This is the release of opam 2.5.1.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Please see our blog post for more details and the upgrade instructions.

Changelog:

Security fix

• OSEC-2026-03: Invalidate .install fields containing destination filepath trying to escape their scope [#6897 @kit-ty-kate - report by @andrew]

Other changes

• Fix a string injection from the depexts field to nix-build, when os-family=nixos [#6894 @RyanGibb]
• Restore the distribution detection on Gentoo [#6886 @kit-ty-kate - fix #6887]
• Add support for single-quoted values of the /etc/os-release file [#6886 @kit-ty-kate - fix #6887]
• Fix rare potential GC corruptions [#6882 #6880 @kit-ty-kate @avsm - report by @andrew]
• Improve and extend the testsuite [#6897 @rjbou @kit-ty-kate]
• API changes in opam-core:
  • OpamFilename.might_escape: ensure / is detected as a file separator when called with ~sep:Unspecified on Windows [#6897 @kit-ty-kate]

This is the final release of opam 2.5.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Changelog:

Changes

No significant change compared to 2.5.0~beta1.

To get the detailed list of changes compared to 2.4.1, you can look at the pre-releases' release notes:

• the release note for 2.5.0~alpha1
• the release note for 2.5.0~beta1
• the release note for 2.5.0~rc1

For a more descriptive and simplified list of changes, please read our blog post.

This is the first release candidate of opam 2.5.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Please see our blog post for the upgrade instructions.

Changelog:

Changes

No significant change compared to 2.5.0~beta1.

This is the first beta release of opam 2.5.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Please see our blog post for a highlight on the major changes and upgrade instructions.

Changelog:

Fixes

Sandbox

• Allow the macOS sandbox to write in the /var/folders/ and /var/db/mds/ directories as it is required by some of macOS core tools [#4797 @kit-ty-kate - fix #4389 #6460]

Update

• Fixed a bug occurring on version-equivalent package rename (i.e. pkg.00 -> pkg.0) leading to the package being completely removed [#6774 @arozovyk - fix #6754]

Dry-run mode

• Stop opam switch create --dry-run from creating switch root directory by stopping the creation of build directory and writing the switch-state cache [#6540 @hannesm - fix #5918]
• Stop cleaning the build directory when installing packages with --dry-run [#6540 @hannesm]

Other changes

Build changes

• Add the upcoming OCaml 5.5 (trunk) support when using dune's dev profile [#6670 @kit-ty-kate]
• opam no longer depends on cmdliner [#6755 @kit-ty-kate - fix #6425]
• Clean variables before calling make on different projects (e.g. downlodad-if-missing OCaml compiler) to avoid clashes with other variables set by these projects [#6769 @kit-ty-kate]

Internal changes

Improve the release script

• Fix the placement of the vendored archives in the release tarball [#6765 @kit-ty-kate - fix #6762]
• Fix the Windows build [#6769 @kit-ty-kate]

Testing

• Improve and extend the testsuite [#6540 #6774 @arozovyk @kit-ty-kate]
• Improve and extend the test infrastructure [#6732 @kit-ty-kate]

API updates

opam-state

• OpamRepositoryState.load_opams_from_diff: track added packages to avoid removing version-equivalent packages [#6774 @arozovyk - fix #6754]

opam-core

• OpamCmdliner: was added. It is the new internal interface for Cmdliner, accessible through a new opam-core.cmdliner sub-library, however it is meant for internal use only. [#6755 @kit-ty-kate]

This is the first alpha release of opam 2.5.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Please see our blog post for a highlight on the major changes and upgrade instructions.

Changelog:

Major changes

Opam update performance enhancement

• Implement incremental opam file loading to process only changed files during repository updates and repository state loading [#6614 @arozovyk - fix #5824]

Shell integration

• The variables.*sh script used for shell hooks now only updates the environment if OPAM_SWITCH_PREFIX is unset-or-empty [#6729 @dra27 - fix dbuenzli/topkg#142, #4649, #5761]
• Default to the .bashrc file instead of the .profile when writing the shell hook with bash during opam init [#6603 @kit-ty-kate - fix #5819 #4201 #3990]
• csh: Don't double-set unconditional variables in variables.csh and env_hook.csh [#6729 @dra27]

Installer script

• The shell/install.sh script now installs an appropriate apparmor profile on systems configured with apparmor [#6647 @kit-ty-kate - fix #5968]

Miscellaneous changes

Install

• Archives without checksums now fetch only once per call of opam install if their url match [#6627 @psafont - fix #5638]
• Do not ignore extra-files whose name is invalid and fail early in that case [#6679 @rjbou @kit-ty-kate]
• No longer ignore extra-files whose name is invalid and raise a warning in that case [#6679 @rjbou @kit-ty-kate]
• Raise a warning instead of a fatal uncaught exception when an item of extra-files is missing [#6696 @rjbou]
• [BUG] Fix erroneous recompilations on opam files with empty but present build/runtest/install/remove field [#6505 @kit-ty-kate - fix #5814]
• [BUG] Fix opam install pkg --depext-only exiting with code 0 instead of 20 (not found) [#6516 @rjbou - fix #6488]

Init

• Remove getconf from the list of required runtime tools, which allows opam init to work out-of-the-box on Haiku [#6634 @kit-ty-kate - fix #6632]

Var / Option

• Refine the specification of pkg:opamfile variable and update its computation accordingly [#6659 @kit-ty-kate - fix #5346]
• Make global option default-invariant modifiable [#6730 @rjbou]

Download

• [BUG] Fix parsing of OPAMFETCH (support quotes / proper POSIX shell syntax) [#5492 @kit-ty-kate - fix #5490]
• [BUG] Check the status of git submodules when checking if a repository is up-to-date [#6132 @kit-ty-kate]

Remove

• [BUG] Fix opam remove --force that was launching commands in current directory [#6672 @rjbou - fix #6570]

Lock

• [BUG] Fix opam lock's error message on pinned packages with no git remote by handling exit code 2 from git remote get-url [#6422 @rjbou]

Update

• [BUG] Fix the false-positive mismatch debug warning during opam update when faced with nested extra-files on Windows [#6715 @kit-ty-kate]

Depexts

• [BUG] Harden the parsing of apk policy on Alpine [#6742 @kit-ty-kate]

Improve the UI

• Show the invalid character when detecting an erroneous package name [#6638 @lefessan - fix #6396]
• Improve the error messages on opam source, especially in case of Failure [#6696 @rjbou]
• The name of missing or erroneous extra-files are now displayed instead of their path in error messages [#6679 @kit-ty-kate @rjbou]
• Remove duplicated directory separator when displaying some rare filenames [#6703 @rjbou]
• Handle non-displayable characters when detecting an erroneous package name or version [#6640 @kit-ty-kate]
• More fine grained error message in opam install in case of bad hash or missing extra-files error (and remove raw fatal error) [#6696 @rjbou]
• Update warning messages when the git remote is not found and when skipping local pins [#6422 @rjbou]
• Add an upgrade advice if the repository is 1.2 version, for all opam admin commands except upgrade [#6385 @rjbou]

Internal Changes

• Replace every polymorphic uses of List.mem by a version that doesn't use Repr.equal [#6644 @kit-ty-kate]
• Simplify the src_ext/update-sources.sh script [#6701 @kit-ty-kate]
• Homogeneise verbose command output between sandboxed and non sandboxed one [#6675 @rjbou]
• Add the install-pin-depends, ignore-pin-depends, proceed-actions and switch-clean-up named questions (for opam developers use only) [#6611 @kit-ty-kate @rjbou]
• Add logging for file reads and writes [#6679 @rjbou]
• Add cli version 2.5 [#6709 @kit-ty-kate]
• Add mechanism for the OPAMAUTOANSWER environment variable (for opam developers use only) [#6709 @kit-ty-kate]
• Complete upgrade mechanism to permit on the fly upgrade and write upgrade from repo and switch level [#6416 @rjbou]
• Enforce repository root check for every opam admin commands [#6385 @rjbou]

Build changes

• Update the dependency constraint on patch to now require its stable version [#6663 @kit-ty-kate]
• Update the download-if-missing dependencies to their latest version (re.1.14.0, dune.3.20.2, menhir.20250903) [#6700 @kit-ty-kate]
• Remove seq from the list of packages to download-if-missing as it is no longer a dependency of re [#6700 @kit-ty-kate]
• ./configure --enable-static is now supported on OpenBSD [#6705 @flumf]
• Add missing constraints to avoid cmdliner 2.0.0 [#6707 @kit-ty-kate]
• Add patch library dependency to opam-state [#6614 @arozovyk]
• Update the bootstrap compiler's flexdll to 0.44 [#6592 @MisterDA]
• Update the msvs-detect script used on Windows during compiler bootstrap to 0.7.0 [#6592 @MisterDA]

Improve the release script

• The OpenBSD binary now a full static binary [#6705 @flumf @kit-ty-kate - fix #6241]
• The release archive (opam-full-*.tar.gz) is now reproducible [#6706 @kit-ty-kate - fix #6619]

Testing and documentation

• Improve and extend the testsuite [#6673 #6450 #6638 #6627 #6640 #6671 #6690 #6688 #6691 #6659 #6659 #6675 #6715 #6614 #6719 #6611 #6679 #6153 #6516 #6672 #6741 #6729 #6505 #6422 #5492 #6385 @rjbou @kit-ty-kate @arozovyk @dra27]
• Improve and extend the benchmarks [#6681 @arozovyk]
• Improve and extend the test infrastructure [#6624 #6450 #6663 #6675 #6710 #6708 #6734 #6643 #6652 #6648 #6582 #6394 #6656 #6655 #6657 #6666 #6676 #6701 #6741 #6745 @kit-ty-kate @rjbou @arozovyk]
• Improve and extend the documentation [#6620 #6631 #6650 #6653 #6653 #6596 #6364 #6660 @kit-ty-kate @jmid @gahr @mbarbin @arozovyk]

API updates

opam-client

• OpamAdminRepoUpgrade: add upgradefrom_version that have version "1.2" hardcoded [#6391 @rjbou]
• OpamClientConfig.opam_init: now takes an optional auto_answer argument [#6709 @kit-ty-kate]

opam-repository

• OpamLocal.rsync_*: change the return type from OpamFilename.* to unit [#6658 @kit-ty-kate]
• OpamRepository.update: changed the 'Changes return type to include Patch.operation list of changes. [#6614 @arozovyk]
• OpamRepositoryBackend.update type : include the Patch.t list in Update_patch variant [#6614 @arozovyk]
• OpamRepositoryBackend.get_diff: include Patch.t list in the return type (along with filename) [#6614 @arozovyk]

opam-state

• OpamRepositoryState: add load_opams_from_diff to update package definitions based on file change operations (diff) [#6614 @arozovyk]
• OpamRepositoryState.get_repo_files: was added [#6679 @kit-ty-kate @rjbou]
• OpamSwitchState.files: was removed [#6662 @kit-ty-kate]
• OpamSwitchState.overlay_opam_file: was added [6679 @rjbou]

opam-format

• OpamFile.OPAM.get_metadata_dir: was removed [#6679 @kit-ty-kate]
• OpamFile.OPAM.get_extra_files: no longer takes a named repos_roots argument and instead takes a named get_repo_files argument. It also now returns the content of the files instead of their path [#6679 @kit-ty-kate @rjbou]
• OpamFormula: add equal function for OpamFormula.t [#6730 @rjbou]
• OpamFormula.equal_relop: was added [#6644 @kit-ty-kate]
• OpamTypesBase.{action,pkg_flag,simple_arg,arg,filter,command}_equal: were added [#6644 @kit-ty-kate]
• OpamVariable.variable_contents_equal: was added [#6644 @kit-ty-kate]

opam-core

• OpamConsole.confirm: now takes an optional name argument (for opam developers use only) [#6709 @kit-ty-kate]
• OpamConsole.log: does not keep log messages before initialization if the code is ran through a library [#6487 @kit-ty-kate]
• OpamCoreConfig.auto_answer: field and arguments were added [#6709 @kit-ty-kate]
• OpamCoreConfig.{answer,anwser_is,answer_is_yes}: now take a name labeled argument (for opam developers use only) [#6709 @kit-ty-kate]
• OpamCoreConfig.in_opam: was added [#6487 @kit-ty-kate]
• OpamCompat.Lazy: add map_val [#6679 @rjbou]
• OpamCompat.List.fold_left_map: was added [#6442 @kit-ty-kate]
• OpamCompat.List.equal: was added [#6644 @kit-ty-kate]
• OpamCompat.Map.filter_map: was added [#6442 @kit-ty-kate]
• OpamCompat.MAP: was added [#6442 @kit-ty-kate]
• OpamCompat.Pair.equal: was added [#6644 @kit-ty-kate]
• OpamCompat.String.{starts_with,ends_with,for_all,fold_left}: were added [#6442 @kit-ty-kate]
• OpamFilename.create: deduplicate the directory separator character when the basename starts with one [#6703 @rjbou]
• OpamFilename: add parse_patch that preprocesses and parses a patch file. [#6614 @arozovyk]
• OpamFilename.patch: use variants to make the input either Filename.t or reuse Patch.diffs directly. Remove the ?preprocess argument since the preprocess logic is moved to the `OpamFilename.parse_pa...

This is the release of opam 2.4.1.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Please see our blog post for the upgrade instructions.

Changelog:

Changes

• Fix pin-depends being ignored on simulated pins (e.g. opam install --deps-only) [#6612 @kit-ty-kate - fix #6610]
• Improve and extend the testsuite [#6612 @kit-ty-kate]

This is the final release of opam 2.4.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Changelog:

Changes

• Fix a regression in opam pin list which crashed when the source of the pinned package doesn't exist [#6598 @kit-ty-kate - fix #6600]
• Improve and extend the testsuite [#6598 @kit-ty-kate]

To get the detailed list of changes compared to 2.3.0, you can look at the pre-releases' release notes:

• the release note for 2.4.0~alpha1
• the release note for 2.4.0~alpha2
• the release note for 2.4.0~beta1
• the release note for 2.4.0~rc1

For a more descriptive and simplified list of changes, please read our blog post.

Special thanks to the whole haematology department of the NHS Greater Glasgow for making this release – in the state that it is – possible. Fighting cancer is not easy but it is much more bearable with great people <3

This is the first release candidate of opam 2.4.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Please see our blog post for a highlight on the major changes and upgrade instructions.

Changelog:

Changes

• Fix opam switch create <version> when all compilers of that version are flagged with avoid-version [#6571 @rjbou - fix #6563]
• Opam update performance: No longer copy VCS directories when adding or updating local non-VCS repositories [#6575 @kit-ty-kate - fix #6560]
• Do not remove the generated patch file during updates when debug-mode is on [#6575 @kit-ty-kate]

Release script

• Switch the host of qemu-base-images from gitlab to github [#6510 @kit-ty-kate]
• Speedup the initial clone of qemu-base-images when missing [#6510 @kit-ty-kate]
• Update some of the platforms the prebuilt binaries are built on to Alpine 2.21, FreeBSD 14.3, OpenBSD 7.7 and NetBSD 10.1 [#6510 @kit-ty-kate]

Build changes

• Use coreutils' sha512sum instead of perl's shasum utility when using ./configure --with-cygwin-setup [#6566 @kit-ty-kate - fix #6557]
• Upgrade the download-if-missing dependencies to dune 3.19.1, opam-file-format 2.2.0, spdx_licenses 1.4.0 and patch 3.0.0 [#6580 @kit-ty-kate]

Testing and documentation

• Improve and extend the testsuite [#6473 #6571 @rjbou @kit-ty-kate]
• Improve and extend the test infrastructure [#6575 @kit-ty-kate]

API updates

opam-format

• OpamLocal: fetch_repo_update no longer copies vcs directories [#6575 @kit-ty-kate]

opam-core

• OpamSystem: Add copy_dir_except_vcs [#6575 @kit-ty-kate]
• OpamSystem: Add get_files_except_vcs [#6575 @kit-ty-kate]

This is the first beta release of opam 2.4.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Please see our blog post for a highlight on the major changes and upgrade instructions.

Changelog:

New option/command/subcommand are prefixed with ◈.

Changes

Install of dependencies --deps-only

Behaviour

• ◈ Change the behaviour of --deps-only, where it no longer requires unicity of package version between the request and the installed packages. In other words, if you have pkg.1 installed, installing dependencies of pkg.2 no longer removes pkg.1. This also allows to install dependencies of conflicting packages when their dependencies are compliant. [#6520 @rjbou]

Fixes

Fixed some bugs in opam install --deps-only (and other commands simulating package pins, such as --depext-only) more visible in 2.4:

• When a package pkg is already installed and opam install ./pkg --deps is called, if there is a conflict between the installed pkg dependencies and the definition of the local pkg, the conflict was not seen and the already installed pkg was kept [#6530 @rjbou - fix #6529]
• No longer fetch and write the sources when simulating packages that were already pinned [#6533 @rjbou - fix #6532]
• opam was triggering the reinstall of the package based on the already pinned packages instead of the expected newly simulated pinned packages [#6522 @rjbou - partial fix #6501]
• opam was using the opam description of the wrong package in some cases [#6544 @kit-ty-kate - fix #6535]

Reinstall

• Fix a regression where the internal sources directory was removed unexpectedly on reinstall actions, making opam re-fetch the package [#6550 @rjbou - fix #6551]

Update

Fixed a couple of regressions in opam update:

• An unexpected stack overflow exception was raised when updating repositories with large files when opam is compiled with OCaml < 5.1 [#6527 @kit-ty-kate - fix #6513]
• Updating a repository where a line was added at the end of a file without final newline character was making the update fail [#6527 @kit-ty-kate - fix hannesm/patch#28]

Windows

• Improve the prebuilt Windows binaries by including Cygwin's setup-x86_64.exe in the binary itself as fallback, in case cygwin.com is inaccessible [#6538 @kit-ty-kate]

Build changes

• Bump the downloaded-if-missing dune to 3.19.0, cppo to 1.8.0, ocamlgraph to 2.2.0, uutf to 1.0.4 and patch to 3.0.0~beta1 [#6527 @kit-ty-kate]
• Allows ./configure --without-dune to build with OCaml 5.4 [#6527 @kit-ty-kate]
• Add a --with-cygwin-setup option to the configure script, only available on Windows and disabled by default, which includes the optionally given setup-x86_64.exe binary inside the opam binary. If the option is given without a filename, the file with be fetched from cygwin.com [#6526 @kit-ty-kate @dra27 @rjbou - fix #6498]

Testing and documentation

• Improve and extend the testsuite [#6530 #6533 #6539 #6544 #6550 #6520 @rjbou @kit-ty-kate]
• Improve and extend the test infrastructure [#6524 #6553 #6549 @kit-ty-kate @rjbou]

API updates

opam-client

• OpamAction.cleanup_artefacts: no longer removes the internal sources directory if the package is installed but not pinned [#6550 @rjbou]

This is the second alpha release of opam 2.4.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Please see our blog post for a highlight on the major changes and upgrade instructions.

Changelog:

Changes

• Do not include compiler packages flagged with avoid-version/deprecated in the generated invariant when calling opam switch create [name] <version> [#6494 @kit-ty-kate]
• Cygwin: Fallback to the existing setup-x86_64.exe if its upgrade failed to be fetched [#6482 @kit-ty-kate - fix #6495, partial fix #6474]
• Fix a memory leak happening when running large numbers of commands or opening large number of opam files [#6485 @hannesm - fix #6484]
• Remove handling of the OPAMSTATS environment variable [#6485 @hannesm]

Regression fixes from 2.4.0~alpha1

• Fix a crash when updating a repository that is deleting or adding empty files [#6490 @kit-ty-kate]
• Fix an extreme performance issue (takes several hours) when applying a large repository update [#6490 @kit-ty-kate]
• Fix a crash when updating a git repository that moved a file to a new directory [#6490 @kit-ty-kate]

Build changes

• Update the requirement for the patch library to 3.0.0~alpha2 [#6490 @kit-ty-kate]
• Upgrade the downloaded-if-missing patch library to 3.0.0~alpha2 [#6490 @kit-ty-kate]

Testing and documentation

• Improve and extend the testsuite [#6490 #6494 @rjbou @kit-ty-kate]
• Improve and extend the test infrastructure [#6277 @rjbou @kit-ty-kate]

API updates

opam-core

• OpamArg.environment_variable: make STATS as removed from cli 2.3 [#6485 @rjbou]
• OpamClientConfig: remove STATS variant and related print_stats field in config record [#6485 @hannesm]

opam-format

• OpamFile: remove Stats module [#6485 @hannesm]

opam-core

• OpamSystem: remove print_stats function [#6485 @hannesm]
• OpamSystem: add the rmdir_cleanup function [#6490 @kit-ty-kate]
• OpamSystem.dir_is_empty: Speedup and change its type to handle unreachable directories better [#6490 @kit-ty-kate]
• OpamSystem.internal_patch: remove parent directories when all of their content has been moved somewhere else [#6490 @kit-ty-kate]
• OpamSystem.internal_patch: fix moving files to new directories when receiving a git diff [#6490 @kit-ty-kate]