Post 2.5.1 release bumps

.github/scripts/main/main.sh

@@ -203,7 +203,7 @@ if [ "$OPAM_DEPENDS" = "1" ]; then
   OCAMLVER=$(ocamlc -version)
 
   (set +x; echo -en "::group::depends\r") 2>/dev/null
-  VERSION="2.5.0"
+  VERSION="2.5.1"
   opam_libs=$(opam show . -f name 2>/dev/null)
   depends_on=$(echo "$opam_libs" | sed "s/\$/.${VERSION}/" | paste -sd, -)
   packages=$(echo "$opam_libs" | while read lib; do

.github/workflows/ci.ml

@@ -553,7 +553,7 @@ let main oc : unit =
     ("OPAM12CACHE", "~/.cache/opam1.2/cache");
     (* These should be identical to the values in appveyor.yml *)
     ("OPAM_REPO", "https://github.com/ocaml/opam-repository.git");
-    ("OPAM_TEST_REPO_SHA", "eb45f7ec868b0ffc828b9d59cccc72cfec100333");
+    ("OPAM_TEST_REPO_SHA", "ea549f9f2496d9b1454d1cb4817bba7be9013985");
     ("OPAM_REPO_SHA", "38a1469dbbc69c770e534e26f79c97256a442b71");
     ("SOLVER", "");
     (* Cygwin configuration *)

.github/workflows/depexts.yml

@@ -18,7 +18,7 @@ defaults:
     shell: bash
 
 env:
-  OPAMVERSION: 2.5.0
+  OPAMVERSION: 2.5.1
   OPAM_REPO: https://github.com/ocaml/opam-repository.git
   OPAM_REPO_SHA: eb45f7ec868b0ffc828b9d59cccc72cfec100333
 

.github/workflows/main.yml

@@ -26,7 +26,7 @@ env:
   OPAMBSROOT: ~/.cache/.opam.cached
   OPAM12CACHE: ~/.cache/opam1.2/cache
   OPAM_REPO: https://github.com/ocaml/opam-repository.git
-  OPAM_TEST_REPO_SHA: eb45f7ec868b0ffc828b9d59cccc72cfec100333
+  OPAM_TEST_REPO_SHA: ea549f9f2496d9b1454d1cb4817bba7be9013985
   OPAM_REPO_SHA: 38a1469dbbc69c770e534e26f79c97256a442b71
   SOLVER:
   CYGWIN_MIRROR: http://mirrors.kernel.org/sourceware/cygwin/

CHANGES

@@ -3,6 +3,16 @@ repositories (changes that are automatically handled by the format upgrade tools
 are not marked). Those prefixed with "(+)" are new command/option (since
 2.1.0~alpha2).
 
+2.5.1:
+* OSEC-2026-03: Invalidate .install fields containing destination filepath trying to escape their scope [#6897 @kit-ty-kate - report by @andrew]
+* Fix a string injection from the depexts field to nix-build, when `os-family=nixos` [#6894 @RyanGibb]
+* Restore the distribution detection on Gentoo [#6886 @kit-ty-kate - fix #6887]
+* Add support for single-quoted values of the /etc/os-release file [#6886 @kit-ty-kate - fix #6887]
+* Fix rare potential GC corruptions [#6882 #6880 @kit-ty-kate @avsm - report by @andrew]
+* Improve and extend the testsuite [#6897 @rjbou @kit-ty-kate]
+* API changes in `opam-core`:
+  * `OpamFilename.might_escape`: ensure / is detected as a file separator when called with `~sep:Unspecified` on Windows [#6897 @kit-ty-kate]
+
 2.5.0:
 * (no difference compared to 2.5.0~rc1)
 

doc/pages/Install.md

@@ -146,9 +146,9 @@ Sources of the latest stable version of opam are available on Github:
 You can also download the full archives, including opam dependencies (these
 don't require any extra downloads):
 
-* [2.5.0](https://github.com/ocaml/opam/releases/download/2.5.0/opam-full-2.5.0.tar.gz)
- - MD5: 300a43aca6a20c984100ec6855c2f979
- - SHA512: 4e47b03e22de3ab975f1e14b4a6b8e98f159a065be8f9d56f110e6a2a5275b42d4646350b230f912b057b768f182225db24d5343da41a716d0e9cdc1cb435c54
+* [2.5.1](https://github.com/ocaml/opam/releases/download/2.5.1/opam-full-2.5.1.tar.gz)
+ - MD5: 3c3d90e87ed5c7986306a24aa233c58c
+ - SHA512: 1661feb001cdb238180448d5b528eafaebd89787c7c927533a29201f40cbd2bee9398c030c9576746daf860e4b59f478d3668a6fb0e5544128111e40715ca13d
 
 Follow the instructions in the included
 [`README.md`](https://github.com/ocaml/opam#readme) to get opam built and

master_changes.md

@@ -172,6 +172,7 @@ users)
   * Trigger the depexts CI when OpamSysPoll is modified [#6886 @kit-ty-kate]
   * Speedup macOS builds by stopping testing alternative solvers on macOS [#6889 @kit-ty-kate]
   * Disable testing conf-clang-format in favour of conf-fts on Alpine [#6888 @kit-ty-kate]
+  * Upgrade to use opam 2.5.1 [#6904 @kit-ty-kate]
 
 ## Doc
   * Add spacing between two words in `--locked` man section [#6806 @yosefAlsuhaibani]