From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Authentication-Results: plum.tunbury.org; dkim=pass (1024-bit key; unprotected) header.d=inria.fr header.i=@inria.fr header.a=rsa-sha256 header.s=dc header.b=Zpkf9FxH; dkim-atps=neutral Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=192.134.164.83; helo=mail2-relais-roc.national.inria.fr; envelope-from=caml-list-owner@inria.fr; receiver=tunbury.org Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) by plum.tunbury.org (Postfix) with ESMTP id 0651E4008C for ; Mon, 15 Jun 2026 19:48:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inria.fr; s=dc; h=date:from:to:message-id:mime-version:subject:reply-to: sender:list-id:list-help:list-subscribe:list-unsubscribe: list-post:list-owner:list-archive; bh=LpyYUxZUU1cnlqiaNWkQRUbDFnOolegBMarcYsQA6So=; b=Zpkf9FxH4Uxbp1ds8cS4ffQIYRL6z+Y6hxoaLLTfgHVIW/mUMY5oZKi8 umZCNeezpvpKPXi5iZKeBCRcNvV9BZDL6I8joUrNaXXRiO1t9QnIEI5pL loYrX9CM20Yh53E5q+fdJEvrLQ3a18fbnmBma3ECzHt9NiGoEEp+4kbxl Q=; X-CSE-ConnectionGUID: 1+X0boGHSn+dKuTd0kTHow== X-CSE-MsgGUID: 9s7j8UtJRs22PKD8ThPZ8g== Authentication-Results: mail2-relais-roc.national.inria.fr; dkim=none (message not signed) header.i=none; spf=SoftFail smtp.mailfrom=caml-list-owner@inria.fr; spf=None smtp.helo=postmaster@prod-sympa-app.inria.fr Received-SPF: SoftFail (mail2-relais-roc.national.inria.fr: domain of caml-list-owner@inria.fr is inclined to not designate 128.93.162.27 as permitted sender) identity=mailfrom; client-ip=128.93.162.27; receiver=mail2-relais-roc.national.inria.fr; envelope-from="caml-list-owner@inria.fr"; x-sender="caml-list-owner@inria.fr"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:128.93.142.0/24 ip4:192.134.164.0/24 ip4:128.93.162.160 ip4:128.93.162.3 ip4:128.93.162.88 ip4:89.107.174.7 mx ~all" Received-SPF: None (mail2-relais-roc.national.inria.fr: no sender authenticity information available from domain of postmaster@prod-sympa-app.inria.fr) identity=helo; client-ip=128.93.162.27; receiver=mail2-relais-roc.national.inria.fr; envelope-from="caml-list-owner@inria.fr"; x-sender="postmaster@prod-sympa-app.inria.fr"; x-conformance=spf_only X-IronPort-AV: E=Sophos;i="6.24,206,1774306800"; d="scan'208,217";a="281676483" Received: from prod-sympa-app.inria.fr ([128.93.162.27]) by mail2-relais-roc.national.inria.fr with ESMTP; 15 Jun 2026 21:48:06 +0200 Received: by prod-sympa-app.inria.fr (Postfix, from userid 990) id 24BB28239E; Mon, 15 Jun 2026 21:48:06 +0200 (CEST) Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) by prod-sympa-app.inria.fr (Postfix) with ESMTP id 4D5B180F81 for ; Mon, 15 Jun 2026 21:47:58 +0200 (CEST) X-CSE-ConnectionGUID: i+dJ+cw/TF22eZy3kutQyg== X-CSE-MsgGUID: OjmkgIUTSc2t+hPbKtUcGw== X-ThreatScanner-Verdict: Negative IronPort-Data: A9a23:/mkoXaiJDcQkZCenqdWsBeMbX161WhEKZh0ujC45NGQN5FlHY01je htvUGjVOfbfNGSje4x+Ot+38E8A75TdyINgQVY5/CA0FCMW8JqUDtmncnv9bniYRiHhZBI+v p9GMrEsD+htEySC/k/1WlTFhSMhvU1dbuOkUIYoAggoG0k8Dntn0Us98wIAqtYAqcCjBA+Qs s/FrcTaOVu0sxZ5KWt8B5ir8XuDh9ys/mlE1rACTaoT5gGGySBIVMt3yZyZdBMUfKEERoZWe M6YlNlVzkuBlz8xB9WslKrMc0Fiatb6IQiUh3NKbLOpix5EqzZa+v5T2C00NC+7Ix3Q9zxA4 I0lWa6YEG/FDYWV8AgpaCS0JgkiVUFw0O+ecCLn6aR/+GWdG5fk660G4EjbpuT08M4vaY1F3 aVwxDzg8nlvLg95qV62YrAEuygtECXkFIJctlMjxi6eMdh8G53xUv7J+MNhzThl06iiHd6GD yYYQShkd06FeAFIIFpOTpM4huahwHflG9FagAvP9exmuC6KkFY3i9ABM/KNEjCObctRmVyZr 2SA9mL2DxUXKMCe4TuD6HOlwOHV9c/+cNhCTePnqKIy2DV/wEQ0ChgVWnqGncKy0FL9W+pVC FAp8QUx+P1aGEuDC4OVsweDiHWNuxpZX9tLD8Uh+QSVw+zV5RyYDy4KVFZ8hMcOpsQtH3kxy liTkoqvBDp1sbTTR2j1GqqokA5e8BM9dQcqDRLohyNfizU/iOnfTy4jT+qP1IanhcavXCrsx CqH9W4/ga8ShIgFzc1XOLwBby2E/vD0oswdvm07nV5JKit4YpSkbsqm8zA3KN5eeZ2BQADpU GcswqCj0QzFMX1BeOFhjgnA8HFFKstp6AHhvGM= IronPort-HdrOrdr: A9a23:lXN4Lal6qEmt9aVgpE/wXKokFK7pDfMrimdD5ihNYBxZY6Wkfg 6V/cjzsiWE7gr5OUtQ/uxoXZPqfZqyz/NICOUqUYtKGTOW21dBwulZnPffKn7balDDHtc079 YeT0EGMqyPMbEit7eK3ODbKbYdKai8gcSVbLzlvg5QpGhRAskL0+46MHf4LqQRfmZ77PECZf +hD6R8yQZIUE5nGviTNz0qX/Xju9aOvIj9YRAACxI8gTP+/w+A2frVEwW4whxbcylU3bsZ7G DZn2XCl9CemsD+5B/A9nPZq7Ffk9fl0LJ4db+xo/lQBDXwqxqiIKNmRr2MrHQNpemz51AwlL D30mcdFvU2xXPNX32/5SDg0xPn118VmgXf4G7dr3v/gNDzAAk3AcpZhY5fb3LimjEdleA5/q JX/n6T86FaBxPYnCj7+pzhWhxwmlCvyEBS59I7vjhwUZY+dLQUl4AZ8U9Pea1wZB7S5Yw8De loBNzd4vFNGGnqGEzkgg== X-Talos-CUID: 9a23:/7IteGwucdEqSzqNMPDLBgUVWcwHMXbCi0v+eRW1O3cyS6CJcE6frfY= X-Talos-MUID: =?us-ascii?q?9a23=3AmPvUFQyKfvajfNVTXtwxgKH7SqaaqIOsDUMCsKg?= =?us-ascii?q?6gMLeKW9wAz2+kAm8bZByfw=3D=3D?= X-IronPort-AV: E=Sophos;i="6.24,206,1774306800"; d="scan'208,217";a="281676400" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown X-MGA-submission: =?us-ascii?q?MDGg4o8+MIR3jL/BJ3xgLQsiq6e9Y7YzRgJfl6?= =?us-ascii?q?H/WIXqf5GwdZfJBvhoD54LZlYQ4jQjL+3n5bKY2cvyQewkWxX/SMHG1i?= =?us-ascii?q?vfdTe+y0iELqoPJ7vjuT3YGixJSpvnIks3Kbzp5Op6NM+jAdSXZxiSSK?= =?us-ascii?q?fp2hHB6/AOANzbOjj6mnEMEw=3D=3D?= Received: from zcs2-store1.inria.fr ([128.93.142.3]) by mail2-relais-roc.national.inria.fr with ESMTP; 15 Jun 2026 21:47:58 +0200 Date: Mon, 15 Jun 2026 21:47:58 +0200 (CEST) From: Florian Angeletti To: caml-list Message-ID: <1462283419.31989609.1781552878167.JavaMail.zimbra@inria.fr> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_88c36d82-c841-42f9-b311-a64ab105e5bc" X-Originating-IP: [88.162.13.102] X-Mailer: Zimbra 10.1.16_GA_4850 (ZimbraWebClient - FF151 (Linux)/10.1.16_GA_4863) Thread-Index: qudvgBxUkZGpKkEhiaUF01WBUO0/XA== Thread-Topic: OCaml 4.14.4 released Subject: [Caml-list] OCaml 4.14.4 released Reply-To: Florian Angeletti X-Loop: caml-list@inria.fr X-Sequence: 19532 Errors-To: caml-list-owner@inria.fr Precedence: list Precedence: bulk Sender: caml-list-request@inria.fr X-no-archive: yes List-Id: List-Help: , List-Subscribe: , List-Unsubscribe: , List-Post: List-Owner: List-Archive: Archived-At: --=_88c36d82-c841-42f9-b311-a64ab105e5bc Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Dear OCaml users,=20 We have the pleasure of celebrating the anniversary of the first flight of= =20 Ariane 4 by announcing the release of OCaml version 4.14.4.=20 (The release of OCaml 5.5.0 is planned later this week.)=20 This release is a collection of safe bug fixes and security fixes for the= =20 standard library, cherry-picked from the OCaml 5 branch.=20 The 4.14 branch is expected to receive episodic updates until at least the = end=20 of 2026.=20 However, the end of its extended maintenance period is on the horizon.=20 Consequently, please mention to us any obstacle remaining to your migration= to=20 OCaml 5.=20 In the meanwhile, do not hesitate to report any bugs on the OCaml issue=20 tracker at=20 - https://github.com/ocaml/ocaml/issues.=20 See the list of changes below for more details.=20 Happy hacking,=20 Florian Angeletti for the OCaml team.=20 Installation Instructions=20 -------------------------------=20 The base compiler can be installed as an opam switch with the following com= mands:=20 opam update=20 opam switch create 4.14.4=20 The source code for the release candidate is also directly available on:=20 * GitHub: https://github.com/ocaml/ocaml/archive/4.14.4.tar.gz=20 * Inria archive: https://caml.inria.fr/pub/distrib/ocaml-4.14/ocaml-4.14.4.= tar.gz=20 Changes in OCaml 4.14.4 (15 June 2026)=20 -------------------------------------------------------=20 ### Build system:=20 - #12372(https://github.com/ocaml/ocaml/issues/12372),=20 #14572(https://github.com/ocaml/ocaml/issues/14572): Pass option -no-execut= e-only to the linker for OpenBSD >=3D 7.3=20 so that code sections remain readable, as needed for closure marshaling.=20 Originally backported in 4.14.2, but the flag was accidentally not passed w= hen=20 linking the .so versions of the OCaml runtime libraries or when linking .cm= xs=20 files.=20 (Xavier Leroy and Anil Madhavapeddy, review by Anil Madhavapeddy and=20 S=E9bastien Hinderer)=20 ### Bug fixes:=20 - #14599(https://github.com/ocaml/ocaml/issues/14599), #14606(https://githu= b.com/ocaml/ocaml/issues/14606):=20 on ARM64 platforms, ocamlopt was under-estimating the sizes of some instruc= tions.=20 This could lead to overflows in relative branch offsets, reported as errors= by the assembler.=20 (Xavier Leroy, review by Vincent Laviron, report by Rapha=EBl Proust)=20 - #14607(https://github.com/ocaml/ocaml/issues/14607): Fix linking with lib= asmrun_shared.so on Risc-V (undefined symbol=20 declared riscv.o)=20 (David Allsopp, review by Nicol=E1s Ojeda B=E4r)=20 - #14661(https://github.com/ocaml/ocaml/issues/14661): Build dllthreads.so = with pthreads flags (removed in #13018(https://github.com/ocaml/ocaml/issue= s/13018)). For=20 normal programs there's no semantic difference, because ocamlrun and=20 ocamlc.opt are always linked with pthreads, but it was a regression to requ= ire=20 programs wishing to dlopen dllthreads.so to have already linked with pthrea= ds=20 themselves.=20 (David Allsopp, review by Gabriel Scherer)=20 - #14655(https://github.com/ocaml/ocaml/issues/14655), #14691(https://githu= b.com/ocaml/ocaml/issues/14691), CVE-2026-34353, OSEC-2026-04: check for si= ze overflow in=20 caml_ba_reshape=20 (Stephen Dolan, review by Xavier Leroy)=20 - #14853(https://github.com/ocaml/ocaml/issues/14853), CVE-2026-41083, OSEC= -2026-05: fix quoting of filenames passed to=20 Filename.quote_command on Windows.=20 (David Allsopp, report by Andrew Nesbitt, review by Florian Angeletti)=20 --=_88c36d82-c841-42f9-b311-a64ab105e5bc Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
Dear OCaml users,

We have the pleasu= re of celebrating the anniversary of the first flight of
Ariane 4 by ann= ouncing the release of OCaml version 4.14.4.

(The release of OCaml 5= .5.0 is planned later this week.)

This release is a collection of sa= fe bug fixes and security fixes for the
standard library, cherry-picked = from the OCaml 5 branch.

The 4.14 branch is expected to receive epis= odic updates until at least the end
of 2026.

However, the end of = its extended maintenance period is on the horizon.
Consequently, please = mention to us any obstacle remaining to your migration to
OCaml 5.
In the meanwhile, do not hesitate to report any bugs on the OCaml issuetracker at

- https://github.com/ocaml/ocaml/issues.

See the= list of changes below for more details.

Happy hacking,
Florian A= ngeletti for the OCaml team.


Installation Instructions
------= -------------------------

The base compiler can be installed as an o= pam switch with the following commands:

    opam update    opam switch create 4.14.4

The source code for the rel= ease candidate is also directly available on:
* GitHub: https://github.c= om/ocaml/ocaml/archive/4.14.4.tar.gz
* Inria archive: https://caml.inria= .fr/pub/distrib/ocaml-4.14/ocaml-4.14.4.tar.gz


Changes in OCaml = 4.14.4 (15 June 2026)
--------------------------------------------------= -----

### Build system:

- #12372(https://github.com/ocaml/oca= ml/issues/12372),
  #14572(https://github.com/ocaml/ocaml/issues/1= 4572): Pass option -no-execute-only to the linker for OpenBSD >=3D 7.3  so that code sections remain readable, as needed for closure marsh= aling.
  Originally backported in 4.14.2, but the flag was accident= ally not passed when
  linking the .so versions of the OCaml runtim= e libraries or when linking .cmxs
  files.
  (Xavier Leroy = and Anil Madhavapeddy, review by Anil Madhavapeddy and
  S=E9bastie= n Hinderer)

### Bug fixes:

- #14599(https://github.com/ocaml/= ocaml/issues/14599), #14606(https://github.com/ocaml/ocaml/issues/14606): <= br>  on ARM64 platforms, ocamlopt was under-estimating the sizes of so= me instructions.
  This could lead to overflows in relative branch= offsets, reported as errors by the assembler.
  (Xavier Leroy, rev= iew by Vincent Laviron, report by Rapha=EBl Proust)

- #14607(https:/= /github.com/ocaml/ocaml/issues/14607): Fix linking with libasmrun_shared.so= on Risc-V (undefined symbol
  declared riscv.o)
  (David A= llsopp, review by Nicol=E1s Ojeda B=E4r)

- #14661(https://github.com= /ocaml/ocaml/issues/14661): Build dllthreads.so with pthreads flags (remove= d in #13018(https://github.com/ocaml/ocaml/issues/13018)). For
  no= rmal programs there's no semantic difference, because ocamlrun and
 = ; ocamlc.opt are always linked with pthreads, but it was a regression to re= quire
  programs wishing to dlopen dllthreads.so to have already li= nked with pthreads
  themselves.
  (David Allsopp, review b= y Gabriel Scherer)

- #14655(https://github.com/ocaml/ocaml/issues/14= 655), #14691(https://github.com/ocaml/ocaml/issues/14691), CVE-2026-34353, = OSEC-2026-04: check for size overflow in
  caml_ba_reshape
 = ; (Stephen Dolan, review by Xavier Leroy)

- #14853(https://github.co= m/ocaml/ocaml/issues/14853), CVE-2026-41083, OSEC-2026-05: fix quoting of f= ilenames passed to
  Filename.quote_command on Windows.
  (= David Allsopp, report by Andrew Nesbitt, review by Florian Angeletti)
--=_88c36d82-c841-42f9-b311-a64ab105e5bc--