2.5.2

This is the release of opam 2.5.2.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).
To verify the authenticity of one of these files, run the following commands:

curl -fsSLO https://opam.ocaml.org/opam-dev-pubkey.pgp
gpg --import opam-dev-pubkey.pgp
gpg --verify *.sig

Please see our blog post for more details and the upgrade instructions.

Changelog:

Security fix

• Fix a bug that allowed a package to install files anywhere on the system using a symlink to an external directory without warning the user and asking for their permission: CVE-2026-57825 / OSEC-2026-10. [#7005 @NathanReb]

Other changes

• Re-allow .. in .install files, partially reverts 2.5.1's #6898 [#7008 @kit-ty-kate - fix ocaml/dune#14393]
• Stop the installation process via .install file from creating unnecessary intermediate directories for paths that contain .. [#7015 @kit-ty-kate]
• Improve and extend the testsuite [#6953 #7011 #7008 #7005 @NathanReb @rjbou @kit-ty-kate]
• API changes in opam-core:
  • OpamFilename.{,dir_}starts_with: Fix a bug where foo/bar would be considered a prefix of foo/bar-baz [#6953 @NathanReb - fix #6948]
  • OpamFilename.{,dir_}starts_with: / and \ are now equivalent on Windows [#6953 @NathanReb]
  • OpamFilename.starts_with: starts_with "a/b" "a/b" no longer returns true [#6953 @NathanReb]
  • OpamSystem.real_path: fix a bug where paths after a non existent directory where not resolve [#7011 @kit-ty-kate - fix #7010]