[Caml-list] Attn: Development Editor, Latest OCaml Weekly News

[Alan Schmitt <alan.schmitt@polytechnique.org>]

[-- Attachment #1.1.1: Type: text/plain, Size: 17629 bytes --]

Hello

Here is the latest OCaml Weekly News, for the week of May 12 to 19,
2026.

Table of Contents
─────────────────

hotseat Squava (a tiny LablGtk2 demo)
Request for comments: What to do with opam packages that have known security vulnerabilities
odoc 3.2.1 release
List your open OCaml positions on the OCaml.org job board
Cammy Stories: a small OCaml webcomic experiment 🐫
MlFront_ProgressZig - Zig-compatible progress trees
loo - lua of ocaml
Old CWN


hotseat Squava (a tiny LablGtk2 demo)
═════════════════════════════════════

  Archive:
  <https://discuss.ocaml.org/t/ann-hotseat-squava-a-tiny-lablgtk2-demo/17957/2>


Continuing this thread, Damien Guichard announced
─────────────────────────────────────────────────

  Newer 1.2 version, now detects eventual draw games.

  <https://pastebin.com/DjZ03yPa>


Request for comments: What to do with opam packages that have known security vulnerabilities
════════════════════════════════════════════════════════════════════════════════════════════

  Archive:
  <https://discuss.ocaml.org/t/request-for-comments-what-to-do-with-opam-packages-that-have-known-security-vulnerabilities/18087/1>


Hannes Mehnert announced
────────────────────────

  Dear everyone,

  we (the OCaml security) team is curious what the practice should be
  for opam packages that have known security vulnerabilities?

  One way is to mark them with `available: false' in the
  opam-repository, which will make them not installable (apart from if
  you manually edit the opam file).

  Especially for the OCaml compiler it is a tricky question: the recent
  vulnerability (in Marshal) affects everything < 4.14.3 | > 5 & < 5.4.1
  – so marking these compilers as unavailable will result in lots of
  projects that require such older OCaml versions to not be easily
  installable anymore. Especially since the Marshal issue is not exposed
  in many (any?) applications, it feels wrong to disallow / make it hard
  for anyone to install these compilers.

  Some ideas we have for the future:
  • annotate the exact function(s) that is/are vulnerabile in the
    security advisory (thus, you could automatically search for use of
    that function)
  • provide an "opam audit" which takes the advisory database and
    inspects your opam switch whether you have installed any vulnerable
    package

  But for the short & medium term, we'd appreciate input on what to do
  with normal opam packages that have advisories; and also whether to
  treat the compiler packages differently or not.


odoc 3.2.1 release
══════════════════

  Archive: <https://discuss.ocaml.org/t/ann-odoc-3-2-1-release/18088/1>


Jon Ludlam announced
────────────────────

  The odoc team is pleased to announce the release of odoc 3.2.1!


Highlights
╌╌╌╌╌╌╌╌╌╌

◊ OCaml 5.5.0 support

  odoc now compiles against, and produces documentation for, OCaml 5.5.0
  (@panglesd, @xvw, [#1406]).


  [#1406] <https://github.com/ocaml/odoc/issues/1406>


◊ OxCaml support

  odoc now supports OxCaml natively, thanks to @lukemaurer and @art-w
  ([#1399]). Right now this is very bare-bones, but full support for the
  various features of OxCaml is already in progress. If you're
  interested, check out the [PRs]!

  One thing worth flagging: because OxCaml is moving much faster than
  upstream OCaml, each odoc release will likely support only a single
  OxCaml release, in contrast to our usual policy of supporting every
  OCaml back to 4.08. If you're documenting an OxCaml project, please
  use a matched pair of odoc and oxcaml-compiler.


  [#1399] <https://github.com/ocaml/odoc/issues/1399>

  [PRs] <https://github.com/ocaml/odoc/pulls>


Added
╌╌╌╌╌

  • Persistent LaTeX macros in the HTML/KaTeX backend (@dlesbre,
    [#1391]).
  • The `markdown-generate' command now accepts multiple `.odocl' files
    in a single invocation, so you no longer need to wrap it in a shell
    loop (@davesnx, [#1387]).


[#1391] <https://github.com/ocaml/odoc/issues/1391>

[#1387] <https://github.com/ocaml/odoc/issues/1387>


Changed / Fixed
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌

  • Fixed two long-standing compile-time crashes, [#930] and #1385
    (@jonludlam, [#1400]).
  • The Markdown backend now assumes `ocaml' as the language id on
    declarations, and collects code snippets into a single block with
    comments rather than splitting variants/records per
    constructor/field.
  • URL remapping now works correctly for page references (@jonludlam,
    [#1395]).
  • Incremental builds no longer break under the conditions described in
    [#1396] (@jonludlam, [#1402]).
  • `--warn-error' now reliably promotes all warnings to errors
    (@jonludlam, [#1402]).
  • Polymorphic arguments are no longer missing their parentheses
    (@art-w, [#1404]).
  • Fixed a regression that broke docs for packages depending on ~base
    ~under OCaml 5.5.0 (@jonludlam, [#1426], [#1427]).
  • Fixed a regression that broke docs for packages depending on
    `merlin-lib' (@jonludlam, [#1429], [#1430]).


[#930] <https://github.com/ocaml/odoc/issues/930>

[#1400] <https://github.com/ocaml/odoc/issues/1400>

[#1395] <https://github.com/ocaml/odoc/issues/1395>

[#1396] <https://github.com/ocaml/odoc/issues/1396>

[#1402] <https://github.com/ocaml/odoc/issues/1402>

[#1404] <https://github.com/ocaml/odoc/issues/1404>

[#1426] <https://github.com/ocaml/odoc/issues/1426>

[#1427] <https://github.com/ocaml/odoc/issues/1427>

[#1429] <https://github.com/ocaml/odoc/issues/1429>

[#1430] <https://github.com/ocaml/odoc/issues/1430>


Installation
╌╌╌╌╌╌╌╌╌╌╌╌

  ┌────
  │ opam update
  │ opam install odoc
  └────


Use
╌╌╌

  Please use [odoc_driver] to build and test your package's docs locally
  and to see how they will look on ocaml.org.

  Odig and Dune continue to work as before, no changes required. Full
  support for all of the features of odoc 3.x is being worked on in
  Dune.


[odoc_driver] <https://ocaml.github.io/odoc/odoc-driver/index.html>


Thanks
╌╌╌╌╌╌

  Thanks to everyone who contributed code, reviews, bug reports, and
  testing for this release: @art-w, @davesnx, @dlesbre, @jonludlam,
  @lukemaurer, @panglesd, and @xvw, and anyone else I've forgotten!

  As always, please report any issues on [github].


[github] <https://github.com/ocaml/odoc/issues>


List your open OCaml positions on the OCaml.org job board
═════════════════════════════════════════════════════════

  Archive:
  <https://discuss.ocaml.org/t/list-your-open-ocaml-positions-on-the-ocaml-org-job-board/11377/24>


Continunig this thread, Daniel Lamping announced
────────────────────────────────────────────────

  Please can I post this job that we are hiring for.

  • title: Senior Systems Software Engineer
  • link:
    <https://careers.cloud.com/jobs/senior-software-engineer-xenserver-toolstack-remote-united-kingdom>
  • locations: Remote, United-Kingdom
  • publication_date: 2026-05-14
  • company: Cloud Software Group
  • company_logo:
    <https://www.cloud.com/media_1e40e7d048f0117d4543c940f9e7433b549c08a03.svg>


Cammy Stories: a small OCaml webcomic experiment 🐫
═══════════════════════════════════════════════════

  Archive:
  <https://discuss.ocaml.org/t/cammy-stories-a-small-ocaml-webcomic-experiment/18128/1>


Ramiro Checa-Garcia announced
─────────────────────────────

  Hi everyone,

  I've been experimenting lately with ways to make technical topics feel
  a bit more visual and approachable, and somehow that ended up turning
  into a small hobby project called Cammy Stories.

  It's a collection of short comics about OCaml featuring a camel mascot
  ("Cammy") together with some familiar faces from the ecosystem like
  Dune, OPAM, Merlin and Odoc as characters and teammates.

  The idea is not to make formal tutorials or documentation, but rather
  playful visual explanations of concepts like variants, functors,
  concurrency, Dune stanzas, OPAM switches, and other OCaml topics I
  found interesting while learning and exploring the ecosystem.

  Most of the images were created through lots of iteration with AI
  image generation tools. Sometimes the results are surprisingly good,
  sometimes the text becomes nonsense, and occasionally random hearts
  appear for no reason. I've also kept many of the leftover drafts
  visible because I thought the process itself was funny and
  interesting.

  Functional programming communities tend to have a reputation for being
  quite technical and serious, and I sometimes feel that a more visual
  and community-driven approach could help make some of these ideas feel
  a bit more approachable. So this is mostly a small experiment in that
  direction.

  Feedback is very welcome, especially since there are probably
  technical inaccuracies or misleading ideas here and there. Suggestions
  for future topics, formats or concepts are also appreciated.

  At the moment, most pages also include small notes, side comments or
  short stories about how each comic was created, since the project is
  still very much in a discussion and experimentation phase.

  • 🔗 Live: <https://rchg.github.io/cammy/>
  • 🔗 Repo: <https://github.com/RCHG/cammy>

  Hope you enjoy it 🐫


MlFront_ProgressZig - Zig-compatible progress trees
═══════════════════════════════════════════════════

  Archive:
  <https://discuss.ocaml.org/t/ann-mlfront-progresszig-zig-compatible-progress-trees/18142/1>


jbeckford announced
───────────────────

  I am pleased to announce MlFront_ProgressZig. Install instructions,
  docs and examples further below.

  TLDR: It renders a progress tree (a generalization of a progress
  bar). The killer feature is rendering a single progress tree with
  progress data fed from compatible child/grandchild/etc processes (see
  2nd and 3rd examples). MlFront_ProgressZig is a port of Zig's
  `progress' standard library, with improvements for Windows and
  protocol compatibility with zig processes. The motivation and
  algorithm is at
  <https://andrewkelley.me/post/zig-new-cli-progress-bar-explained.html>. The
  port was initially AI-assisted; prompts for progress.zig [start at
  line 1 here] and Cabinet (government) data [starts on line 218 here].


[start at line 1 here]
<https://gitlab.com/dkml/build-tools/MlFront/-/blob/b8787f345238bfe131c4f92bbe141c96788c3b1a/src/MlFront_ProgressZig/Zig.ml>

[starts on line 218 here]
<https://gitlab.com/dkml/build-tools/MlFront/-/blob/b8787f345238bfe131c4f92bbe141c96788c3b1a/tests/DkZero_RuntimeC/SyntheticDemoD.ml#L218>

Examples: Normal Progress Tree
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌

  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
   What                                   Animation Link                             
  ───────────────────────────────────────────────────────────────────────────────────
   Cabinet officials since 1975           [https://asciinema.org/a/NWc2vbPeRQuOyGAa] 
   OCaml spawns a zig build               [https://asciinema.org/a/Tu9ofrH3ekKUCyLk] 
   OCaml spawns OCaml which spawns OCaml  [https://asciinema.org/a/Tdtt52iQqSsIXcku] 
  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  /Zig seems to have a bug, at least on Windows, where a zig parent
  can't collect data from an OCaml/zig child. That is why there are no
  "zig spawns OCaml" examples./


[https://asciinema.org/a/NWc2vbPeRQuOyGAa]
<https://asciinema.org/a/NWc2vbPeRQuOyGAa>

[https://asciinema.org/a/Tu9ofrH3ekKUCyLk]
<https://asciinema.org/a/Tu9ofrH3ekKUCyLk>

[https://asciinema.org/a/Tdtt52iQqSsIXcku]
<https://asciinema.org/a/Tdtt52iQqSsIXcku>


Example: Performance Monitoring
╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌

  Here is a snapshot of my single-threaded build system. The interesting
  parts of the call stack are added to the progress tree (basically
  `start' and `end_' around a function):

  ┌────
  │ $ ./dk0 distribute CommonsBase_Std-dist-win32 --library 'CommonsBase_Std@2.5.999911122233' dist-win32.u
  │ 
  │ [signify] New build key pair in t/k/build.pub and t/k/build.sec ...
  │ [signify] Distribute key pair among trusted coworkers only!
  │ ►0/2] distribute CommonsBase_Std-dist-win32
  │    └─ [2/5] prepare distribution
  │       └─ [29/32] get-object CommonsBase_Std.Toybox@0...
  │          └─ dl toybox-aarch64@toybox sz 806K
  │             └─ landley.net/toybox...oads/binaries/0.8.9
  │                └─ [0/1] MiB downloaded
  └────

  By seeing the "►" tree not update for more than 10 seconds, I could
  see that downloading a small 806K file from the `landley.net/toybox'
  webserver was killing the performance.
        It is easy to identify perf bottlenecks that last longer
        than 0.5 seconds.


Packages
╌╌╌╌╌╌╌╌

  • MlFront_Progress: The API which can be used with one of four
    backends. Includes the "silent" and "plain" backends.
  • MlFront_ProgressZig: The zig compatible backend (high refresh rate)
  • MlFront_ProgressPeriod: A backend which dumps the progress tree
    periodically to the console.

  Docs are at [https://dkml.gitlab.io/build-tools/MlFront/].


[https://dkml.gitlab.io/build-tools/MlFront/]
<https://dkml.gitlab.io/build-tools/MlFront/>


Installing It
╌╌╌╌╌╌╌╌╌╌╌╌╌

  I have it in the opam queue
  ([https://github.com/ocaml/opam-repository/pull/29918]) and don't
  expect it to be released until the AI thread is resolved. Install the
  bleeding edge with:

  ┌────
  │ for pkg in MlFront_Progress MlFront_Core MlFront_Lua MlFront_ZipFile UnifiedScript_Std MlFront_Thunk MlFront_Console MlFront_ProgressZig; do
  │   opam pin add $pkg https://gitlab.com/dkml/build-tools/MlFront/-/releases/permalink/latest/downloads/MlFront.tar.gz
  │ done
  └────

  (Even though I document "AI" in a couple files, I do it for my own
  benefit, apply it narrowly, and keep it under my control. Among other
  things, I can't imagine there are many (American) attorneys who would
  say it is wise for me to proactively and quasi-permanently label
  packages as "AI assisted/etc.", so I'll keep my packages out of the
  opam repository if that becomes a new policy.)

  Enjoy!


[https://github.com/ocaml/opam-repository/pull/29918]
<https://github.com/ocaml/opam-repository/pull/29918>


loo - lua of ocaml
══════════════════

  Archive: <https://discuss.ocaml.org/t/ann-loo-lua-of-ocaml/18143/1>


Ben announced
─────────────

  Hi

  Like mentioned in the title this compiles Ocaml (Bytecode) into Lua
  (lua5.1). This project is ai generated, I tried to fully disclose that
  with the methods described in the project ocaml-ai-dislosure:

  <https://github.com/maltasea/lua_of_ocaml>


Old CWN
═══════

  If you happen to miss a CWN, you can [send me a message] and I'll mail
  it to you, or go take a look at [the archive] or the [RSS feed of the
  archives].

  If you also wish to receive it every week by mail, you may subscribe
  to the [caml-list].

  [Alan Schmitt]


[send me a message] <mailto:alan.schmitt@polytechnique.org>

[the archive] <https://alan.petitepomme.net/cwn/>

[RSS feed of the archives] <https://alan.petitepomme.net/cwn/cwn.rss>

[caml-list] <https://sympa.inria.fr/sympa/info/caml-list>

[Alan Schmitt] <https://alan.petitepomme.net/>


[-- Attachment #1.1.2: Type: text/html, Size: 29159 bytes --]

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 568 bytes --]