This is the final release of opam 2.6.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).
To verify the authenticity of one of these files, run the following commands:

curl -fsSLO https://opam.ocaml.org/opam-dev-pubkey.pgp
gpg --import opam-dev-pubkey.pgp
gpg --verify *.sig

Changelog:

Changes

• Bump opam-root-version to 2.6 [#7146 @kit-ty-kate]
• Improve and extend the testsuite [#7146 @kit-ty-kate @rjbou]

To get the detailed list of changes compared to 2.5.2, you can look at the pre-releases' release notes:

• the release note for 2.6.0~alpha1
• the release note for 2.6.0~beta1
• the release note for 2.6.0~beta2
• the release note for 2.6.0~rc1

For a more descriptive and simplified list of changes, please read our blog post.

Special thanks to the Haematology department and Bone Marrow Transplant Unit of the NHS Greater Glasgow for making this release possible <3

This is the first candidate of opam 2.6.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).
To verify the authenticity of one of these files, run the following commands:

curl -fsSLO https://opam.ocaml.org/opam-dev-pubkey.pgp
gpg --import opam-dev-pubkey.pgp
gpg --verify *.sig

Please see our blog post for more details and the upgrade instructions.

Changelog:

Changes

Install

• Fix a 2.6 performance regression where tar.gz repositories were read entirely twice per package installed [#7131 @kit-ty-kate]

Build and release

• Upgrade the "lockfile" with all the most up-to-date dependencies available (ocaml.4.14.4, base64.3.5.2, spdx_licenses.1.5.0, menhir.20260209, patch.3.1.2, checkseum.0.5.3) [#7116 @kit-ty-kate]
• Update the OCaml compiler used for releases to 4.14.4 [#7116 @kit-ty-kate]

Internal

• Add a debug log upon reading an archive [#7131 @kit-ty-kate]
• Improve and extend the testsuite [#7131 @kit-ty-kate]
• Improve the documentation [#7082 @RyanGibb]

This is the second beta release of opam 2.6.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).
To verify the authenticity of one of these files, run the following commands:

curl -fsSLO https://opam.ocaml.org/opam-dev-pubkey.pgp
gpg --import opam-dev-pubkey.pgp
gpg --verify *.sig

Please see our blog post for more details and the upgrade instructions.

Changelog:

Changes

Install

• Fix a performance regression where opam project trees were scanned for nothing, when pinning them [#7101 @kit-ty-kate - fix #7098]

Release script and documentation

• Harden against known sshpass instability [#7096 @kit-ty-kate]
• Make the Windows binary reproducible [#7097 @kit-ty-kate - fix #6752]
• Add a reproducibility check step to our release checklist [#7097 @kit-ty-kate]
• Document and define reproducibility of release binaries and tarballs [#7097 #7115 @kit-ty-kate]

Internal

• Improve and extend the testsuite [#7101 @kit-ty-kate]

API updates

opam-core:

• OpamSystem.{rec_,}{files,dirs}: add some log in debug mode [#7101 @kit-ty-kate]

This is the first beta release of opam 2.6.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).
To verify the authenticity of one of these files, run the following commands:

curl -fsSLO https://opam.ocaml.org/opam-dev-pubkey.pgp
gpg --import opam-dev-pubkey.pgp
gpg --verify *.sig

Please see our blog post for more details and the upgrade instructions.

Changelog:

Changes

Init

• Do not make opam init --reinit ask to retry the command when upgrading from a 2.1 root [#7058 @kit-ty-kate - fix #7057]
• opam init --reinit now regenerate the list of valid switches, fix switch internal data (cache, config, packages) [#7068 @kit-ty-kate - fix #7066]

VCS

• Disable git gc/maintenance on repositories opam maintains to avoid git underlying job from blocking opam [#7073 @kit-ty-kate - partially fix #7031]

Safe mode

• Respect safe mode when encountering an outdated cache file [#7067 @kit-ty-kate - fix #7066]
• Stop resetting debuglevel to 0 in safe mode [#7091 @kit-ty-kate - fix #7000]

Internal

• Add debug log when switch list is fixed [#7068 @rjbou]
• Add level 4 debug output of the patch operations during a load from diff [#7072 @kit-ty-kate]
• Improve and extend the testsuite [#7069 #7058 #7068 #7092 #7067 @rjbou @kit-ty-kate]
• Improve and extend the test infrastructure [#7071 #7092 #7094 #7033 @rjbou @kit-ty-kate]

API updates

opam-core:

• OpamStd.Env: Add the raw = string array type alias [#7073 @kit-ty-kate]
• OpamStd.Env: Add the get_from_array and add_and_replace functions [#7073 @kit-ty-kate]

This is the first alpha release of opam 2.6.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).
To verify the authenticity of one of these files, run the following commands:

curl -fsSLO https://opam.ocaml.org/opam-dev-pubkey.pgp
gpg --import opam-dev-pubkey.pgp
gpg --verify *.sig

Please see our blog post for a highlight on the major changes and upgrade instructions.

Changelog:

Major changes

• The shell env hook will now update the current bin path in PATH in place instead of always prioritising opam's path over every other one [#6859 @gridbugs - fix #6815]
• Add root and rootexec sections to .install files to install files from prefix root [#6938 @WardBrian @rjbou - fix #6919]
• The system's tar utility is now only use to extract packages, every other use is now done using the ocaml-tar library [#6945 @kit-ty-kate]
• Added --ignore-available-on option to allow ignoring the available: field of certain packages [#6836 @WardBrian - fix #5283]
• opam update now supports updating a repository that changed a file to a directory of the same name and vice versa [#6915 @rjbou @arozovyk - fix #3830]
• Improved depexts handling by caching system package availability during opam update, avoiding redundant system checks at install time [#6489 @arozovyk - fix #6461]
• Allow detection of installed packages through their virtual names on ALT Linux, RHEL-based and SUSE-based distributions, at the cost of ~300ms per run [#6431 @kit-ty-kate - fix #6426]

Performance improvements

• Speedup repository operations on certain file-systems (e.g. NTFS on Windows or IO constrained machines) by changing its storage in the opam root from plain directory to archive for HTTP repositories (or non-VCS one if OPAMREPOSITORYTARRING is enabled) [#6625 @rjbou @kit-ty-kate @arozovyk - fix #5346 #5741 #5648 #5484 #5559 #3050 #6974]
• Improve cache-loading performance when opam is compiled with OCaml >= 5.4 by using Gc.ramp_up [#6515 @dra27]
• Improve the performance of most opam commands by a few percents by making some hot functions allocation-free [#6515 @dra27]
• Improve the performance of opam init --bare by no longer computing the default compiler in that case [#6957 @tuesdayjz @kit-ty-kate - fix #5815]
• Improve performance of opam show by reading switch selection only once instead of once per package-version [#6818 @dra27]

Reduce the disk space usage of opam

• Remove the build directory as soon as possible when installing a package [#6906 @kit-ty-kate - fix #5884]
• The internal sources directory now only serves to cache dev packages instead of every packages, for which it is now removed during the build phase [#6440 @kit-ty-kate - fix #4056 #5448]

Miscellaneous changes

• Add support for terminal resizing detection on Solaris/Illumos [#6933 @kit-ty-kate]
• Stop the opam 1.2 to 2.0 repository upgrade process from downloading packages without checksums to add a non-trusted md5 [#6978 @kit-ty-kate]
  • opam admin upgrade --clear-cache is no longer needed, it is deprecated (no-op) [#6978 @kit-ty-kate]
• The legacy url file from opam 1.2 now only supports the legacy opam 1.2 fields [#6827 @kit-ty-kate]
• Drop support for darcs < 2.12.0 (released in 2016) [#6866 @toastal]
• When fetching a git repository, the resulting git branch is now deterministically named main instead of taking the system's init.defaultBranch [#6992 @kit-ty-kate]
• When fetching a git repository (e.g. opam source --dev-repo or a package with git url), the resulting git branch is now deterministically named main instead of taking the system's init.defaultBranch [#6992 @kit-ty-kate]
• Add conditional hard upgrade to opam root 2.6. It is triggered by an already present repository archive (from OPAMREPOSITORYTARRING usage, or 2.1 opamroot) [#6949 #6839 #6625 @rjbou]
• Warn on destination containing a .. path segment in .install files [#7008 @rjbou]

Improve the UI

• Reorder the list of actions by increased priority [#6864 @kit-ty-kate - fix #6863]
• Show a working opam switch create command when opam init fails to create the default switch [#6851 @kit-ty-kate - partial fix #6848]
• Fix a typo in the note telling users about new a depexts bypass [#6489 @rjbou @kit-ty-kate]
• Opam files parsing error now prints the origin repository of the failing opam file if relevant [#6971 @rjbou]
• Display an appropriate error message when the file given to opam init --config does not exist or is in a VCS. This changes the behaviour for local VCS urls that was previously retrieved [#5979 @kit-ty-kate - fix #5971]

Bug fixes

• Fix an opam 2.5 regression where opam pin list failed abruptly when the source of the pinned package doesn't exist [#6910 #6597 @NathanReb @kit-ty-kate]
• Do not fail on directories named opam when scanning the packages directory of a repository during opam repo add or opam init (worked on subsequent opam update) [#6995 @kit-ty-kate @rjbou]
• Added return 0 for zsh/bash/sh/fish to prevent leaking error codes [#6930 @ta2005]
• Fix the filename check used when parsing arguments to allow / to be recognised as a directory separator on Windows [#6981 @kit-ty-kate - fix #6940]
• Fix "undefined variable" error when a lock file filter contains an undefined variables: fail gracefully with strict mode, continue and default the variable to false otherwise [#6947 @rjbou - fix #6946]
• Fix opam lock support of dependency formula that include disjunctions [#6990 @kit-ty-kate - fix #6944]
• Fix package installation during opam pin add <url to archive> [#7012 @zoggy - fix #6999]
• Fix opam config subst so it works with absolute paths [#6936 @NathanReb - fix #6925]
• Make git calls more deterministic regardless of the global or system config [#6992 @kit-ty-kate - fix #6937]
• Read full lines when asking for user input when TERM=dumb (e.g. emacs' M-x shell) [#6829 @arvidj - fix #6828]

Internal changes

• Remove unnecessary uses of chdir [#6910 @NathanReb]
• Source compatibility with newer cmdliner versions [#6854 @WardBrian]
• Remove uses of Stdlib.ignore [#6481 @rjbou @kit-ty-kate]
• Silence warnings raised by OCaml 5.6 [#6987 @kit-ty-kate]
• Harden the Makefile's inline shell scripts [#6751 @kit-ty-kate]
• Add a helper script to help generate the configure file on platforms without autoconf 2.71 [#6878 @kit-ty-kate]
• Add some debug logging for opam files loading from repository (dir vs diff) [#6941 @rjbou]
• Add opam root format upgrade conditional mechanism for hard upgrades [#6949 @rjbou]

Build changes

• The opam-repository library (and thus opam itself) now depends on the tar, checkseum and decompress libraries [#6945 #6976 @kit-ty-kate @rjbou]
• Require spdx_licenses >= 1.4.0 to ensure compatibility with SPDX v3 syntax [#6878 @kit-ty-kate]
• Add lower-bounds constraints to the dependencies that have none (ocamlgraph >= 1.8.8, jsonm >= 1.0.2, swhid_core >= 0.1, uutf >= 1.0.3) [#6878 @kit-ty-kate]
• Fix Windows build on MSYS2 [#6862 @Firobe]
• Update the download-if-missing patch library to 3.1.0 [#6772 @kit-ty-kate]
• Remove support for building opam with OCaml 4.08, 4.09 and 4.10 [#6879 @kit-ty-kate]

Improve the release script

• Harden the Makefile's inline shell scripts [#6751 @kit-ty-kate]
• Fix the release script not being a noop on re-runs [#6903 @kit-ty-kate]

Testing and documentation

• Improve and extend the benchmarks [#6567 #6912 @kit-ty-kate]
• Improve and extend the testsuite [#6915 #6928 #6793 #5979 #6860 #6489 #6922 #6939 #6970 #6936 #6947 #6990 #6995 #6941 #6625 #6956 #6597 #6992 #6864 #6957 #6938 #6836 #6851 #6981 #7012 @rjbou @kit-ty-kate @NathanReb @arozovyk @WardBrian]
• Improve and extend the test infrastructure [#6939 #6625 #6956 #7029 #7030 #6992 #6732 #6684 #6768 #6771 #6811 #6835 #6832 #6886 #6889 #6888 #6904 #6905 #6905 #6927 #6939 #6960 #6976 #6976 #6979 #6978 #6983 #6998 #6988 #7007 #7018 #6821 #7002 #7044 @kit-ty-kate @rjbou]
• Improve and extend the documentation [#6973 #6806 #6821 #6846 #6858 #6920 #6807 #6809 #7018 @kit-ty-kate @mseri @yosefAlsuhaibani @raphael-proust @gridbugs @ccoulombel]

API updates

opam-client

• OpamArg: add build_options_no_depexts getter to retrieve the value of the given flag [#6489 @rjbou]
• OpamArg{,Tools}.cli2_6 was added [#6978 @kit-ty-kate]
• OpamClient update the system package status check for dependencies during opam install --deps-only, including support for pinned packages; also update this in OpamAuxCommands.autopin [#6489 @arozovyk]
• OpamClient.init: a new ?no_compiler argument was added to not compute the default compiler and the list of atom returned is now an option to separate empty invariant from no switch [#6957 @kit-ty-kate]
• OpamClientConfig.opam_init: replace no_depexts argument by depexts [#6489 @rjbou]
• OpamConfigCommand.subst now takes a filename instead of a basename [#6936 @NathanReb]
• OpamSolution remove the heuristic of recomputing depexts of additional (pinned) packages [#6489 @arozovyk]
• OpamSolution.apply: now also take the user_action as parameter [#6864 @kit-ty-kate]
• OpamSolution.get_depexts remove no longer needed recover option that was used with --depext-only option [#6489 @arozovyk]
• OpamSolution.resolve: the return type now also return the user_action [#6864 @kit-ty-kate]

opam-repository

• OpamGit: git is now always called with the GIT_CONFIG_GLOBAL and GIT_CONFIG_SYSTEM environment variables set to /dev/null [#6992 @kit-ty-ka...

This is the release of opam 2.5.2.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).
To verify the authenticity of one of these files, run the following commands:

curl -fsSLO https://opam.ocaml.org/opam-dev-pubkey.pgp
gpg --import opam-dev-pubkey.pgp
gpg --verify *.sig

Please see our blog post for more details and the upgrade instructions.

Changelog:

Security fix

• Fix a bug that allowed a package to install files anywhere on the system using a symlink to an external directory without warning the user and asking for their permission: CVE-2026-57825 / OSEC-2026-10. [#7005 @NathanReb]

Other changes

• Re-allow .. in .install files, partially reverts 2.5.1's #6898 [#7008 @kit-ty-kate - fix ocaml/dune#14393]
• Stop the installation process via .install file from creating unnecessary intermediate directories for paths that contain .. [#7015 @kit-ty-kate]
• Improve and extend the testsuite [#6953 #7011 #7008 #7005 @NathanReb @rjbou @kit-ty-kate]
• API changes in opam-core:
  • OpamFilename.{,dir_}starts_with: Fix a bug where foo/bar would be considered a prefix of foo/bar-baz [#6953 @NathanReb - fix #6948]
  • OpamFilename.{,dir_}starts_with: / and \ are now equivalent on Windows [#6953 @NathanReb]
  • OpamFilename.starts_with: starts_with "a/b" "a/b" no longer returns true [#6953 @NathanReb]
  • OpamSystem.real_path: fix a bug where paths after a non existent directory where not resolve [#7011 @kit-ty-kate - fix #7010]

This is the release of opam 2.5.1.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Please see our blog post for more details and the upgrade instructions.

Changelog:

Security fix

• OSEC-2026-03: Invalidate .install fields containing destination filepath trying to escape their scope [#6897 @kit-ty-kate - report by @andrew]

Other changes

• Fix a string injection from the depexts field to nix-build, when os-family=nixos [#6894 @RyanGibb]
• Restore the distribution detection on Gentoo [#6886 @kit-ty-kate - fix #6887]
• Add support for single-quoted values of the /etc/os-release file [#6886 @kit-ty-kate - fix #6887]
• Fix rare potential GC corruptions [#6882 #6880 @kit-ty-kate @avsm - report by @andrew]
• Improve and extend the testsuite [#6897 @rjbou @kit-ty-kate]
• API changes in opam-core:
  • OpamFilename.might_escape: ensure / is detected as a file separator when called with ~sep:Unspecified on Windows [#6897 @kit-ty-kate]

This is the final release of opam 2.5.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Changelog:

Changes

No significant change compared to 2.5.0~beta1.

To get the detailed list of changes compared to 2.4.1, you can look at the pre-releases' release notes:

• the release note for 2.5.0~alpha1
• the release note for 2.5.0~beta1
• the release note for 2.5.0~rc1

For a more descriptive and simplified list of changes, please read our blog post.

This is the first release candidate of opam 2.5.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Please see our blog post for the upgrade instructions.

Changelog:

Changes

No significant change compared to 2.5.0~beta1.

This is the first beta release of opam 2.5.0.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Please see our blog post for a highlight on the major changes and upgrade instructions.

Changelog:

Fixes

Sandbox

• Allow the macOS sandbox to write in the /var/folders/ and /var/db/mds/ directories as it is required by some of macOS core tools [#4797 @kit-ty-kate - fix #4389 #6460]

Update

• Fixed a bug occurring on version-equivalent package rename (i.e. pkg.00 -> pkg.0) leading to the package being completely removed [#6774 @arozovyk - fix #6754]

Dry-run mode

• Stop opam switch create --dry-run from creating switch root directory by stopping the creation of build directory and writing the switch-state cache [#6540 @hannesm - fix #5918]
• Stop cleaning the build directory when installing packages with --dry-run [#6540 @hannesm]

Other changes

Build changes

• Add the upcoming OCaml 5.5 (trunk) support when using dune's dev profile [#6670 @kit-ty-kate]
• opam no longer depends on cmdliner [#6755 @kit-ty-kate - fix #6425]
• Clean variables before calling make on different projects (e.g. downlodad-if-missing OCaml compiler) to avoid clashes with other variables set by these projects [#6769 @kit-ty-kate]

Internal changes

Improve the release script

• Fix the placement of the vendored archives in the release tarball [#6765 @kit-ty-kate - fix #6762]
• Fix the Windows build [#6769 @kit-ty-kate]

Testing

• Improve and extend the testsuite [#6540 #6774 @arozovyk @kit-ty-kate]
• Improve and extend the test infrastructure [#6732 @kit-ty-kate]

API updates

opam-state

• OpamRepositoryState.load_opams_from_diff: track added packages to avoid removing version-equivalent packages [#6774 @arozovyk - fix #6754]

opam-core

• OpamCmdliner: was added. It is the new internal interface for Cmdliner, accessible through a new opam-core.cmdliner sub-library, however it is meant for internal use only. [#6755 @kit-ty-kate]