2.5.1

This is the release of opam 2.5.1.

Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92).

Please see our blog post for more details and the upgrade instructions.

Changelog:

Security fix

• OSEC-2026-03: Invalidate .install fields containing destination filepath trying to escape their scope [#6897 @kit-ty-kate - report by @andrew]

Other changes

• Fix a string injection from the depexts field to nix-build, when os-family=nixos [#6894 @RyanGibb]
• Restore the distribution detection on Gentoo [#6886 @kit-ty-kate - fix #6887]
• Add support for single-quoted values of the /etc/os-release file [#6886 @kit-ty-kate - fix #6887]
• Fix rare potential GC corruptions [#6882 #6880 @kit-ty-kate @avsm - report by @andrew]
• Improve and extend the testsuite [#6897 @rjbou @kit-ty-kate]
• API changes in opam-core:
  • OpamFilename.might_escape: ensure / is detected as a file separator when called with ~sep:Unspecified on Windows [#6897 @kit-ty-kate]