[Caml-list] OCaml 4.14.5 released

[Florian Angeletti <florian.angeletti@inria.fr>]

[-- Attachment #1: Type: text/plain, Size: 4187 bytes --]

Dear OCaml users, 

We have the pleasure of celebrating the birthdays of Marie Skłodowska-Curie and 
Lise Meitner by announcing the release of OCaml version 4.14.5. 

This release is a safe collection of six security fixes, one pattern-matching 
miscompilation fix, and one configuration fix for the newest version of macOS. 
See the full Changes list below. 

If we are using any previous 4.14 version of OCaml, we are advising you to 
switch to this new version. 

### Evaluating the end of the active maintenance of OCaml 4.14 

As an important announcement, in January 2027, we will start evaluating if it 
would be reasonable to stop the active maintenance of the 4.14 branch between 
January and June 2027, taking in account that maintaining 4.14 is becoming more 
arduous each passing year. 

If this evaluation does not reveal any major issues, we would stop the active 
maintenance of OCaml 4.14 between June 2027 and the end of 2027. OCaml 4.14 
would still be available, and we would still try to keep the branch compatible 
with newer OSs and C compilers on a best effort basis. 

In the meanwhile, do not hesitate to report any bugs on the OCaml issue tracker 
(https://github.com/ocaml/ocaml/issues). 

Happy hacking, 
Florian Angeletti for the OCaml team. 


Installation Instructions 
------------------------- 

The base compiler can be installed as an opam switch with the following 
commands: 

opam update 
opam switch create 4.14.5 

The source code for the release candidate is also directly available on: 
* GitHub: https://github.com/ocaml/ocaml/archive/4.14.5.tar.gz 
* Inria archive: https://caml.inria.fr/pub/distrib/ocaml-4.14/ocaml-4.14.5.tar.gz 


Changes in OCaml 4.14.5 (6 November 2026) 
-------------------------------------- 
### Bug fixes: 

- 15019(https://github.com/ocaml/ocaml/issues/15019), 15030(https://github.com/ocaml/ocaml/issues/15030), OSEC-2026-18(https://osv.dev/vulnerability/OSEC-2026-18): `Marshal.from_{string,bytes}`: guard against 
overflow in the computation of the total data length. 
(Xavier Leroy, report by Akshay Singh, review by Nicolás Ojeda Bär 
and Antonin Décimo) 

- 15113(https://github.com/ocaml/ocaml/issues/15113), OSEC-2026-21(https://osv.dev/vulnerability/OSEC-2026-21): `Str.string_partial_match`: make sure captured groups 
are valid. 
(Xavier Leroy, review by Nicolás Ojeda Bär and Edwin Török) 

- 15112(https://github.com/ocaml/ocaml/issues/15112), OSEC-2026-22(https://osv.dev/vulnerability/OSEC-2026-22): `Unix.map_file`: protect against overflow 
when computing the data size. 
(Xavier Leroy and Nicolás Ojeda Bär, review by Nicolás Ojeda Bär 
and Edwin Török) 

- 15115(https://github.com/ocaml/ocaml/issues/15115), OSEC-2026-23(https://osv.dev/vulnerability/OSEC-2026-23): Fix multiple issues in demarshaling 
(`Marshal.from_{channel,string,bytes}`) 
(Xavier Leroy, review by Nicolás Ojeda Bär) 

- 15133(https://github.com/ocaml/ocaml/issues/15133), OSEC 2026-24(https://osv.dev/vulnerability/OSEC-2026-24): Multiple issues in command quoting on Windows 
(Xavier Leroy and Nicolás Ojeda Bär, review by Nicolás Ojeda Bär) 

- 15233(https://github.com/ocaml/ocaml/issues/15233), OSEC-2026-30(https://osv.dev/vulnerability/OSEC-2026-30): ensure that ephemeron marking follows Infix pointers. 
(Gabriel Scherer, review by Florian Angeletti) 

- 15185(https://github.com/ocaml/ocaml/issues/15185), 15187(https://github.com/ocaml/ocaml/issues/15187): fix a pattern-matching miscompilation on certain 
combinations of immediate ranges and redundant patterns 
(Gabriel Scherer, report by Alperer Keleş, 
review by Vincent Laviron and Florian Angeletti) 

- 15067(https://github.com/ocaml/ocaml/issues/15067), 15071(https://github.com/ocaml/ocaml/issues/15071): Fix detection of functions available in the future on macOS. 
(Antonin Décimo, review by Nicolás Ojeda Bär and Damien Doligez) 


### Internal tools: 

- 11100(https://github.com/ocaml/ocaml/issues/11100): Fix ocamltest to make sure failed tests are not counted as 
"unexpected error". 
(Damien Doligez, review by Sébastien Hinderer) 


[-- Attachment #2: Type: text/html, Size: 4593 bytes --]