Dear everyone, I’m happy to announce that opam-audit has been released to opam in its initial version. It is an opam plugin (so you install it in one switch and have it available in all switches as opam audit). So, opam-audit keeps a local copy of the security-advisory database from the OCaml Secu…

Thank you for this information. Much appreciated.

Hello Hannes. I have installed opam audit and I ran it, I have 4 vulnerable packages in my switch. The vulnerable packages can not be upgraded because, ∗ mirage-crypto-rng-lwt.1.2.0 is installed and requires mirage-crypto-rng = 1.2.0 I saw you have resolved the vulnerabilities in mirage-crypto 2.…

@aguluman mirage-crypto-rng-lwt was removed in 2.0.0. See remove now superfluous mirage-crypto-rng-{lwt,eio,async} by hannesm · Pull Request #256 · mirage/mirage-crypto · GitHub So I think the way forward for you is to look if you can remove mirage-crypto-rng-lwt and if not see if you can update th…

Hello @reynir Thank you for this information. This is helpful. Cheers

And, did it work? Or did you have any packages that are still depending on mirage-crypto-rng-lwt? (if so, let me know, I can spend time to get rid of this dependency.)

It did work. I pinned dream master branch using opam. That resolved *-lwt issue. I uninstalled it and upgraded mirage crypto. @reynir comment was helpful.

[ANN] opam-audit

Ecosystem

Topic		Replies	Views
Request for comments: What to do with opam packages that have known security vulnerabilities Community security , opam-repository	23	914	May 26, 2026
OCaml Security Team, report for first half of 2026 Ecosystem announce , security	1	296	July 17, 2026
[ANN] opam 2.1.5 release! Community opam , announce	0	1181	June 1, 2023
[ANN] opam 2.3.0 is out! Ecosystem opam , announce	2	490	November 21, 2024
Opam-repository: security and data integrity posture Ecosystem opam , opam-publish	15	2278	October 5, 2020

[ANN] opam-audit

Related topics