From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Authentication-Results: plum.tunbury.org; dkim=pass (1024-bit key; unprotected) header.d=inria.fr header.i=@inria.fr header.a=rsa-sha256 header.s=dc header.b=N5chbYUr; dkim-atps=neutral Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=192.134.164.83; helo=mail2-relais-roc.national.inria.fr; envelope-from=caml-list-owner@inria.fr; receiver=tunbury.org Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) by plum.tunbury.org (Postfix) with ESMTP id B46FD400BC for ; Sat, 7 Nov 2026 14:06:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inria.fr; s=dc; h=date:from:to:message-id:mime-version:subject:reply-to: sender:list-id:list-help:list-subscribe:list-unsubscribe: list-post:list-owner:list-archive; bh=TDDWAF/DNuZT4tgX3s2YWGV5NUNFceMDrGIxqATm+Qc=; b=N5chbYUrVlRYUJxmfA0HmSk1tBFTgGhwdVLwGpfIE9XZrYv5op7s1xaw wsskX3dqaQjni7+8GfLxgrGUW/Dejb59Waix0C/k2C43MWbqS0NcysWiG /ZqNlp8XdIJ+fs+9EObx7Hqm3UgWoBaKzJgk1DH+sEzmnXY9Ce7hvOr1D M=; X-CSE-ConnectionGUID: oMe5eNW2ShuAGCWINR9N8w== X-CSE-MsgGUID: U/fZ2tyOSGCI/qNT+on9jQ== Authentication-Results: mail2-relais-roc.national.inria.fr; dkim=none (message not signed) header.i=none; spf=Pass smtp.mailfrom=caml-list-owner@inria.fr; spf=None smtp.helo=postmaster@prod-sympa-app.inria.fr Received-SPF: Pass (mail2-relais-roc.national.inria.fr: domain of caml-list-owner@inria.fr designates 128.93.162.27 as permitted sender) identity=mailfrom; client-ip=128.93.162.27; receiver=mail2-relais-roc.national.inria.fr; envelope-from="caml-list-owner@inria.fr"; x-sender="caml-list-owner@inria.fr"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:128.93.142.0/24 ip4:192.134.164.0/24 ip4:128.93.162.160 ip4:128.93.162.3 ip4:128.93.162.88 ip4:128.93.162.27 mx ~all" Received-SPF: None (mail2-relais-roc.national.inria.fr: no sender authenticity information available from domain of postmaster@prod-sympa-app.inria.fr) identity=helo; client-ip=128.93.162.27; receiver=mail2-relais-roc.national.inria.fr; envelope-from="caml-list-owner@inria.fr"; x-sender="postmaster@prod-sympa-app.inria.fr"; x-conformance=spf_only X-IronPort-AV: E=Sophos;i="6.27,200,1787004000"; d="scan'208,217";a="304335373" Received: from prod-sympa-app.inria.fr ([128.93.162.27]) by mail2-relais-roc.national.inria.fr with ESMTP; 07 Nov 2026 15:06:00 +0100 Received: by prod-sympa-app.inria.fr (Postfix, from userid 990) id 302C88193D; Sat, 7 Nov 2026 15:06:00 +0100 (CET) Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) by prod-sympa-app.inria.fr (Postfix) with ESMTP id E256581284; Sat, 7 Nov 2026 15:05:44 +0100 (CET) X-CSE-ConnectionGUID: z8rhS/wPQ8CJbaP+Gq52EA== X-CSE-MsgGUID: QrfUwt2MQR+KwARzwOd4Dg== X-ThreatScanner-Verdict: Negative IronPort-Data: A9a23:v/xo+qmfMrKsABs65fI+1Ono5gxZJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIfWG6BbP7eYmCkfY0ibtjj9x8F68OGyNQyQApr+yFmRi4T+ZvOCOrFEkqhZCn6wu/rHBs2t Z1GAjXjBJlpFSGE/k/F3pzJ9yQUOXSgH+KkYAL8EnkvA1ciFGF60UgLd9cR2uZAmcK+Dx6Gp eT8qsjePE7N8zNvOwr40YrawP9UlKq04mxwUmAWP6gR4gaHzyZNVfrzGInqR5fGatkMdgKFb 72bpF2J1jux1wsgDNqjjoH6fiUiKpbOPRKDg2ZhQKOrhB5PvEQais7X49JBAav/o2zhc+FZk L2hh7TpIesaFvSkdNAmbvVtO30W0ZtuqOaWeyDn2SCk5xaun3PEm52CBaytVGES0r4f7Wpmr JT0JN2RB/wqai3fLL+TE4FRasofwMbDLtMFukon0gngXd0ES5n7AIrTuIV19WJl7ixONa62i 8sxezF0NlHbfxpVNw5RCZQkne7uiGOXnz9w8QjF4/tspTGPlkoquFTuGIK9ltiiS8FShEeRo CTP+Wv0BhwGKN23yDyf83vqiPWncSbTA9pOT+blrqI36LGV7lUJBiAJSQGemMP6qVGXYcBAD EBI1iV7+MDe82TuFLERRSaQq3eBulsYWsFMO/Yr7RmEjKvS+QeQQGYeJhZKYdki8cYwQzs30 FSEt8j4ACRm9ryTU3OUsLmOxQ5eIgAHJnRYIDQYShEIup/ippsyh1TBVL6PDZKIszE8Ihmoq xjikcT0r+x7YRIjv0l6wbzGv95ojorCVVRw/RnQRG/8qAJ/fo+sIYKygbQeATCsM67BJmRtf lBc8yRd0AzKJZCLji2EBusXdF1sz+jQKyXS2DaDALF4nwmQF7WfkUy8Ld2wyIqF8irJRNMxX HLuhA== IronPort-HdrOrdr: A9a23:o7RwqK96QrG1kGXcF45uk+C9I+orL9Y04lQ7vn2ZKCYlEfBw+P rDoB1273HJYVUqOE3I5+rrBEDoexq1nqKdirNxAV7NZmbbUYmTQb1f0Q== X-Talos-CUID: =?us-ascii?q?9a23=3AbZ/1L2lGfOty9KuqRic9nCP2363XOW+N1nfrZFC?= =?us-ascii?q?AMDZCareccRy/4f4+vuM7zg=3D=3D?= X-Talos-MUID: =?us-ascii?q?9a23=3AIlrZtw4Z+PyMIo2R/1tRmEPxxoxR+aqTF1xXtKw?= =?us-ascii?q?8+OqbHBZiJBCR0Bi4F9o=3D?= X-IronPort-AV: E=Sophos;i="6.27,200,1787004000"; d="scan'208,217";a="304335045" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown X-MGA-submission: =?us-ascii?q?MDH2Dtx74rXKN91xRFClVve3V6caMjaShsx9Ru?= =?us-ascii?q?av7SBtz8mv3ZJuKEbvxwAeHOXBozmovsl+8OCROT/uz9zomuskDcrNPH?= =?us-ascii?q?rbFNvPGTejaSNzZpDEaCfc38dSqiUKGbjpHqeigd4OKI/ha1e+Bd5sgf?= =?us-ascii?q?z7o3If9wnIQkTx3uk7RkAyaQ=3D=3D?= Received: from zcs2-store1.inria.fr ([128.93.142.3]) by mail2-relais-roc.national.inria.fr with ESMTP; 07 Nov 2026 15:05:44 +0100 Date: Sat, 7 Nov 2026 15:05:44 +0100 (CET) From: Florian Angeletti To: caml-list , caml-announce Message-ID: <1757932808.41421771.1794060344730.JavaMail.zimbra@inria.fr> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_010b1e73-c99b-4cfc-9821-9d56ce65fbd1" X-Originating-IP: [88.162.13.102] X-Mailer: Zimbra 10.1.21_GA_4899 (ZimbraWebClient - FF159 (Linux)/10.1.21_GA_4899) X-Zimbra-Message-Verification: hash=SHA256;guid=MjdmNGZmNTc5ZTk1NzU5Y2RlM2YyMzU4MWNkZDUxZjQ2ZTg5OTQ0NmJlYzRmNGVmYTQ3NDZiNDMwOGM3Y2ZmMw== Thread-Index: WEkkZZbq78Zx+deO1jbdtrsKRSEjEg== Thread-Topic: OCaml 4.14.5 released Subject: [Caml-list] OCaml 4.14.5 released Reply-To: Florian Angeletti X-Loop: caml-list@inria.fr X-Sequence: 19603 Errors-To: caml-list-owner@inria.fr Precedence: list Precedence: bulk Sender: caml-list-request@inria.fr X-no-archive: yes List-Id: List-Help: , List-Subscribe: , List-Unsubscribe: , List-Post: List-Owner: List-Archive: Archived-At: --=_010b1e73-c99b-4cfc-9821-9d56ce65fbd1 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Dear OCaml users,=20 We have the pleasure of celebrating the birthdays of Marie Sk=C5=82odowska-= Curie and=20 Lise Meitner by announcing the release of OCaml version 4.14.5.=20 This release is a safe collection of six security fixes, one pattern-matchi= ng=20 miscompilation fix, and one configuration fix for the newest version of mac= OS.=20 See the full Changes list below.=20 If we are using any previous 4.14 version of OCaml, we are advising you to= =20 switch to this new version.=20 ### Evaluating the end of the active maintenance of OCaml 4.14=20 As an important announcement, in January 2027, we will start evaluating if = it=20 would be reasonable to stop the active maintenance of the 4.14 branch betwe= en=20 January and June 2027, taking in account that maintaining 4.14 is becoming = more=20 arduous each passing year.=20 If this evaluation does not reveal any major issues, we would stop the acti= ve=20 maintenance of OCaml 4.14 between June 2027 and the end of 2027. OCaml 4.14= =20 would still be available, and we would still try to keep the branch compati= ble=20 with newer OSs and C compilers on a best effort basis.=20 In the meanwhile, do not hesitate to report any bugs on the OCaml issue tra= cker=20 (https://github.com/ocaml/ocaml/issues).=20 Happy hacking,=20 Florian Angeletti for the OCaml team.=20 Installation Instructions=20 -------------------------=20 The base compiler can be installed as an opam switch with the following=20 commands:=20 opam update=20 opam switch create 4.14.5=20 The source code for the release candidate is also directly available on:=20 * GitHub: https://github.com/ocaml/ocaml/archive/4.14.5.tar.gz=20 * Inria archive: https://caml.inria.fr/pub/distrib/ocaml-4.14/ocaml-4.14.5.= tar.gz=20 Changes in OCaml 4.14.5 (6 November 2026)=20 --------------------------------------=20 ### Bug fixes:=20 - 15019(https://github.com/ocaml/ocaml/issues/15019), 15030(https://github.= com/ocaml/ocaml/issues/15030), OSEC-2026-18(https://osv.dev/vulnerability/O= SEC-2026-18): `Marshal.from_{string,bytes}`: guard against=20 overflow in the computation of the total data length.=20 (Xavier Leroy, report by Akshay Singh, review by Nicol=C3=A1s Ojeda B=C3=A4= r=20 and Antonin D=C3=A9cimo)=20 - 15113(https://github.com/ocaml/ocaml/issues/15113), OSEC-2026-21(https://= osv.dev/vulnerability/OSEC-2026-21): `Str.string_partial_match`: make sure = captured groups=20 are valid.=20 (Xavier Leroy, review by Nicol=C3=A1s Ojeda B=C3=A4r and Edwin T=C3=B6r=C3= =B6k)=20 - 15112(https://github.com/ocaml/ocaml/issues/15112), OSEC-2026-22(https://= osv.dev/vulnerability/OSEC-2026-22): `Unix.map_file`: protect against overf= low=20 when computing the data size.=20 (Xavier Leroy and Nicol=C3=A1s Ojeda B=C3=A4r, review by Nicol=C3=A1s Ojeda= B=C3=A4r=20 and Edwin T=C3=B6r=C3=B6k)=20 - 15115(https://github.com/ocaml/ocaml/issues/15115), OSEC-2026-23(https://= osv.dev/vulnerability/OSEC-2026-23): Fix multiple issues in demarshaling=20 (`Marshal.from_{channel,string,bytes}`)=20 (Xavier Leroy, review by Nicol=C3=A1s Ojeda B=C3=A4r)=20 - 15133(https://github.com/ocaml/ocaml/issues/15133), OSEC 2026-24(https://= osv.dev/vulnerability/OSEC-2026-24): Multiple issues in command quoting on = Windows=20 (Xavier Leroy and Nicol=C3=A1s Ojeda B=C3=A4r, review by Nicol=C3=A1s Ojeda= B=C3=A4r)=20 - 15233(https://github.com/ocaml/ocaml/issues/15233), OSEC-2026-30(https://= osv.dev/vulnerability/OSEC-2026-30): ensure that ephemeron marking follows = Infix pointers.=20 (Gabriel Scherer, review by Florian Angeletti)=20 - 15185(https://github.com/ocaml/ocaml/issues/15185), 15187(https://github.= com/ocaml/ocaml/issues/15187): fix a pattern-matching miscompilation on cer= tain=20 combinations of immediate ranges and redundant patterns=20 (Gabriel Scherer, report by Alperer Kele=C5=9F,=20 review by Vincent Laviron and Florian Angeletti)=20 - 15067(https://github.com/ocaml/ocaml/issues/15067), 15071(https://github.= com/ocaml/ocaml/issues/15071): Fix detection of functions available in the = future on macOS.=20 (Antonin D=C3=A9cimo, review by Nicol=C3=A1s Ojeda B=C3=A4r and Damien Doli= gez)=20 ### Internal tools:=20 - 11100(https://github.com/ocaml/ocaml/issues/11100): Fix ocamltest to make= sure failed tests are not counted as=20 "unexpected error".=20 (Damien Doligez, review by S=C3=A9bastien Hinderer)=20 --=_010b1e73-c99b-4cfc-9821-9d56ce65fbd1 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Dear OCaml users,

We have the pleasu= re of celebrating the birthdays of Marie Sk=C5=82odowska-Curie and
Lise = Meitner by announcing the release of OCaml version 4.14.5.

This rele= ase is a safe collection of six security fixes, one pattern-matching
mis= compilation fix, and one configuration fix for the newest version of macOS.=
See the full Changes list below.

If we are using any previous 4.= 14 version of OCaml, we are advising you to
switch to this new version.<= br>
### Evaluating the end of the active maintenance of OCaml 4.14
As an important announcement, in January 2027, we will start evaluating i= f it
would be reasonable to stop the active maintenance of the 4.14 bran= ch between
January and June 2027, taking in account that maintaining 4.1= 4 is becoming more
arduous each passing year.

If this evaluation = does not reveal any major issues, we would stop the active
maintenance o= f OCaml 4.14 between June 2027 and the end of 2027. OCaml 4.14
would sti= ll be available, and we would still try to keep the branch compatible
wi= th newer OSs and C compilers on a best effort basis.

In the meanwhil= e, do not hesitate to report any bugs on the OCaml issue tracker
(https:= //github.com/ocaml/ocaml/issues).

Happy hacking,
Florian Angelett= i for the OCaml team.


Installation Instructions
-------------= ------------

The base compiler can be installed as an opam switch wi= th the following
commands:

    opam update
  &n= bsp; opam switch create 4.14.5

The source code for the release candi= date is also directly available on:
* GitHub: https://github.com/ocaml/o= caml/archive/4.14.5.tar.gz
* Inria archive: https://caml.inria.fr/pub/di= strib/ocaml-4.14/ocaml-4.14.5.tar.gz


Changes in OCaml 4.14.5 (6 = November 2026)
--------------------------------------
### Bug fixes:<= br>
- 15019(https://github.com/ocaml/ocaml/issues/15019), 15030(https://= github.com/ocaml/ocaml/issues/15030), OSEC-2026-18(https://osv.dev/vulnerab= ility/OSEC-2026-18): `Marshal.from_{string,bytes}`: guard against
 = overflow in the computation of the total data length.
  (Xavier Le= roy, report by Akshay Singh, review by Nicol=C3=A1s Ojeda B=C3=A4r
 = ; and Antonin D=C3=A9cimo)

- 15113(https://github.com/ocaml/ocaml/is= sues/15113), OSEC-2026-21(https://osv.dev/vulnerability/OSEC-2026-21): `Str= .string_partial_match`: make sure captured groups
  are valid.
&= nbsp; (Xavier Leroy, review by Nicol=C3=A1s Ojeda B=C3=A4r and Edwin T=C3= =B6r=C3=B6k)

- 15112(https://github.com/ocaml/ocaml/issues/15112), O= SEC-2026-22(https://osv.dev/vulnerability/OSEC-2026-22): `Unix.map_file`: p= rotect against overflow
  when computing the data size.
  (= Xavier Leroy and Nicol=C3=A1s Ojeda B=C3=A4r, review by Nicol=C3=A1s Ojeda = B=C3=A4r
  and Edwin T=C3=B6r=C3=B6k)

- 15115(https://github= .com/ocaml/ocaml/issues/15115), OSEC-2026-23(https://osv.dev/vulnerability/= OSEC-2026-23): Fix multiple issues in demarshaling
  (`Marshal.from= _{channel,string,bytes}`)
  (Xavier Leroy, review by Nicol=C3=A1s O= jeda B=C3=A4r)

- 15133(https://github.com/ocaml/ocaml/issues/15133),= OSEC 2026-24(https://osv.dev/vulnerability/OSEC-2026-24): Multiple issues = in command quoting on Windows
  (Xavier Leroy and Nicol=C3=A1s Ojed= a B=C3=A4r, review by Nicol=C3=A1s Ojeda B=C3=A4r)

- 15233(https://g= ithub.com/ocaml/ocaml/issues/15233), OSEC-2026-30(https://osv.dev/vulnerabi= lity/OSEC-2026-30): ensure that ephemeron marking follows Infix pointers.  (Gabriel Scherer, review by Florian Angeletti)

- 15185(http= s://github.com/ocaml/ocaml/issues/15185), 15187(https://github.com/ocaml/oc= aml/issues/15187): fix a pattern-matching miscompilation on certain
&nbs= p; combinations of immediate ranges and redundant patterns
  (Gabri= el Scherer, report by Alperer Kele=C5=9F,
   review by Vincent= Laviron and Florian Angeletti)

- 15067(https://github.com/ocaml/oca= ml/issues/15067), 15071(https://github.com/ocaml/ocaml/issues/15071): Fix d= etection of functions available in the future on macOS.
  (Antonin = D=C3=A9cimo, review by Nicol=C3=A1s Ojeda B=C3=A4r and Damien Doligez)
<= br>
### Internal tools:

- 11100(https://github.com/ocaml/ocaml/is= sues/11100): Fix ocamltest to make sure failed tests are not counted as
=   "unexpected error".
  (Damien Doligez, review by S=C3=A9bast= ien Hinderer)

--=_010b1e73-c99b-4cfc-9821-9d56ce65fbd1--