2">
<h2 id=3D"orgb4b9601">Old CWN</h2>
<div class=3D"outline-text-2" id=3D"text-orgb4b9601">
<p>
If you happen to miss a CWN, you can <a href=3D"mailto:alan.schmitt@polytec=
hnique.org">send me a message</a> and I'll mail it to you, or go take a loo=
k at <a href=3D"https://alan.petitepomme.net/cwn/">the archive</a> or the <=
a href=3D"https://alan.petitepomme.net/cwn/cwn.rss">RSS feed of the archive=
s</a>.
</p>
<p>
If you also wish to receive it every week by mail, you may subscribe to the=
<a href=3D"https://sympa.inria.fr/sympa/info/caml-list">caml-list</a>.
</p>
<div class=3D"authorname" id=3D"orgcc7b65e">
<p>
<a href=3D"https://alan.petitepomme.net/">Alan Schmitt</a>
</p>
</div>
</div>
</div>
</div>
</body>
</html>
--==-=-=--
--=-=-=--
--===-=-=
Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQFvBAEBCABZFiEE6lXof/BsSVW56ZmGBA0KO07S5ccFAmpfmCkbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzHxxhbGFuLnNjaG1pdHRAcG9seXRlY2huaXF1ZS5v
cmcACgkQBA0KO07S5ccQ5Af7BX+Z0CxLAFCGhsk2OjdvePowFMhnGEUdHbLEPyls
D1VakbOaHuIUIXfoDVLJ8uBqzXbeBboKWFPom4VkQxpQ7uGqbQIiCL+gmXe6CHZb
fYpAeQCwxM6fjKz4QsBpbzagQDtPpaysl8KNMhdCGDBa9skDRSNWKTVFrtdY4eas
xlCbLHaHQJqaV+sh8ANyLKWIJc3JRKuuqjQyU1VoOJh6FTakIYvApVfsL+7ngibn
opwkg3K0AglATPH95n5orBQh4stsZgzv7o3nnhsqxMWpzfzpYA+kRYdv2OCE02AG
miB/NgWG1iWfOv5/N3TsG5B4t0sOodXiyLoCrjXUSOa/Vg==
=nl9F
-----END PGP SIGNATURE-----
--===-=-=--