Skip to content

Release 2.5.2 #7016

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kit-ty-kate merged 1 commit into from
Jul 8, 2026
Merged

Release 2.5.2 #7016

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions CHANGES
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,27 @@ repositories (changes that are automatically handled by the format upgrade tools
are not marked). Those prefixed with "(+)" are new command/option (since
2.1.0~alpha2).

2.5.2:
* Fix a bug that allowed a package to install files anywhere on the system
using a symlink to an external directory without warning the user and
asking for their permission: CVE-2026-57825 / OSEC-2026-10.
[#7005 @NathanReb]
* Re-allow `..` in `.install` files, partially reverts 2.5.1's #6879
[#7008 @kit-ty-kate - fix ocaml/dune#14393]
* Stop the installation process via .install file from creating unnecessary
intermediate directories for paths that contain `..` [#7015 @kit-ty-kate]
Comment on lines +13 to +14

@rjbou rjbou Jul 8, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* Stop the installation process via .install file from creating unnecessary
intermediate directories for paths that contain `..` [#7015 @kit-ty-kate]
* When installing files from `.install` resolve them before creating paths.
It no longer create unnecessary intermediate directories if it contains
indirections (`..`) [#7015 @kit-ty-kate]

@kit-ty-kate kit-ty-kate Jul 8, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure it's clearer

@rjbou rjbou Jul 8, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe a rewording is needed to make it clearer. The idea was to highlight that the paths are now resolved, which avoid creating unnecessary dirs. It is not obvious with just "no more create unnecessary dirs"

@kit-ty-kate kit-ty-kate Jul 8, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From the users' point of view i don't think it makes sense to mention that paths are resolved. They don't really care. The only effect they could see is the unnecessary directories not being created anymore

@rjbou rjbou Jul 8, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we go that way, from user perspective, there is no impact on the usage, its all under opam root, expect for misc.
I've thought about it because if I read an external changelog that contains that line, it would have implied a lot of questions (why it was created in the first place, what changed, is it a bug, etc.), which can be answered directly/not raised by having the "path resolved" information.

@kit-ty-kate kit-ty-kate Jul 8, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we go that way, from user perspective, there is no impact on the usage, its all under opam root, expect for misc.

I'm also happy to remove it from the changelog entirely.

I've thought about it because if I read an external changelog that contains that line, it would have implied a lot of questions (why it was created in the first place, what changed, is it a bug, etc.), which can be answered directly/not raised by having the "path resolved" information.

But if someone were to have question of that type, then they'd already be interested in the opam codebase enough to simply have a look at the PR directly. Then the question would answer itself.

@rjbou rjbou Jul 8, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But if someone were to have question of that type, then they'd already be interested in the opam codebase enough to simply have a look at the PR directly. Then the question would answer itself.

Not necessarily, when i read release notes, i'm just interested on the changes, not the codebase itself. Plus, there is a cost to go and dig on an unknown codebase to have these questions answered, that i won't do on most cases.

I'm also happy to remove it from the changelog entirely.

My opinion : we should keep the line (otherwise half of opam changelog would be removed) and i think it is better to have the "path resolved" information. Now, it is ok for me to keep it as is, the PR is already approved.

* Improve and extend the testsuite
[#6953 #7011 #7008 #7005 @NathanReb @rjbou @kit-ty-kate]
* API changes in `opam-core`:
* `OpamFilename.{,dir_}starts_with`: Fix a bug where `foo/bar` would be
considered a prefix of `foo/bar-baz` [#6953 @NathanReb - fix #6948]
* `OpamFilename.{,dir_}starts_with`: `/` and `\` are now equivalent on
Windows [#6953 @NathanReb]
* `OpamFilename.starts_with`: `starts_with "a/b" "a/b"` no longer returns
`true` [#6953 @NathanReb]
* `OpamSystem.real_path`: fix a bug where paths after a non existent
directory where not resolve [#7011 @kit-ty-kate - fix #7010]
Comment thread
rjbou marked this conversation as resolved.

2.5.1:
* Invalidate .install fields containing destination filepath trying to escape their scope [#6897 @kit-ty-kate - report by @andrew]
* Fix a string injection from the depexts field to nix-build, when `os-family=nixos` [#6894 @RyanGibb]
Expand Down
18 changes: 9 additions & 9 deletions configure
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
dnl The line below must be formatted AC_INIT([opam],[VERSION]) with no extra spaces
AC_INIT([opam],[2.5.1])
AC_INIT([opam],[2.5.2])
AC_COPYRIGHT(Copyright 2012-2019 OcamlPro SAS)

AC_CONFIG_MACRO_DIR([m4])
Expand Down
12 changes: 0 additions & 12 deletions master_changes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@ users)
## Config report

## Actions
* Stop the installation process via .install file from creating unnecessary intermediate directories for paths that contain `..` [#7015 @kit-ty-kate]

## Install

Expand Down Expand Up @@ -100,16 +99,11 @@ users)
## Internal: Windows

## Test
* Add `opamUnit` as a basic unit test framework [#6953 @NathanReb]
* Add unit tests for `OpamFilename.starts_with` and `dir_starts_with` in `tests/lib/core` [#6953 @NathanReb]
* Add unit test for `OpamSystem.real_path` [#7011 @rjbou]

## Benchmarks

## Reftests
### Tests
* Add a test showing the behaviour of .install files containing destination filepath trying to escape their scope [#6897 #7008 @rjbou @kit-ty-kate]
* Add a test ensuring installing files through a .install file can't escape the opam switch (CVE-2026-57825) [#7005 @NathanReb]

### Engine

Expand All @@ -118,8 +112,6 @@ users)
## Doc

## Security fixes
* Invalidate .install fields containing absolute destination filepath except when in the `misc` field [#6897 #7008 @kit-ty-kate]
* Fix a bug that allowed a package to install files anywhere on the system using a symlink to an external directory without warning the user and asking for their permission: CVE-2026-57825. [#7005 @NathanReb]

# API updates
## opam-client
Expand All @@ -133,7 +125,3 @@ users)
## opam-format

## opam-core
* `OpamFilename.{,dir_}starts_with`: Fix a bug where `foo/bar` would be considered a prefix of `foo/bar-baz` [#6953 @NathanReb - fix #6948]
* `OpamFilename.{,dir_}starts_with`: `/` and `\` are now equivalent on Windows [#6953 @NathanReb]
* `OpamFilename.starts_with`: `starts_with "a/b" "a/b"` no longer returns `true` [#6953 @NathanReb]
* `OpamSystem.real_path`: fix a bug where paths after a non existent directory where not resolve [#7011 @kit-ty-kate - fix #7010]
2 changes: 1 addition & 1 deletion opam-client.opam
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
opam-version: "2.0"
version: "2.5.1"
version: "2.5.2"
synopsis: "Client library for opam 2.5"
description: """
Actions on the opam root, switches, installations, and front-end.
Expand Down
2 changes: 1 addition & 1 deletion opam-core.opam
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
opam-version: "2.0"
version: "2.5.1"
version: "2.5.2"
synopsis: "Core library for opam 2.5"
description:
"Small standard library extensions, and generic system interaction modules used by opam."
Expand Down
2 changes: 1 addition & 1 deletion opam-devel.opam
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
opam-version: "2.0"
version: "2.5.1"
version: "2.5.2"
synopsis: "Bootstrapped development binary for opam 2.5"
description: """
This package compiles (bootstraps) opam. For consistency and safety of the installation, the binaries are not installed into the PATH, but into lib/opam-devel, from where the user can manually install them system-wide.
Expand Down
2 changes: 1 addition & 1 deletion opam-format.opam
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
opam-version: "2.0"
version: "2.5.1"
version: "2.5.2"
synopsis: "Format library for opam 2.5"
description: """
Definition of opam datastructures and its file interface.
Expand Down
2 changes: 1 addition & 1 deletion opam-installer.opam
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
opam-version: "2.0"
version: "2.5.1"
version: "2.5.2"
synopsis: "Installation of files to a prefix, following opam conventions"
description: """
opam-installer is a small tool that can read *.install files, as defined by opam [1], and execute them to install or remove package files without going through opam.
Expand Down
2 changes: 1 addition & 1 deletion opam-repository.opam
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
opam-version: "2.0"
version: "2.5.1"
version: "2.5.2"
synopsis: "Repository library for opam 2.5"
description: """
This library includes repository and remote sources handling, including curl/wget, rsync, git, mercurial, darcs backends.
Expand Down
2 changes: 1 addition & 1 deletion opam-solver.opam
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
opam-version: "2.0"
version: "2.5.1"
version: "2.5.2"
synopsis: "Solver library for opam 2.5"
description: """
Solver and Cudf interaction. This library is based on the Cudf and Dose libraries, and handles calls to the external solver from opam.
Expand Down
2 changes: 1 addition & 1 deletion opam-state.opam
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
opam-version: "2.0"
version: "2.5.1"
version: "2.5.2"
synopsis: "State library for opam 2.5"
description: """
Handling of the ~/.opam hierarchy, repository and switch states.
Expand Down
Loading