From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Authentication-Results: plum.tunbury.org; dkim=pass (1024-bit key; unprotected) header.d=inria.fr header.i=@inria.fr header.a=rsa-sha256 header.s=dc header.b=gHs0ROtW; dkim-atps=neutral Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=192.134.164.83; helo=mail2-relais-roc.national.inria.fr; envelope-from=caml-list-owner@inria.fr; receiver=tunbury.org Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) by plum.tunbury.org (Postfix) with ESMTP id 16207400A7 for ; Tue, 17 Feb 2026 16:10:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inria.fr; s=dc; h=date:from:to:message-id:mime-version:subject:reply-to: sender:list-id:list-help:list-subscribe:list-unsubscribe: list-post:list-owner:list-archive; bh=7cMAk6qp+8C7c2skhK/Nl5CNvUwvfPA4MqG3+KarnNk=; b=gHs0ROtWPTKToEVUYY4kTJvf6E9Nv7A8MA5I8kCyoSdvGD6EiFYUMOAi fR1OiW7Lcd0+OP6cLh5dJaYaq907d5oEyiS4T18xIOTw1IsnokOZQX7RS 8IfD9RW7t++8O+/+fZmnhvKcvQh7nbTE8bipXyIN6b6lZn6PC+DnsiTYb Y=; X-CSE-ConnectionGUID: zIHVo0vFReW73QTOgIvOkg== X-CSE-MsgGUID: 0BLl6CCwTh2PdPN1SSK2xA== Authentication-Results: mail2-relais-roc.national.inria.fr; dkim=none (message not signed) header.i=none; spf=SoftFail smtp.mailfrom=caml-list-owner@inria.fr; spf=None smtp.helo=postmaster@prod-sympa-app.inria.fr Received-SPF: SoftFail (mail2-relais-roc.national.inria.fr: domain of caml-list-owner@inria.fr is inclined to not designate 128.93.162.27 as permitted sender) identity=mailfrom; client-ip=128.93.162.27; receiver=mail2-relais-roc.national.inria.fr; envelope-from="caml-list-owner@inria.fr"; x-sender="caml-list-owner@inria.fr"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 include:mailout.safebrands.com a:basic-mail.safebrands.com a:basic-mail01.safebrands.com a:basic-mail02.safebrands.com ip4:128.93.142.0/24 ip4:192.134.164.0/24 ip4:128.93.162.160 ip4:128.93.162.3 ip4:128.93.162.88 ip4:89.107.174.7 mx ~all" Received-SPF: None (mail2-relais-roc.national.inria.fr: no sender authenticity information available from domain of postmaster@prod-sympa-app.inria.fr) identity=helo; client-ip=128.93.162.27; receiver=mail2-relais-roc.national.inria.fr; envelope-from="caml-list-owner@inria.fr"; x-sender="postmaster@prod-sympa-app.inria.fr"; x-conformance=spf_only X-IronPort-AV: E=Sophos;i="6.21,296,1763420400"; d="scan'208,217";a="263906707" Received: from prod-sympa-app.inria.fr ([128.93.162.27]) by mail2-relais-roc.national.inria.fr with ESMTP; 17 Feb 2026 17:10:59 +0100 Received: by prod-sympa-app.inria.fr (Postfix, from userid 990) id 3002682DA4; Tue, 17 Feb 2026 17:10:59 +0100 (CET) Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) by prod-sympa-app.inria.fr (Postfix) with ESMTP id 1A13882DA3; Tue, 17 Feb 2026 17:10:45 +0100 (CET) X-CSE-ConnectionGUID: iNdLaVMmSWuPXJkWteItlQ== X-CSE-MsgGUID: e6TfBocPSlqq1tywnQo+FQ== X-ThreatScanner-Verdict: Negative X-IronPort-AV: E=Sophos;i="6.21,296,1763420400"; d="scan'208,217";a="263906304" X-MGA-submission: =?us-ascii?q?MDFytPaG/YJNRbFye1tMS0w81ZUL8n85GR82AN?= =?us-ascii?q?yUP5c+FYOUdgeoPiWzLF9d9I4eOk+2gkuphAIuWUWCw8pOHeUgp9HoN/?= =?us-ascii?q?08fTiY3bM0p++LkZR69ke1VTyQbDM75zsBu8e9Od0kWqhZ9Tmf7Vx52G?= =?us-ascii?q?AFtldoK9kZfuGXaykrWZ9Z4w=3D=3D?= Received: from zcs2-store1.inria.fr ([128.93.142.3]) by mail2-relais-roc.national.inria.fr with ESMTP; 17 Feb 2026 17:10:45 +0100 Date: Tue, 17 Feb 2026 17:10:44 +0100 (CET) From: Florian Angeletti To: caml-list , caml-announce Message-ID: <1378339832.5134944.1771344644925.JavaMail.zimbra@inria.fr> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_fa172da6-6b11-4a17-bf41-3e5d9e08a09d" X-Originating-IP: [128.93.64.106] X-Mailer: Zimbra 10.1.13_GA_4837 (ZimbraWebClient - FF147 (Linux)/10.1.14_GA_4838) Thread-Index: xkulujo1TOiMqzKMHXrjEkKq+59nBw== Thread-Topic: OCaml 5.4.1 and OCaml 4.14.3 released Subject: [Caml-list] OCaml 5.4.1 and OCaml 4.14.3 released Reply-To: Florian Angeletti X-Loop: caml-list@inria.fr X-Sequence: 19451 Errors-To: caml-list-owner@inria.fr Precedence: list Precedence: bulk Sender: caml-list-request@inria.fr X-no-archive: yes List-Id: List-Help: , List-Subscribe: , List-Unsubscribe: , List-Post: List-Owner: List-Archive: Archived-At: --=_fa172da6-6b11-4a17-bf41-3e5d9e08a09d Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Dear OCaml users,=20 We have the pleasure of announcing the dual releases of OCaml 4.14.3 and OC= aml=20 5.4.1, dedicated to the memory of Nicolaas Govert de Bruijn on the annivers= ary=20 of his death.=20 Those releases are a collection of safe and valuable runtime bugfixes.=20 The OCaml 5.4.1 release also contains a fix for the `-pack` mode for macOs= =20 and various TSAN fixes.=20 More importantly, those new versions harden the Marshal module against mali= cious=20 inputs as described in the security announcement (https://osv.dev/vulnerabi= lity/OSEC-2026-01).=20 We are encouraging you to switch to those new releases whenever possible.= =20 Don't hesitate to report any bugs on the OCaml issue tracker at=20 https://github.com/ocaml/ocaml/issues.=20 See the list of changes below for more details.=20 Happy hacking,=20 -- Florian Angeletti for the OCaml team.=20 Installation Instructions=20 ------------------------------=20 The base compilers will be soon installable as an opam switch with the foll= owing commands:=20 opam update=20 opam switch create 4.14.3=20 opam switch create 5.4.1=20 The source code for the release candidate is also directly available on:=20 * GitHub:=20 - https://github.com/ocaml/ocaml/archive/4.14.3.tar.gz=20 - https://github.com/ocaml/ocaml/archive/5.4.1.tar.gz=20 * Inria archive:=20 - https://caml.inria.fr/pub/distrib/ocaml-4.14/ocaml-4.14.3.tar.gz=20 - https://caml.inria.fr/pub/distrib/ocaml-5.4/ocaml-5.4.1.tar.gz=20 OCaml 4.14.3 (17 February 2026)=20 -----------------------------------------------------=20 - [#12070](https://github.com/ocaml/ocaml/issues/12070), [#12075](https://g= ithub.com/ocaml/ocaml/issues/12075), [#13209](https://github.com/ocaml/ocam= l/issues/13209): auto-detect whether `ar` support @FILE arguments at=20 configure-time to avoid using this feature with toolchains that do not supp= ort=20 it (eg FreeBSD/Darwin); backport from 5.3.=20 (backport by Boris Dobroslavov, original fix by Nicol=E1s Ojeda B=E4r, revi= ew by=20 Xavier Leroy, David Allsopp, Javier Ch=E1varri, Anil Madhavapeddy)=20 - [#12207](https://github.com/ocaml/ocaml/issues/12207), [#12222](https://g= ithub.com/ocaml/ocaml/issues/12222): Make closure computation linear in the= number of recursive=20 functions instead of quadratic=20 (Vincent Laviron, report by Fran=E7ois Pottier, review by Nathana=EBlle Cou= rant=20 and Gabriel Scherer)=20 - [#13430](https://github.com/ocaml/ocaml/issues/13430), [#13434](https://g= ithub.com/ocaml/ocaml/issues/13434): protect memory-safety on Lazy.force ra= ces=20 (Gabriel Scherer and Vincent Laviron, report by Edwin T=F6r=F6k,=20 review by Vincent Laviron)=20 - [#13448](https://github.com/ocaml/ocaml/issues/13448), [#13449](https://g= ithub.com/ocaml/ocaml/issues/13449): fix a code-generation bug on unsafe ar= ray accesses=20 at type int32, int64, nativeint, which has been introduced in OCaml 4.04.= =20 (Gabriel Scherer, review by Nicol=E1s Ojeda B=E4r and Vincent Laviron,=20 report by Simon Cruanes)=20 - [#13516](https://github.com/ocaml/ocaml/issues/13516): Fix regression whe= re error conditions during bytecode initialisation=20 caused a segmentation fault rather than being properly reported (regression= of=20 [#5115](https://github.com/ocaml/ocaml/issues/5115) in [#11788](https://git= hub.com/ocaml/ocaml/issues/11788))=20 (David Allsopp, review by Nicol=E1s Ojeda B=E4r)=20 - [#13847](https://github.com/ocaml/ocaml/issues/13847): On Windows, mainta= in a number of threads waiting on the master lock to=20 avoid unnecessary context switches=20 (Dmitry Bely, review by Antonin D=E9cimo)=20 - [#14007](https://github.com/ocaml/ocaml/issues/14007), [#14015](https://g= ithub.com/ocaml/ocaml/issues/14015): Fix memory corruption when an exceptio= n is raised during=20 demarshaling.=20 (Beno=EEt Vaugon, review by David Allsopp and Gabriel Scherer)=20 - [OSEC-2026-01](https://osv.dev/vulnerability/OSEC-2026-01): robustify int= ern.c=20 (Xavier Leroy, review by Damien Doligez and Olivier Nicole)=20 OCaml 5.4.1 (17 February 2026)=20 -------------------------------------------=20 ### Bug fixes:=20 - [#14010](https://github.com/ocaml/ocaml/issues/14010): Fix miscompilation= / liveness errors for string operations=20 (Mark Shinwell, Xavier Clerc, review by Xavier Leroy and Gabriel Scherer)= =20 - [#14065](https://github.com/ocaml/ocaml/issues/14065): Fix function signa= ture mismatch of `__tsan_func_exit` with GCC 15.=20 Check in the configure step if the TSan provided internal builtins are the= =20 same as what we expect, introduce `caml_tsan_*` wrappers for the `__tsan_*`= =20 functions we use.=20 (Hari Hara Naveen S, report by Hari Hara Naveen S,=20 review by Gabriel Scherer, Antonin D=E9cimo, Olivier Nicole)=20 - [#14417](https://github.com/ocaml/ocaml/issues/14417): Fix issue with nes= ted packs on macOS.=20 (Vincent Laviron, report by Kate Deplaix, review by Gabriel Scherer)=20 - [#14213](https://github.com/ocaml/ocaml/issues/14213): Fix shadow-stack-r= elated crashes with TSan=20 (Olivier Nicole, report by Nathan Taylor, review by Gabriel Scherer and=20 Stefan Muenzel)=20 - [#14255](https://github.com/ocaml/ocaml/issues/14255): Fix TSan bug with = C calls that take many arguments=20 (Olivier Nicole and Miod Vallat, report by Nathan Taylor, review by Gabriel= =20 Scherer)=20 - [OSEC-2026-01](https://osv.dev/vulnerability/OSEC-2026-01): robustify int= ern.c=20 (Xavier Leroy and Nicol=E1s Ojeda B=E4r, review by Olivier Nicole, Mindy Pr= eston,=20 Edwin T=F6r=F6k, and Gabriel Scherer)=20 --=_fa172da6-6b11-4a17-bf41-3e5d9e08a09d Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Dear OCaml users,

We have the pleasu= re of announcing the dual releases of OCaml 4.14.3 and OCaml
5.4.1, dedi= cated to the memory of Nicolaas Govert de Bruijn on the anniversary
of h= is death.

Those releases are a collection of safe and valuable runti= me bugfixes.
The OCaml 5.4.1 release also contains a fix for the `-pack`= mode for macOs
and various TSAN fixes.

More importantly, those n= ew versions harden the Marshal module against malicious
inputs as= described in the security announcement (https://osv.dev/vulnerability/OSEC= -2026-01).

We are encouraging you to switch to those new rele= ases whenever possible.

Don't hesitate to report any bugs on the OCa= ml issue tracker at
https://github.com/ocaml/ocaml/issues.

See th= e list of changes below for more details.

Happy hacking,
-- Flori= an Angeletti for the OCaml team.


Installation Instructions
--= ----------------------------

The base compilers will be soon install= able as an opam switch with the following commands:

    op= am update
    opam switch create 4.14.3
    opam = switch create 5.4.1


The source code for the release candidate is= also directly available on:

* GitHub: 
  - https://git= hub.com/ocaml/ocaml/archive/4.14.3.tar.gz
  - https://github.com/oc= aml/ocaml/archive/5.4.1.tar.gz

* Inria archive: 
  &nbs= p;- https://caml.inria.fr/pub/distrib/ocaml-4.14/ocaml-4.14.3.tar.gz
&nb= sp;  - https://caml.inria.fr/pub/distrib/ocaml-5.4/ocaml-5.4.1.tar.gz<= br>

OCaml 4.14.3 (17 February 2026)
-----------------------------= ------------------------


- [#12070](https://github.com/ocaml/oca= ml/issues/12070), [#12075](https://github.com/ocaml/ocaml/issues/12075), [#= 13209](https://github.com/ocaml/ocaml/issues/13209): auto-detect whether `a= r` support @FILE arguments at
  configure-time to avoid using this = feature with toolchains that do not support
  it (eg FreeBSD/Darwin= ); backport from 5.3.
  (backport by Boris Dobroslavov, original fi= x by Nicol=E1s Ojeda B=E4r, review by
  Xavier Leroy, David Allsopp= , Javier Ch=E1varri, Anil Madhavapeddy)

- [#12207](https://github.co= m/ocaml/ocaml/issues/12207), [#12222](https://github.com/ocaml/ocaml/issues= /12222): Make closure computation linear in the number of recursive
&nbs= p; functions instead of quadratic
  (Vincent Laviron, report by Fra= n=E7ois Pottier, review by Nathana=EBlle Courant
  and Gabriel Sche= rer)

- [#13430](https://github.com/ocaml/ocaml/issues/13430), [#1343= 4](https://github.com/ocaml/ocaml/issues/13434): protect memory-safety on L= azy.force races
  (Gabriel Scherer and Vincent Laviron, report by E= dwin T=F6r=F6k,
   review by Vincent Laviron)

- [#13448= ](https://github.com/ocaml/ocaml/issues/13448), [#13449](https://github.com= /ocaml/ocaml/issues/13449): fix a code-generation bug on unsafe array acces= ses
  at type int32, int64, nativeint, which has been introduced in= OCaml 4.04.
  (Gabriel Scherer, review by Nicol=E1s Ojeda B=E4r an= d Vincent Laviron,
   report by Simon Cruanes)

- [#1351= 6](https://github.com/ocaml/ocaml/issues/13516): Fix regression where error= conditions during bytecode initialisation
  caused a segmentation = fault rather than being properly reported (regression of
  [#5115](= https://github.com/ocaml/ocaml/issues/5115) in [#11788](https://github.com/= ocaml/ocaml/issues/11788))
  (David Allsopp, review by Nicol=E1s Oj= eda B=E4r)

- [#13847](https://github.com/ocaml/ocaml/issues/13847): = On Windows, maintain a number of threads waiting on the master lock to
&= nbsp; avoid unnecessary context switches
  (Dmitry Bely, review by = Antonin D=E9cimo)

- [#14007](https://github.com/ocaml/ocaml/issues/1= 4007), [#14015](https://github.com/ocaml/ocaml/issues/14015): Fix memory co= rruption when an exception is raised during
  demarshaling.
&nbs= p; (Beno=EEt Vaugon, review by David Allsopp and Gabriel Scherer)

- = [OSEC-2026-01](https://osv.dev/vulnerability/OSEC-2026-01): robustify inter= n.c
  (Xavier Leroy, review by Damien Doligez and Olivier Nicole)
OCaml 5.4.1 (17 February 2026)
-----------------------------------= --------

### Bug fixes:

- [#14010](https://github.com/ocaml/o= caml/issues/14010): Fix miscompilation / liveness errors for string operati= ons
  (Mark Shinwell, Xavier Clerc, review by Xavier Leroy and Gabr= iel Scherer)

- [#14065](https://github.com/ocaml/ocaml/issues/14065)= : Fix function signature mismatch of `__tsan_func_exit` with GCC 15.
&nb= sp; Check in the configure step if the TSan provided internal builtins are = the
  same as what we expect, introduce `caml_tsan_*` wrappers for = the `__tsan_*`
  functions we use.
  (Hari Hara Naveen S, r= eport by Hari Hara Naveen S,
  review by Gabriel Scherer, Antonin D= =E9cimo, Olivier Nicole)

- [#14417](https://github.com/ocaml/ocaml/i= ssues/14417): Fix issue with nested packs on macOS.
  (Vincent Lavi= ron, report by Kate Deplaix, review by Gabriel Scherer)

- [#14213](h= ttps://github.com/ocaml/ocaml/issues/14213): Fix shadow-stack-related crash= es with TSan
  (Olivier Nicole, report by Nathan Taylor, review by = Gabriel Scherer and
   Stefan Muenzel)

- [#14255](https= ://github.com/ocaml/ocaml/issues/14255): Fix TSan bug with C calls that tak= e many arguments
  (Olivier Nicole and Miod Vallat, report by Natha= n Taylor, review by Gabriel
   Scherer)

- [OSEC-2026-01= ](https://osv.dev/vulnerability/OSEC-2026-01): robustify intern.c
 = (Xavier Leroy and Nicol=E1s Ojeda B=E4r, review by Olivier Nicole, Mindy P= reston,
  Edwin T=F6r=F6k, and Gabriel Scherer)

--=_fa172da6-6b11-4a17-bf41-3e5d9e08a09d--