From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Authentication-Results: plum.tunbury.org; dkim=pass (1024-bit key; unprotected) header.d=inria.fr header.i=@inria.fr header.a=rsa-sha256 header.s=dc header.b=R/Dwhrj3; dkim-atps=neutral Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=192.134.164.83; helo=mail2-relais-roc.national.inria.fr; envelope-from=caml-list-owner@inria.fr; receiver=tunbury.org Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) by plum.tunbury.org (Postfix) with ESMTP id E4AFB400A6 for ; Tue, 13 Jan 2026 08:27:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inria.fr; s=dc; h=from:to:date:message-id:mime-version:subject:reply-to: sender:list-id:list-help:list-subscribe:list-unsubscribe: list-post:list-owner:list-archive; bh=IxoX8QWi2iB3ASQdTVt0SR2AYbs0/ZAnQb0IOiRwFBQ=; b=R/Dwhrj33+cYDqbRszWUJ5sNsIJZIYDdh0Wn8+NUYCL+cq4gkMf9HaSL 4pc4Gug9pmXitxQe0AxdzphCs8rQWCHfRNbujc9swx1d6nQPxNhkIy49+ pfX4c+5SWytfvRQlk/ji6U7OEupKh0XLAI8c4go2BfIMMhr9Yh9wxxEw+ w=; X-CSE-ConnectionGUID: 2LNp0p98SaKwI0o7mEk0Tg== X-CSE-MsgGUID: JZPBO3OcQsKuraAaAvbfhA== Authentication-Results: mail2-relais-roc.national.inria.fr; dkim=none (message not signed) header.i=none; spf=SoftFail smtp.mailfrom=caml-list-owner@inria.fr; spf=None smtp.helo=postmaster@prod-sympa-app.inria.fr Received-SPF: SoftFail (mail2-relais-roc.national.inria.fr: domain of caml-list-owner@inria.fr is inclined to not designate 128.93.162.27 as permitted sender) identity=mailfrom; client-ip=128.93.162.27; receiver=mail2-relais-roc.national.inria.fr; envelope-from="caml-list-owner@inria.fr"; x-sender="caml-list-owner@inria.fr"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 include:mailout.safebrands.com a:basic-mail.safebrands.com a:basic-mail01.safebrands.com a:basic-mail02.safebrands.com ip4:128.93.142.0/24 ip4:192.134.164.0/24 ip4:128.93.162.160 ip4:128.93.162.3 ip4:128.93.162.88 ip4:89.107.174.7 mx ~all" Received-SPF: None (mail2-relais-roc.national.inria.fr: no sender authenticity information available from domain of postmaster@prod-sympa-app.inria.fr) identity=helo; client-ip=128.93.162.27; receiver=mail2-relais-roc.national.inria.fr; envelope-from="caml-list-owner@inria.fr"; x-sender="postmaster@prod-sympa-app.inria.fr"; x-conformance=spf_only X-IronPort-AV: E=Sophos;i="6.21,222,1763420400"; d="scan'208,217";a="258264351" Received: from prod-sympa-app.inria.fr ([128.93.162.27]) by mail2-relais-roc.national.inria.fr with ESMTP; 13 Jan 2026 09:27:36 +0100 Received: by prod-sympa-app.inria.fr (Postfix, from userid 990) id 4E39582B83; Tue, 13 Jan 2026 09:27:36 +0100 (CET) Received: from mail2-relais-roc.national.inria.fr (mail2-relais-roc.national.inria.fr [192.134.164.83]) by prod-sympa-app.inria.fr (Postfix) with ESMTP id 614F982B79 for ; Tue, 13 Jan 2026 09:27:24 +0100 (CET) X-CSE-ConnectionGUID: sSDcl1XmQjGb4pPOMN8APg== X-CSE-MsgGUID: uBDrs8JJQu2kBC/bAl3REA== IronPort-SDR: 696601eb_8ZrTOq2/VKOlibYm7tk2oXFFWIwGQums4lgh9/pykzUB8wp TqtkFvysn7lvJ9gTIW6dL19psOFZ6vUwLau86lQ== X-ThreatScanner-Verdict: Negative X-IPAS-Result: =?us-ascii?q?A0E0BgAPAWZpgSIeaIFahBZbKRoBbF8zBwhJA4QZPIFjg?= =?us-ascii?q?WyOJZFNgjyGVlmBEIFpgSwWBR4VAQMBDS4BGwQBAgQBAQMBAgGCDIE9gTcCj?= =?us-ascii?q?G0CHwYBBDQTAQIEAQEBAQMCAwEBAQEBAQEBAQ0BAQUBAQECAQECBAYBAhABA?= =?us-ascii?q?T0FSYZPDYJFUVMeYQQDBgYBAQEBAQEBAQEBAQEBASIBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgQEBAEMBx0STg4JBAYTA?= =?us-ascii?q?QEsDBgjAxAEAQYDAhEBNRcBEhQGgmmCIAICTwMEAQwGj3ebTXp/M4EBggwBA?= =?us-ascii?q?QaBCD4FDgIPL9oQgWYJFIE5hW6CShsBBSVJawEChEkJhDQnD4FVRIEVgnlvg?= =?us-ascii?q?koXAQEBAQEXgQwSBgEBTQmDJYJpghEVehQdijUGiUaBRCIDJjMsAVUTFwsHB?= =?us-ascii?q?V6BCAMqLy1uMh2BIz4XMlgbBwWBeIkDD4lFgTQDC209NxQbkBBCGRyBXisOC?= =?us-ascii?q?gE1KS4LJgUBEwgOAiACNgQKKwoFIgkCBAkKBCUaBQYLDR4PjyeDMxAVAyqPX?= =?us-ascii?q?KIObTQHhB+BXgYMiQiBJotmiiGEBIFXpRAimGQigjaHKF1JCYFva4h6jCoQJ?= =?us-ascii?q?QcChVaBRzgjSWIBHQMJBzMaMEMNBoJUCUYcD4tIgjeBVgEHgkQQMX2BJnp6O?= =?us-ascii?q?7oKQjUCAQEKLgIHAQoBAQMJhUUdAQGMBzOBSwEB?= IronPort-PHdr: A9a23:a7bB2xAv+m8WlQg861A6UyQUi00Y04WdBeb1wqQuh78GSKm/5ZOqZ BWZua4xygeRFtyCuqIew8Pt8IneGkU4qa6bt34DdJEeHzQksu4x2yEGPouuJHa/EsTXaTcnF t9JTl5v8iLzG0FUHMHjew+a+SXqvnYdFRrlKAV6OPn+FJLMgMSrzeCy/IDYbxlViDanbr5/I hq7oR/NusUKjoduN7s9xx/Kr3dWZu9b2X5mKVWPkhnz4cu94IRt+DlKtfI78M5AX6T6f6AmQ rFdET8rLWM76tD1uBfaVQeB6WMSXWoPnhdWDAbL8Qn2UZjtvCT0sOp9wzSaMtbtTb8oQzSi7 rxkRwHuhSwaKjM26mDXish3jKJGvBKsogF0zoDIbI2JMvd1Y6TSc84HRWpaRsZeSTBOAp+yY YsICuoOJ+dYr4/grFcKohazAQygCeXywTFKm3D2x7U33eQ/Hw/b0gIuHN0Bv2jPodrvKKsfS /q4wLXUwTjBaf5dxDfz6JLPchAkufyBQbZwftDXyUIyCg3KklWQqYnkPzOJyuQGrm+W4PBkV e21jW4rsRpxrSSvxscpi4nJmp4Vx0vc9SV+xIY0JcG4R1Bnbt6kFptQtjiaN5ZoTc84RGFoo ik6x6QAtJWmcycE1I4pyATDa/ybbYeI+BTjWf6RLDp7mX9oeLGyiwuw/EauxePyVtS43lZXo ydLkdTCuG0B2wLd5MWEVvZw8Uev1SiP2Q3P6+xJL0E5mKTZJpMjxLM7i5QdsUPGHiDsmUX2i rebdl069ei06uTnfqvppoebN49xjwHxLL4imsqhDuQkKgQOWHSU9v651L3n50H5R69KjvIun qnWsZDaOcQbprOiDANPzokj7BO/Ay+p0NQZgXkHLE9Fdwmdg4joPFHCOPL4Deqkg1SwkTdrw e7JMqflApXKKnjPiKvufbFg5EFC0wU808pf551OBrEGOvLzVVf9tdLZDh86Mgy02/joB8h81 owEQ26PBbWZMKzKvV+J4OIvOeiMa5UPtDbzMfgp//nujWQnmVMHYKamw4UXZGi/Hvt6OUqZZ H7sjs0bHWcNpAo+Q/TmiFOfUT5VfnqyWL4z6Ss+CIKiF4vMWoetgLmZ0CehAJJWfX5JBUqWE Xj0d4WEQe0AaCWIIs9uijAFVb+hS5I91RGzrwD11aBrIfbT+i0drZ7sycJ65/HJmh0o6TN0C MOd03mVQ2Fvn2MIXSU2075xoUBnzVeDy6d4j+RfFdNP/fxJVwM6NYbGz+x9Edz9RgXBftKRR Fa8XNqpHTYxTtM1w9MUZEZ9Adqiggjf0CqqGb8VlqeLC4Yu8qLZxHjxO9x9y3HA1KkulVUpX 9VANXO+iq597QfTAZDGk16Fl6awa6sTwjLN+H2fwmqJuUFVVhN7X6bdXX0He0fas9D06lnfQ 7OyBrkrKAVMxdKYJqZEZdDllUhKSfXiNdjEY2+8mX28CQiHy7+SdobndXkR0SPAA0YeiQ8T5 2yJNQ0mCyehvW3eCDtuGErqY0Lj7OVysmu7TkgwzwCKc01uyaa6+h4ThfydUvMTw6wLtD0mq zVuE1axx9PWC9yeqAp9ZKhQfM0x7VNd2W7EqwBwMYasIq5+ilIEfQl6sFvi1xBtBYVBlcgqo mkqzA13Ka+AzV1Pay6W0YzoN7DLK2Ty/RehZrbU11/DyNuW4qAP6PA4qlX/og6mCkoi83Nm0 9lMznuT+I/GDA0IUZL+Sks47Rx6qKvcYiUn/IPbyX1sMay1sj/ex9IkH/AqyhG9f9dZLKyLC hTyH9cfB8WhJ+0mgV+pbggLPOxK7q47I9umd+ea2K6sJOtvgCipjWFD4Ixk1kKM9jF8SvLT0 pYew/CY2xOHWC3mgFegtMD3g4FEaisIEmqx0yjoHIhRabZqcoYRFWiuO9G3xsl5h5P1RnJU7 FGjCE0B2MGqYxSfd1zz0xFI2UQNv3Onhyi2wSZsnjEsoauTwTbCw/zldBoDOm9LWHdtgkvsI YiyjtAaRVWoYBYzmBui/0b6yLBXq7l8L2nSREdFZzD4IW5sXaWuqrSPf8hB5Is1viVSSuu8e 0yVR6blrRUDyy3tEHNSxCsjdzGkopj3hQB3hn+AInprt3rZYc9wyg/f5NPCQf5R2SILSjNkh DfKG1bvd+WuqJ+QiJGJ+rS6SGSJUoJVNy/m0dXE/CCy4GkvBRykg9iynMfmGE40y3zVzd5vA AzMpRC0WYLr0qWmLaozd01hAhnn4Mp/G51iupM3gIAM1HMagJSM4HdBln38Z4YIkZniZWYAE GZYi+Xe5xLojREyRpro74fwV3HHh9Bke8H/eGQdnCQ088FNDq6Qqr1Chyp85FSi/krKefYou DAbxLM17WICxfkTsV8kyiybRKsZHUxZITDEjxOM/syzp6VRZX+yfP63zkUt1cu5AuS6qxpHE G38Zo9kGCZx6stlN1eZ60fIstTNJtj1OI0o4wWTlwbcguNVLpMoi/dMgjBobGv5tHtj0OU7i B1ywbmwu5WBIGh2uqflElhfLDKmL9gL9GTVhL1F1t2Tw5jpHphlHWATW4D0SPuzDD8InfH3b kCWFzkttnqQGbzeBBKSrkB8oBojCriNMHeabDkcxNRmHlyGIVBHxRoTV3M8l4I4EQajwIrgd l1473Yf/AywrBwE0e9uOxTlNwWX7A61djc5ToSeJxtK/0lD4UnSK8mX8uN0GWlR4JSgqAWHL mHTaR5PCCkFXUmNBlarObfLh5GI+uyRAKylJPvLYKmSgfRZU+aUyJmv1Ip/4jvKMd+AfzFjA /A9xktfTCVhAc2K/ldHAycTli/Lc4uavELloHwx95jjtq+zHlmztu7tQ/NIPN5i+g67m/KGP u+U3mNiLCpAk4kLzjnOwaQe21gbj2dvcSOsGPIOr32oLuqYl6lJAhoccy42OtFP6vd25TN2Y Zvy1NLQg+FD2+YyD0ZZWFfhnMCweMFMJHuyYVrDDUDNL7+GIDzX3+n9Zr66QrBLyuAIp1u3o znRQCqBdnyT0iLkURyiK7QGhSWSOlpFs4G4cwpxIXDkSMP6Zxa7Nt5ukDBwxqc7zCCvVyZUI X13dEVDqaeV5CVTj6BkGmBP2XFiKPGNhyeT6+Swxo8+ifJwGWw0kutb5C5/0L5J9GReQ/czn iLOr9loqlXgk++VyzMhXgAc4jpMgYuKuw1lN8C7vtF7Y02cqTtT7EDFVC9fv9xhG8HisKBWy 8HSmeT0MjgX+tbd+40HDMjRKd6bGHAmLBziFSWSCVcVCzmxOgS9zwRRneqT+XucspUh4sG2y dxXEuMdDwRzTa9SA18tBNEYJZZrQj4o2aWWisIF/zvbzlGZRclXuIzGSuPHBPzuLDiDirwXL xAMwL7+McESLtiigR0kMwEm2t+SXRGMDrUv6mV7YwQ5oVtA6i17R2w3gQf+bx+1pWUUHriyl wI3jQ13ZaIs8i3t6hE5PAmvxmN4nU8vlNHimT3UfiT2KfL6ZrttU3/d6UkUZ8zAFh5yaRyuk EdkMjbdWr8XiKFvIGlvgQmaopBPHP9AUYVOZwIWzvyMIfB0wRJbsCrtliolraPVTIBvkgcna 8vmlEh7g1dKMt8QcPPrcbJOyklMi6mOuC6xy+13xxURck8J+WXUYyUIvU0UKpEsIDeu9eF3r wnei31EYmdGBJ9I6rp6s0g6PeqH1Sfp1bVOf1uwO+KoJKSco2HclMSMTwB4xgYSmkJC57Qzz dY7fh/eSRU01LXIXUdsV4KKOURPYsFV7nSWYSuerbCH38duJ4vkXqPpVbPc7fxFxBv8QEByR 8JXsoxCH4HwghiCfIG+dOJDkk1rv1mORh3NT/VRJEDayXFe+Zj5ksUxhNECbnIcGTsva33vv +SL/wNy0vPRA947PyVIAIdbZiBtA6jY02YavmweXmPvirtLlFGOt22l9HWMADSuPYU4OvvGO k8zUJnz8DE7ucBakHbv+47FbyH/PNVm4JrU7P8C4oyAALVSRKV8tEHVn89ZQWarWijBC4z9K 5/1YogqJdv6bxTyGkS4kC4wRtztMcyFK7jRxxnvQZdIvYKb2jE6KML7ESsRUxt9vOAM4qtga BZLOsBqJ0ew60Jlb+rkfE+RybDMCy61JCFTTuVDwOnyfLFRwyc2L6e7xHYmUpAm3ry3/EoKF 9kBihDTw+rmZpELCHKiXCUFJ0OU/WxiyzsEVK562Oo0zRLWvENJNjmKcLYsc2lYp5QmAljUJ 3xqC20+TlvajIzZ4wfq0apBmkkV19tSz+BBt2Dz+5HFZzf5EpeRks2AmnQhSI15mPhpNojyP saNtJXfhyHSCp7KvViMVCe8UeFRmt1RPD5wSv5Vn2ooIooD5ZoH7lA+HJRbRfQHGOw3q7amZ CAxRzYV1jMcXpic0SYqh/flnaPdkgaMfZ8iNh0drZgEhcESGX0TAGtWtOqoUIPYkHWBQ24AL VII7AhC0wkHk5d5YuHv5IebBI8J0TNdpOh4FzfaDpQ9vUWuUXmY2BKrLZfp2/zsxw9Zy+jgl 8UWSAIqQ1YI3P5YzwMhYPR+L61a1mYlmjWPaEXxsXmrzbe2Yl5Lxp+NH7UZJI/V7CzkVSkN5 XAfRYlO0WzSU5MInFggAE7OjE1LJJG6d03+4T092okvGKO3B5jD+g== IronPort-Data: A9a23:uVsvPKIUFf428uKnFE+RBZElxSXFcZb7ZxGr2PjKsXjdYENShGQAy mcaUT3SPP/cazf8fYolb4uwpB4P78CAy9BlGQId+CA2RRqmi+KVXIXDdh+Y0wC6d5CYEho/t 63yTvGacajYm1eF/k/F3oDJ9CQ6iOfRAOKhVYYoAwgpLSd8UiAtlBl/rOAwh49skLCRDhiE0 T/Ii5S31GSNhXguawr414rZ8Ekx5K2r42tB1rADTakjUGH2xyF94K03fvnZw0vQGuF8AuO8T uDf+7C1lkux1wstEN6sjoHgeUQMRLPIVSDW4paBc/XKbrBq/0Te445jXBYuQR8/Zwahw7id/ O5wWamYEm/FCEFjdNM1CHG0GwkmVUFPFSSuzXKX6aR/xGWeG5fgLmkH4Ojb8uT0984uaVyi+ 8D0JxgWVTyIg7uGxYu5ZeMwnvwECe+7FbsQ7yQIITHxVZ7KQLjGU/yM/dhczSs9jcBIHO/Da oweczUHgBboOkcefA5PVNRlxKHz2hETcBUAwL6RjZEN2DCG5VJw9e2yC4/NfdibWchenkCZv 3/LuWPjDUQTMNWZjyGO8netmvPnlyTmXokfD/u9qu4sh0ecroAWIEdLBQHl/aPk0yZSXfpCA WAO4XoMj5Evrk+BZZ73dhnjmlOt60t0t914SLBmtlrSksI4+T2xDWEBSntFacc6nNQnQCQjk F6PhdLgQzJ12IB5UlqY5u7StTS2KDQYJm8EZDYZQE0C+daLTJwPYgznVe1PG6rsvtjMGx76n yiyiw0Y15wrgptev0mkxmwrlQ5AsbDndGYICuj/W3L8qBt+YJ+5aoeo71nC8PsGK5yWJrVgg JTms5bBhAztJcjS/MBofAnrNOr0jxpiGGaH6WOD57F7q1yQF4eLJOi8Gg2S23uFwu5fJGO3O xCL0e+gzJJYO3+nJbdwZ5OtBs8qy6n5CNmtW+jPZcImX6WdgDSvpXk0DWbJhjiFuBF1wckC1 WKzK5fE4YAyU/U/lGLeqiZ0+eND+x3SMkuPG8qik0z3ieL2ibz8Ye5tDWZip9sRtMusyDg5O f4GXydT40QOCL/NcWPM/JQNLFsHC3E+CNqk44ZUb+OPaE4uUm0oF/abk/trdp1HjpZlsL7C3 ki8fUtEl3v5p3nMcjuRZl5ZNbjAYJdYrFAABxIKA2qG4XYZXNuQ3P8tTKdvJbgD385//MFwV MgAKpmhAOwQazHp+AY9TJjara5jfk+VmDPUATiBZWBncrU9WQfM8d7AVSns/RkoESCYm5Yfo bqh9wWDWrsFZV1oI/j3YcKV7WGanCYiisMreGWQOfhVWkHn0LYyGhzLlvVtfv09c0TS9AWVx yO9IEk+p9CUh6QX7dOQp6SPj7nxIttEBkAAQlXqt+enBxL7oFim75RLCtuTXDbnU2jxxqWuS MNVw9z4M9wFhFx6iJV9IZk60ZMB48bTmJECwjRGBHnra3GZOoFkKFSC3uhNsfRp7Z1dsg2UR EmO24d7PZOkBcDbK2MSdTEVNrm76fIpmzfp/asUJmf+73RJ57apaxhZECSNry1/F4FLFr0Z7 90vg+Ms0DznuCEWao6Hqgt261WzKmcxVvR7l5MCX67upAkZ6nBDRp3+FSWs8MyDROtOO2Z3O jSkuq7mguVN9FvjaFs2L2DGhsBGtKQNuTdL7V4MHEuIkdz7nc0K3AVd3DA0bwZNxDBF7r5DA XdqPEhLOqm+xTdkq8xdVWSKGQsaJhmm1mHu6lkOzkv1clKJUzHTEWgDJuq9xkAV3GZCdDx9/ rvD6mLEUy7vTf7hzBkJRk9phPzyf+NfrjSYtpicIP2EOJ0mbR7OoKykPzMIoiS6J/IBvhTMo O0y8dtgbaH+CzUrnJQ6LIunzpUVdgGPIT1TYPNm/Z5RJ1rmRhOJ5WGsJXyyK+R3HN6b1W+jC sdrGNBDaATm6gaKsQIgJPAtJ51aoacXweQsK5LRGH4+krqArzBWnora2QrgiUQKHdh/s8YPB bnAVjCFE2agimtwnUXTpulAYliHR94OYQns0N+I7e9SNZQisf5tQ242wLCbr3WYCyo53hO27 SfoRb7a8Pxm8qtox7DTK6RkAx6mDP/OT8GKzVyDiMtPZtbxLsv+jQMZhV35NQBwP7FKedBIu ZmSkdzwhmXpga0XVj3Hppy/CKV538W+c+5JOMbRLnMBvy+jWtfp0iQT6VKDNp1Fv9NM1PaJH zLiRpOLSucUfNNByFl+SStUSU8dApuqSJbQn3q2qvDUByUN1QDCEsicykboSmNmbQ4NBYz1D 17lmvSp5+0Alr92Oj0/O6hEDaN7cXjZYol3R+2p4HPcRiOtj0iZs7TvqQs45HuZQjOYGcL9+ tTeSgK4aB22v7rSwcpEt5Bp+CcaF2t5nfJ6a3d1FwSaUNxmJDVuwSUh3ZQ65lV8lzyrkon/Y CDRYWAiDyTkQDkCdg/ziDgmdhnKHfQAY78VORRwl354qQ/vbG9DPFel3i1n/nF9dyClyb23b 9YE9RUc+zCvl4pxS797CuOT2I9aKzCz+p7M0Vj6l93uDh0eB7QTyXEnGxBCPcAC/wchi22TT VUIqat4rI1XhKI//QuMu5KYJf3BgA7S8g== IronPort-HdrOrdr: A9a23:cLrpeK1VWJSwwI2jTvQTaQqjBKkkLtp133Aq2lEZdPUCSKKlfq eV7ZYmPH7P6Ar5N0tLpTntAsS9qBDnlKKdn7NhXotKNTOO0ACVxepZgbcKrQeOJxHD X-Talos-CUID: 9a23:ufa222DcmxQPtIL6EzJc2EUQQ/AgS3/yxivIG2idLzZAcLLAHA== X-Talos-MUID: 9a23:S16/wgZOSeJgEOBTqhXAnioyFuVR/v6tImtKm7wC4POpHHkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.21,222,1763420400"; d="scan'208,217";a="258264251" X-MGA-submission: =?us-ascii?q?MDEqBFzSyl92XNirq+SJtL2g/Mdul5jg9gv4Ak?= =?us-ascii?q?Z4cyVPyczAFqER5NHV7ycy1gW2Rzc+L7s63EEMAK/euLDytCvqKLzVUG?= =?us-ascii?q?4+xTehdNZmS8tlh+bAggTlqjvLbbZE+fjsPH8Ft10h0E8Ug2llgchXjJ?= =?us-ascii?q?P6XR/dka3tTXI3mLA/KEPeVA=3D=3D?= Received: from mx1.polytechnique.org ([129.104.30.34]) by mail2-smtp-roc.national.inria.fr with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 Jan 2026 09:27:23 +0100 Received: from TM.local (unknown [176.57.242.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ssl.polytechnique.org (Postfix) with ESMTPSA id E665718143; Tue, 13 Jan 2026 09:27:22 +0100 (CET) From: Alan Schmitt To: "lwn" , caml-list@inria.fr Date: Tue, 13 Jan 2026 09:27:22 +0100 Message-ID: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=-=-=" X-AV-Checked: ClamAV using ClamSMTP at svoboda.polytechnique.org (Tue Jan 13 09:27:23 2026 +0100 (CET)) X-Spam-Flag: Unsure, tests=bogofilter, spamicity=0.461990, queueID=229801A369 X-Org-Mail: alan.schmitt.1995@polytechnique.org Subject: [Caml-list] Attn: Development Editor, Latest OCaml Weekly News Reply-To: Alan Schmitt X-Loop: caml-list@inria.fr X-Sequence: 19426 Errors-To: caml-list-owner@inria.fr Precedence: list Precedence: bulk Sender: caml-list-request@inria.fr X-no-archive: yes List-Id: List-Help: , List-Subscribe: , List-Unsubscribe: , List-Post: List-Owner: List-Archive: Archived-At: --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello Here is the latest OCaml Weekly News, for the week of January 06 to 13, 2026. Table of Contents =E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2= =94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94= =80 camlid: A library for building C stub generators restricted 1.1 - Restrict possible system operations and filesystem view of= your program OCaml Security Team 2025 End-Of-Year Report Lwt.6.0.0 release (direct-style, tracing) Other OCaml News Old CWN camlid: A library for building C stub generators =E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2= =95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95= =90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90= =E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2= =95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95= =90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90 Archive: Fran=C3=A7ois Bobot announced =E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2= =94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94= =80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80 Dear all, I'm happy to announce the first release of [camlid] ([documentation]). While there are many C stub generators for OCaml, **camlid** takes a different approach: it is an OCaml library designed to help you build custom C stub generators. *Key Comparisons*: =E2=80=A2 Vs. *Ctypes*: Manipulation of C structures stays in C. You don't need to replicate C type descriptions in OCaml, keeping the compilation and maintenance simple. =E2=80=A2 Vs. *Camlidl/SWIG*: The generator is written in pure OCaml. This makes it easier to factorize and customize your bindings without resorting to `m4', `sed', or complex external DSLs. *Highlighted Features*: =E2=80=A2 *Library-specific initialization*: Easily handle data structure setup. =E2=80=A2 *Native Optimization*: supports `unboxed~/~untagged' parameters= in native mode. =E2=80=A2 *Automated Definitions*: Automatically generates the C/OCaml definitions your generated code uses. Referencing a generated C function name in your generated OCaml code automatically triggers its generation in the C file. =E2=80=A2 *Free Variables*: Generated functions can contain free variables that are automatically added as formal parameters. This allows you to easily pass a global "context" or "handle" through a generic function without manual boilerplate. *Example Usage*: Using the built-in helpers, a generator is as simple as: =E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80 =E2=94=82 open Camlid =E2=94=82 open Helper =E2=94=82=20 =E2=94=82 let () =3D Generate.to_file =E2=94=82 (* Indicates the basename used for the generated files *) =E2=94=82 "mylib" =E2=94=82 (* Indicates header to include *) =E2=94=82 ~headers:["alib.h"] =E2=94=82 [ =E2=94=82 func "f_input" [ input int_trunc]; =E2=94=82 func "f_output" [ output (ptr_ref int_trunc)]; =E2=94=82 func "f_with_res" [] ~result:int_trunc; =E2=94=82 func "f_no_arg_no_result" []; =E2=94=82 ] =E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80 Only the `mli' of the generated module remains to be written with the documentation. For the first function above, the parameter is correctly marked as `untagged' (for OCaml versions that support it): =E2=94=8C=E2=94=80=E2=94=80=E2=94=80=E2=94=80 =E2=94=82 external f_input: (int [@untagged]) -> unit =3D "camlid_stub_f_= input_byte" "camlid_stub_f_input" =E2=94=94=E2=94=80=E2=94=80=E2=94=80=E2=94=80 A more complex example (converting the `flint' binding from Ctypes) can be found [here]. The API is still experimental, and I would love to hear your feedback on the organization and naming! The package is already in the opam repository. (The [modern-ocaml] template is awesome!) [camlid] [documentation] [here] [modern-ocaml] restricted 1.1 - Restrict possible system operations and filesystem view of= your program =E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2= =95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95= =90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90= =E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2= =95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95= =90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90= =E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2= =95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95= =90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90= =E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2= =95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90 Archive: removewingman announced =E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2= =94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94= =80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80 Hello, I would like to announce a new package [restricted]. This library lets you limit which system operations and which parts of the filesystem your program can access. Call it as early as possible in your program so that the rest of the code runs with reduced privileges. Currently, actual enforced restrictions are implemented for these operating systems: =E2=80=A2 OpenBSD Even on other operating systems, you can still use `restricted' to document which privileges your program needs. Users can then test that your program respects these promises with tools such as [pledge on Linux]. Enjoy ;) =E2=80=A2 opam: =E2=80=A2 homepage: =E2=80=A2 Documented Interface and Examples: =E2=80=A2 License: [AGPL] This is my first ocaml library so feel free to give feedback. [restricted] [pledge on Linux] [AGPL] OCaml Security Team 2025 End-Of-Year Report =E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2= =95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95= =90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90= =E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2= =95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95= =90=E2=95=90 Archive: Hannes Mehnert announced =E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2= =94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94= =80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80 OCaml Security Team 2025 End-Of-Year Report =E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2= =95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95= =8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C= =E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2= =95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95= =8C=E2=95=8C In May of 2025, the OCaml Software Foundation encouraged the formation of an OCaml Security Team, which would handle issues and provide guidance for improving software security in the OCaml ecosystem. Throughout 2025, the team has been building structure and procedures to accomplish these goals. A regular public update on the team's activity is among many good ideas taken from the Haskell Security Response Team, and we hope the community will find this first public update useful. The team consists of: =E2=80=A2 Hannes Mehnert - @hannesm - individual, robur.coop =E2=80=A2 Mindy Preston - @yomimono - individual =E2=80=A2 Joe - @cfcs - individual =E2=80=A2 Edwin T=C3=B6r=C3=B6k - @edwintorok - individual =E2=80=A2 Nicol=C3=A1s Ojeda B=C3=A4r - @nojb - LexiFi =E2=80=A2 Louis Roch=C3=A9 - @Khady - ahrefs =E2=80=A2 Boning Dong - Bloomberg Until December 2025: =E2=80=A2 Maxim Grankin - @maxim092001 - Bloomberg The newly created website [ocaml.org/security] gives some guidelines for people finding security issues. [ocaml.org/security] Contact and Disclosure Process =E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2= =95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95= =8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C= =E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C The team established a procedure for reporting security issues as one of its first activities. The security disclosure process is available at . The OCaml Security Team can also be contacted at security@ocaml.org for matters besides vulnerability disclosure. Mails to security@ocaml.org are not public. The public, announce-only mailing list will broadcast information on security advisories. These procedures were [announced in July 2025]. [announced in July 2025] Vulnerability Database =E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2= =95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95= =8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C A public vulnerability database for OCaml software is another of the Security Team's goals. We indend to accomplish this by publishing information from the existing, but empty to the public [osv.dev] database (again borrowing a good idea from the Haskell SRT). Some work on a pipeline for publishing advisories there and backporting existing advisories is ongoing. [osv.dev] Tool development =E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2= =95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C An OCaml library that supports the [package URL] "purl" was developed and released to the opam-repository (, ). In the process, we propose to make the policy for opam-repository more strict to have immutable packages (where the source is not modified): . We also propose to integrate opam into the package URL specification . The vulnerability database mentioned above hosts advisories in markdown (with some opam-file-format metadata header). We developed [tooling] to convert these into json (following the json schema from osv.dev). We also made OCaml/opam known for the schema . [package URL] [tooling] Public Meetings and Presentations =E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2= =95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95= =8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C= =E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C On September 15, Hannes Mehnert gave an introduction to the OCaml Security Team at [FUN OCaml] in Warsaw. Maxim Grankin gave a talk ["Towards a More Secure OCaml Ecosystem"] at the OCaml Users and Developers Workshop in October of 2025, which is available at . On October 22 2025, the Security Team held a public meeting, for which the notes are available at . [FUN OCaml] ["Towards a More Secure OCaml Ecosystem"] Advisories =E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2= =95=8C=E2=95=8C A potential clickjacking issue with ocurrent's web interface was reported to the Security Team by Kunal Mhaske was fixed by Mark Elvers in . No other communications with the security team have resulted in publicly available remediation information or advisories. Future Plans =E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2= =95=8C=E2=95=8C=E2=95=8C=E2=95=8C The Security Team has received a lot of interest in the advisory database mentioned above, and this work is a high priority for the team. The Security Team also hopes to publish security guides for OCaml programmers and project maintainers. The OCaml Software Foundation has indicated that some funding may be available for projects that make OCaml more secure. The Security Team is actively developing a process for soliciting and evaluating proposals, as discussed in the October public meeting. Acknowledgements =E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2= =95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C=E2=95=8C The Security Team is an initiative of the OCaml Software Foundation and is grateful to the OCSF and its sponsors for their support. Lwt.6.0.0 release (direct-style, tracing) =E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2= =95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95= =90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90= =E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2= =95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90 Archive: Rapha=C3=ABl Proust announced =E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2= =94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94= =80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80 Version 6.0.0 of Lwt has been [released] through opam! This new version of Lwt brings the following notable additions: =E2=80=A2 Lwt_direct: a package/library for using Lwt in direct-style. (Contribution from @c-cube) =E2=80=A2 Lwt_runtime_events: a package/library for emmitting runtime-eve= nts. Check the [release notes] for a full changelog), including removal of some deprecated values. [released] [release notes] Other OCaml News =E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2= =95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90 >>From the ocaml.org blog =E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2= =94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94= =80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80 Here are links from many OCaml blogs aggregated at [the ocaml.org blog]. =E2=80=A2 [OCaml Roundup: December 2025] =E2=80=A2 [Opam 104: Sharing Your Code] =E2=80=A2 [Devcontainer for using O(x)Caml and Claude in your projects] =E2=80=A2 [What would make OCaml serverless ready?] =E2=80=A2 [Fun with Algebraic Effects - from Toy Examples to Hardcaml Simulations] [the ocaml.org blog] [OCaml Roundup: December 2025] [Opam 104: Sharing Your Code] [Devcontainer for using O(x)Caml and Claude in your projects] [What would make OCaml serverless ready?] [Fun with Algebraic Effects - from Toy Examples to Hardcaml Simulations] Old CWN =E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90=E2=95=90 If you happen to miss a CWN, you can [send me a message] and I'll mail it to you, or go take a look at [the archive] or the [RSS feed of the archives]. If you also wish to receive it every week by mail, you may subscribe to the [caml-list]. [Alan Schmitt] [send me a message] [the archive] [RSS feed of the archives] [caml-list] [Alan Schmitt] --=-=-= Content-Type: text/html; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable OCaml Weekly News

OCaml Weekly News

Previous Week<= /a> Up Next Week

Hello

Here is the latest OCaml Weekly News, for the week of January 06 to 13, 202= 6.

camlid: A library for building C stub generators

Archive: https://discuss.ocaml.org/t/ann-camlid-a-= library-for-building-c-stub-generators/17679/1

Fran=C3=A7ois Bobot announced

Dear all,

I'm happy to announce the first release of camlid (documentation).

While there are many C stub generators for OCaml, camlid take= s a different approach: it is an OCaml library designed to help you build c= ustom C stub generators.

Key Comparisons:

  • Vs. Ctypes: Manipulation of C structures stays in C. You don't n= eed to replicate C type descriptions in OCaml, keeping the compilation and = maintenance simple.
  • Vs. Camlidl/SWIG: The generator is written in pure OCaml. This m= akes it easier to factorize and customize your bindings without resorting t= o m4, sed, or complex external DSLs.

Highlighted Features:

  • Library-specific initialization: Easily handle data structure se= tup.
  • Native Optimization: supports unboxed~/~untagged pa= rameters in native mode.
  • Automated Definitions: Automatically generates the C/OCaml defin= itions your generated code uses. Referencing a generated C function name in= your generated OCaml code automatically triggers its generation in the C f= ile.
  • Free Variables: Generated functions can contain free variables t= hat are automatically added as formal parameters. This allows you to easily= pass a global "context" or "handle" through a generic function without man= ual boilerplate.

Example Usage: Using the built-in helpers, a generator is as simple = as: 

open C=
amlid
open Helper

 let () =3D Generate.to_file
    (* Indicates the basename used for =
the generated files *)
    "mylib"
    (* Indicates header to include *)
    ~headers:["alib.h"]
  [
    func "f_input" [ input int_trunc=
];
    func "f_output" [ output (ptr_re=
f int_trunc)];
    func "f_with_res" [] ~result:int_trunc;
    func "f_no_arg_no_result" [];
  ]

Only the mli of the generated module remains to be written wit= h the documentation. For the first function above, the parameter is correct= ly marked as untagged (for OCaml versions that support it): 

external f_input: =
(int [@untagged]) -> unit =3D "camlid_stub_f_input_byte" "camlid_stub_f_input"

A more complex example (converting the flint binding from Ctyp= es) can be found = here.

The API is still experimental, and I would love to hear your feedback on th= e organization and naming! The package is already in the opam repository.

(The modern-ocaml te= mplate is awesome!)

restricted 1.1 - Restrict possible system operations and files= ystem view of your program

Archive: ht= tps://discuss.ocaml.org/t/ann-restricted-1-1-restrict-possible-system-opera= tions-and-filesystem-view-of-your-program/17681/1

removewingman announced

Hello,

I would like to announce a new package restricted.

This library lets you limit which system operations and which parts of the = filesystem your program can access. Call it as early as possible in your pr= ogram so that the rest of the code runs with reduced privileges. Currently,= actual enforced restrictions are implemented for these operating systems:

  • OpenBSD

Even on other operating systems, you can still use restricted = to document which privileges your program needs. Users can then test that y= our program respects these promises with tools such as pledge on Linux. Enjoy ;)

This is my first ocaml library so feel free to give feedback.

OCaml Security Team 2025 End-Of-Year Report

Archive: https://discuss.ocaml.org/t/ocaml-security-team-2= 025-end-of-year-report/17689/1

Hannes Mehnert announced

OCaml Security Team 2025 End-Of-Year Report

In May of 2025, the OCaml Software Foundation encouraged the formation of a= n OCaml Security Team, which would handle issues and provide guidance for i= mproving software security in the OCaml ecosystem. Throughout 2025, the tea= m has been building structure and procedures to accomplish these goals. A r= egular public update on the team's activity is among many good ideas taken = from the Haskell Security Response Team, and we hope the community will fin= d this first public update useful.

The team consists of:

  • Hannes Mehnert - @hannesm - individual, robur.coop
  • Mindy Preston - @yomimono - individual
  • Joe - @cfcs - individual
  • Edwin T=C3=B6r=C3=B6k - @edwintorok - individual
  • Nicol=C3=A1s Ojeda B=C3=A4r - @nojb - LexiFi
  • Louis Roch=C3=A9 - @Khady - ahrefs
  • Boning Dong - Bloomberg

Until December 2025:

  • Maxim Grankin - @maxim092001 - Bloomberg

The newly created website ocaml.org/= security gives some guidelines for people finding security issues.

Contact and Disclosure Process

The team established a procedure for reporting security issues as one of it= s first activities. The security disclosure process is available at https://github.com/ocaml/security-advisories?tab=3Dre= adme-ov-file#reporting-vulnerabilities . The OCaml Security Team can al= so be contacted at security@ocaml.org for matters besides vulnerability dis= closure. Mails to security@ocaml.org are not public.

The public, announce-only mailing list https://sympa.inria.fr/sympa/in= fo/ocsf-ocaml-security-announcements will broadcast information on secu= rity advisories.

These procedures were announced in July 2025.

Vulnerability Database

A public vulnerability database for OCaml software is another of the Securi= ty Team's goals. We indend to accomplish this by publishing information fro= m the existing, but empty https://github.com/ocaml/security-advisories to the public osv.dev database (again borrowing a good idea f= rom the Haskell SRT). Some work on a pipeline for publishing advisories the= re and backporting existing advisories is ongoing.

Tool development

An OCaml library that supports the package URL "purl" was developed and released to the opam-= repository (https://github.com/= hannesm/purl, https://ocaml= .org/p/purl/latest). In the process, we propose to make the policy for = opam-repository more strict to have immutable packages (where the source is= not modified): https://github.com/ocaml/opam-repository/pull/29072. We also propo= se to integrate opam into the package URL specification https://github.com/package-url/p= url-spec/pull/763.

The vulnerability database mentioned above hosts advisories in markdown (wi= th some opam-file-format metadata header). We developed tooling to convert these into json (foll= owing the json schema from osv.dev). We also made OCaml/opam known for the = schema https://gith= ub.com/ossf/osv-schema/pull/473.

Public Meetings and Presentations

On September 15, Hannes Mehnert gave an introduction to the OCaml Security = Team at FUN OCaml in Warsaw.

Maxim Grankin gave a talk "To= wards a More Secure OCaml Ecosystem" at the OCaml Users and Developers = Workshop in October of 2025, which is available at https://www.youtube.com/watch?v=3DPekeGxG= lc3Q .

On October 22 2025, the Security Team held a public meeting, for which the = notes are available at https://pad.data.coop/7-Ic5rG6ToynsW02hJsndg?both .

Advisories

A potential clickjacking issue with ocurrent's web interface was reported t= o the Security Team by Kunal Mhaske was fixed by Mark Elvers in https://github.com/ocurrent/= ocurrent/pull/465 .

No other communications with the security team have resulted in publicly av= ailable remediation information or advisories.

Future Plans

The Security Team has received a lot of interest in the advisory database m= entioned above, and this work is a high priority for the team.

The Security Team also hopes to publish security guides for OCaml programme= rs and project maintainers.

The OCaml Software Foundation has indicated that some funding may be availa= ble for projects that make OCaml more secure. The Security Team is actively= developing a process for soliciting and evaluating proposals, as discussed= in the October public meeting.

Acknowledgements

The Security Team is an initiative of the OCaml Software Foundation and is = grateful to the OCSF and its sponsors for their support.

Lwt.6.0.0 release (direct-style, tracing)

Archive: https://discuss.ocaml.org/t/ann-lwt-6-0-0-release-= direct-style-tracing/17690/1

Rapha=C3=ABl Proust announced

Version 6.0.0 of Lwt has been released through opam! This new version of Lwt brings = the following notable additions:

  • Lwt_direct: a package/library for using Lwt in direct-style. (Contribut= ion from @c-cube)
  • Lwt_runtime_events: a package/library for emmitting runtime-events.

Check the rel= ease notes for a full changelog), including removal of some deprecated = values.

Old CWN

If you happen to miss a CWN, you can send me a message and I'll mail it to you, or go take a loo= k at the archive or the <= a href=3D"https://alan.petitepomme.net/cwn/cwn.rss">RSS feed of the archive= s.

If you also wish to receive it every week by mail, you may subscribe to the= caml-list.

--=-=-=--