While discussing at the OCaml workshop 2026, it became clear that the tool opam-audit (https://github.com/hannesm/opam-audit) - which detects known security issues for packages installed in your switch - would be very good if integrated into opam directly.
My proposal would be:
- during "opam update", the security vulnerability "database" should be updated (and if there is an update, and any installed package is vulnerable, warnings should be printed)
- it may be worth to have an explicit "opam update-security-issues" -- but not really needed
- on "opam install", if the package to install (or any of its dependencies) is vulnerable, at least a warning should be printed (better would IMHO be to not install the vulnerable package unless "--ignore-security-issues" is passed on command line)
What do you think? Would that be appropriate for a next opam release?
While discussing at the OCaml workshop 2026, it became clear that the tool opam-audit (https://github.com/hannesm/opam-audit) - which detects known security issues for packages installed in your switch - would be very good if integrated into opam directly.
My proposal would be:
What do you think? Would that be appropriate for a next opam release?