OCaml Weekly News

Newer 1.2 version, now detects eventual draw games.

https://pastebin.com/DjZ03yPa

Dear everyone,

we (the OCaml security) team is curious what the practice should be for opam packages that have known security vulnerabilities?

One way is to mark them with available: false in the opam-repository, which will make them not installable (apart from if you manually edit the opam file).

Especially for the OCaml compiler it is a tricky question: the recent vulnerability (in Marshal) affects everything < 4.14.3 | > 5 & < 5.4.1 – so marking these compilers as unavailable will result in lots of projects that require such older OCaml versions to not be easily installable anymore. Especially since the Marshal issue is not exposed in many (any?) applications, it feels wrong to disallow / make it hard for anyone to install these compilers.

Some ideas we have for the future:

• annotate the exact function(s) that is/are vulnerabile in the security advisory (thus, you could automatically search for use of that function)
• provide an "opam audit" which takes the advisory database and inspects your opam switch whether you have installed any vulnerable package

But for the short & medium term, we'd appreciate input on what to do with normal opam packages that have advisories; and also whether to treat the compiler packages differently or not.

The odoc team is pleased to announce the release of odoc 3.2.1!

opam update
opam install odoc

Please can I post this job that we are hiring for.

• title: Senior Systems Software Engineer
• link: https://careers.cloud.com/jobs/senior-software-engineer-xenserver-toolstack-remote-united-kingdom
• locations: Remote, United-Kingdom
• publication_date: 2026-05-14
• company: Cloud Software Group
• company_logo:

Hi everyone,

I've been experimenting lately with ways to make technical topics feel a bit more visual and approachable, and somehow that ended up turning into a small hobby project called Cammy Stories.

It's a collection of short comics about OCaml featuring a camel mascot ("Cammy") together with some familiar faces from the ecosystem like Dune, OPAM, Merlin and Odoc as characters and teammates.

The idea is not to make formal tutorials or documentation, but rather playful visual explanations of concepts like variants, functors, concurrency, Dune stanzas, OPAM switches, and other OCaml topics I found interesting while learning and exploring the ecosystem.

Most of the images were created through lots of iteration with AI image generation tools. Sometimes the results are surprisingly good, sometimes the text becomes nonsense, and occasionally random hearts appear for no reason. I've also kept many of the leftover drafts visible because I thought the process itself was funny and interesting.

Functional programming communities tend to have a reputation for being quite technical and serious, and I sometimes feel that a more visual and community-driven approach could help make some of these ideas feel a bit more approachable. So this is mostly a small experiment in that direction.

Feedback is very welcome, especially since there are probably technical inaccuracies or misleading ideas here and there. Suggestions for future topics, formats or concepts are also appreciated.

At the moment, most pages also include small notes, side comments or short stories about how each comic was created, since the project is still very much in a discussion and experimentation phase.

• 🔗 Live: https://rchg.github.io/cammy/
• 🔗 Repo: https://github.com/RCHG/cammy

Hope you enjoy it 🐫

I am pleased to announce MlFront_ProgressZig. Install instructions, docs and examples further below.

TLDR: It renders a progress tree (a generalization of a progress bar). The killer feature is rendering a single progress tree with progress data fed from compatible child/grandchild/etc processes (see 2nd and 3rd examples). MlFront_ProgressZig is a port of Zig's progress standard library, with improvements for Windows and protocol compatibility with zig processes. The motivation and algorithm is at https://andrewkelley.me/post/zig-new-cli-progress-bar-explained.html. The port was initially AI-assisted; prompts for progress.zig start at line 1 here and Cabinet (government) data starts on line 218 here.

$ ./dk0 distribute CommonsBase_Std-dist-win32 --library 'CommonsBase_Std@2.5.999911122233' dist-win32.u

[signify] New build key pair in t/k/build.pub and t/k/build.sec ...
[signify] Distribute key pair among trusted coworkers only!
►0/2] distribute CommonsBase_Std-dist-win32
   └─ [2/5] prepare distribution
      └─ [29/32] get-object CommonsBase_Std.Toybox@0...
         └─ dl toybox-aarch64@toybox sz 806K
            └─ landley.net/toybox...oads/binaries/0.8.9
               └─ [0/1] MiB downloaded

for pkg in MlFront_Progress MlFront_Core MlFront_Lua MlFront_ZipFile UnifiedScript_Std MlFront_Thunk MlFront_Console MlFront_ProgressZig; do
  opam pin add $pkg https://gitlab.com/dkml/build-tools/MlFront/-/releases/permalink/latest/downloads/MlFront.tar.gz
done

Hi

Like mentioned in the title this compiles Ocaml (Bytecode) into Lua (lua5.1). This project is ai generated, I tried to fully disclose that with the methods described in the project ocaml-ai-dislosure:

https://github.com/maltasea/lua_of_ocaml