OCaml Weekly News

Dear everyone,

it is my pleasure to announce the first security announcement of this year, and the first coordinated by the new OCaml security response team (https://ocaml.org/security).

Please subscribe to the OCaml security announcement mailing list (https://sympa.inria.fr/sympa/info/ocsf-ocaml-security-announcements) to receive all security advisories. To this mailing list I'll only copy those affecting the core of OCaml distribution.

It should any moment now also appear at https://osv.dev/list?q=OSEC-2026-01

Human link: https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-01.md

id: OSEC-2026-01
modified: "2026-02-17T13:30:00Z"
published: "2026-02-17T13:30:00Z"
aliases: [  GHSA-j26j-m5xr-g23c GHSA-m34r-cgq7-jhfm ]
severity: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
severity_score: "6.8"
affected: "ocaml" {< "4.14.3" | (>= "5" & < "5.4.1")}
events: [
   [
     git "https://github.com/ocaml/ocaml" [
       [fixed "b0a2614684a52acded784ec213f14ddfe085d146"]
     ]
   ]
   [
     git "https://github.com/ocaml/ocaml" [
       [fixed "e3919fef436f89271bc30bbe8592851f7289fb68"]
     ]
   ]
]
references: [
   [report 
"https://github.com/ocaml/security-advisories/security/advisories/GHSA-j26j-m5xr-g23c"]
]
credits: [
   [reporter "Justin Timperio"]
   [remediation_developer "Nicolás Ojeda Bär"]
   [remediation_developer "Xavier Leroy"]
   [remediation_developer "Gabriel Scherer"]
   [remediation_reviewer "Xavier Leroy"]
   [remediation_reviewer "Olivier Nicole"]
   [remediation_verifier "Mindy Preston"]
   [remediation_verifier "Edwin Török"]
   [coordinator "Hannes Mehnert"]
]
cwe: [ CWE-126 CWE-502 CWE-754 ]

Buffer Over-Read in OCaml Marshal Deserialization

We have the pleasure of announcing the dual releases of OCaml 4.14.3 and OCaml 5.4.1, dedicated to the memory of Nicolaas Govert de Bruijn on the anniversary of his death.

Those releases are a collection of safe and valuable runtime bugfixes. The OCaml 5.4.1 release also contains a fix for the -pack mode for macOs and various TSAN fixes.

More importantly, those new versions harden the Marshal module against malicious inputs as described in the security announcement OSEC-2026-01.

We are encouraging you to switch to those new releases whenever possible.

Don't hesitate to report any bugs on the OCaml issue tracker.

See the list of changes below for more details.

Happy hacking, – Florian Angeletti for the OCaml team.

Installation Instructions

The base compilers will be soon installable as an opam switch with the following commands:

opam update
opam switch create 4.14.3
opam switch create 5.4.1

The source code for the release candidate is also directly available on:

• GitHub:
  • https://github.com/ocaml/ocaml/archive/4.14.3.tar.gz
  • https://github.com/ocaml/ocaml/archive/5.4.1.tar.gz
• Inria archive:
  • https://caml.inria.fr/pub/distrib/ocaml-4.14/ocaml-4.14.3.tar.gz
  • https://caml.inria.fr/pub/distrib/ocaml-5.4/ocaml-5.4.1.tar.gz

OCaml 4.14.3 (17 February 2026)

• #12070, #12075, #13209: auto-detect whether ar support @FILE arguments at configure-time to avoid using this feature with toolchains that do not support it (eg FreeBSD/Darwin); backport from 5.3. (backport by Boris Dobroslavov, original fix by Nicolás Ojeda Bär, review by Xavier Leroy, David Allsopp, Javier Chávarri, Anil Madhavapeddy)
• #12207, #12222: Make closure computation linear in the number of recursive functions instead of quadratic (Vincent Laviron, report by François Pottier, review by Nathanaëlle Courant and Gabriel Scherer)
• #13430, #13434: protect memory-safety on Lazy.force races (Gabriel Scherer and Vincent Laviron, report by Edwin Török, review by Vincent Laviron)
• #13448, #13449: fix a code-generation bug on unsafe array accesses at type int32, int64, nativeint, which has been introduced in OCaml 4.04. (Gabriel Scherer, review by Nicolás Ojeda Bär and Vincent Laviron, report by Simon Cruanes)
• #13516: Fix regression where error conditions during bytecode initialisation caused a segmentation fault rather than being properly reported (regression of #5115 in #11788) (David Allsopp, review by Nicolás Ojeda Bär)
• #13847: On Windows, maintain a number of threads waiting on the master lock to avoid unnecessary context switches (Dmitry Bely, review by Antonin Décimo)
• #14007, #14015: Fix memory corruption when an exception is raised during demarshaling. (Benoît Vaugon, review by David Allsopp and Gabriel Scherer)
• OSEC-2026-01: robustify intern.c (Xavier Leroy, review by Damien Doligez and Olivier Nicole)

OCaml 5.4.1 (17 February 2026)

Hi all — I’d like to share a project I’ve been building: Ochat.

• Repo: https://github.com/dakotamurphyucf/ochat
• Demo: https://youtu.be/eGgmUdZfnxM

<tool mcp_server="stdio:npx -y brave-search-mcp" name="brave_web_search" />

<config model="gpt-5.2" reasoning_effort="medium" />

<!-- core built-ins -->
<tool name="read_dir"/>
<tool name="read_file"/>
<tool name="apply_patch"/>
<tool name="webpage_to_markdown"/>

<!-- optional: import an external tool via MCP -->
<tool mcp_server="stdio:npx -y brave-search-mcp" name="brave_web_search" />

<!-- prompt-pack tools (agents as tools) -->
<tool name="plan"   agent="prompts/pack/plan.md" local/>
<tool name="code"   agent="prompts/pack/code.md" local/>
<tool name="review" agent="prompts/pack/review.md" local/>

<developer>
You are the orchestrator. Call plan first.
Keep edits small. Before apply_patch: explain the diff and wait for confirmation.
</developer>

<user>
Add a Quickstart section to README.md.
</user>

dune exec chat_tui -- -file prompts/refactor.md

Added (aka implemented) Win32 support, which has not been thoroughly tested, but may be useful for certain target use cases.

It is with extraterrestrial excitement that I announce the next release of Slipshow:

Slipshow 0.9.0: Manim Black

The featured new feature of this release is the ability to easily integrate Manim videos in your presentation.

https://github.com/user-attachments/assets/f67bb8fc-c288-4ff3-b6bc-e72c12e636a7

Note that, compared to just playing a video, you can schedule pauses, go faster to the next pause, and go back to the previous pauses, as showcased below.

We are looking for an OCaml engineer to join whitesky.cloud to work on low-level distributed infrastructure components.

About the work

You will work on core building blocks of a sovereign cloud platform, including distributed storage and coordination services.

Examples of related projects:

• https://github.com/openvstorage/alba
• https://github.com/openvstorage/arakoon

The work involves:

• Distributed systems design and implementation
• High-performance networking and I/O
• Linux systems programming
• Debugging and optimizing behavior under real production load
• Long-running services where reliability and correctness matter

This is infrastructure work, not web development.

—

What we are looking for

• Strong OCaml experience or strong systems programming background with willingness to work in OCaml
• Good understanding of:
  • Linux internals
  • Networking / TCP/IP
  • Concurrency and performance
• Interest in distributed systems, storage, or consensus algorithms

We care more about systems thinking and engineering depth than about specific frameworks.

—

Practical details

• Full-time position
• Fully remote
• Location: EMEA or Asia
• Salary: around €3000/month (depending on experience and location)

We know this is not a big-tech salary. We are a small engineering-driven company, and the role is aimed at engineers who enjoy working close to the system, solving real infrastructure problems, and having a direct impact.

—

About whitesky

whitesky builds a complete cloud platform based on Linux and KVM, focused on sovereignty and control. The platform is used by MSPs, SaaS providers and enterprises to run their own cloud infrastructure.

You will be working on components that run in production environments and form part of a distributed cloud stack.

—

If this sounds interesting, please contact:

geert.audenaert@whitesky.cloud

or send a DM.

We are happy to answer questions or discuss whether this could be a good fit.

I’m excited to announce the release of grace 0.3.0, an OCaml library for building, reporting and rendering beautiful compiler diagnostics :camel: :paintbrush:. Now available on opam-repository.

This release includes:

• :window: Windows support: Grace now works on Windows, a long-awaited feature since its 0.1.0 release! :rocket:
• :keyboard: TTY auto-detection: Grace_ansi_renderer can now automatically configure itself based on whether the output channel is a TTY. New functions: pr_diagnostic, epr_diagnostic, and output_diagnostic.
• :elephant: Line elision: Grace_ansi_renderer now elides unnecessary lines in diagnostics, producing more focused output.
• :zero: Zero-width ranges: Grace_ansi_renderer can now handle zero-width ranges within lines, as well as at end-of-line (EOL) and end-of-file (EOF) positions.

Many thanks to @giltho for their contributions to this release! :flexed_biceps:

I'm pleased to announce the joint release of js_of_ocaml and wasm_of_ocaml 6.3.

Js_of_ocaml is a compiler from OCaml bytecode to JavaScript. It makes it possible to run pure OCaml programs in JavaScript environment like browsers and Node.js.

Wasm_of_ocaml is a compiler from OCaml bytecode to WebAssembly. It is highly compatible with Js_of_ocaml, so you can compile your programs with wasm_of_ocaml instead of js_of_ocaml and experience overall better performance.

Most significant changes (since 6.1):

• Number unboxing for wasm_of_ocaml: a type analysis pass now tracks which values are floats, integers, or nativeints, enabling the compiler to unbox them and use native Wasm instructions directly. This also enables specialisation of number comparisons and bigarray operations, avoiding costly generic runtime calls.
• Constant sinking for js_of_ocaml: a new optimisation pass moves constants closer to their use sites, reducing register pressure. Many constants end up inlined, resulting in smaller code size.
• JS parser improvements: support for import/export attributes, decorators, using declarations (resource management), and HTML comments.
• Many bug fixes across the compiler, runtime, library bindings, and PPX.

See the Changelog for the full list of changes.

Hi,

I'd like to announce a new release for kqueue-ml version 0.5.0

Kqueue-ml: Thin bindings to kqueue event notification system.

Changes since the last release:

• Moved development to codeberg
• Remove dependencies on ppx_optcomp and ppx_expect (Dependencies are limited to the ocaml standard library and dune)

Best, Anurag

The Dune team announces the release of dune 3.21.1.

This is a small patch release consisting of a few bug fixes. See the full changelog for all the changes.

If you encounter a problem with this release, please report it in our issue tracker.

Here are links from many OCaml blogs aggregated at the ocaml.org blog.

• At the AI Impact Summit in Delhi: people, planet, progress
• OBuilder on Windows: Bringing Native Container Builds with the HCS Backend
• 1st TESSERA/CoRE hackathon at the Indian AI Summit