Initial advisory inspection: 2026-09-14; local cancellation patch review: 2026-09-15. This is a scoped maintainer review of locked packages, published upstream advisories and native linkage. It is not a complete vulnerability scan or an independent security approval. Full deployment dependency review remains open.
Core values have no third-party runtime dependency. HTTP/1 adds ipaddr for
authority validation; the engine adds only our core and codec. Keep these layers
free of database, authentication, TLS and runtime-backend dependencies.
| Area | Locked dependency / purpose | Review boundary |
|---|---|---|
| Runtime transport/application | Eio 1.5 or Lwt 6.1.2 | Cancellation, provider/backend and native resource semantics |
| HTTP/application values | ipaddr 5.6.2, Yojson 3.0.0, Base64, Digestif 1.3.1, Eqaf 0.10 | Parsing limits, encoded lengths, hashing and equality |
| Database | Caqti 3.0.0, PostgreSQL driver3.0.1+httpkit1, SQLite driver3.0.0 | Native client libraries, transactions, rollback, lease scope |
| Cookie protection | Mirage Crypto 2.4.1 plus its RNG | Upstream authenticated encryption; our key/nonce/configuration and expiry policy |
| Passwords | ocaml-argon2 1.0.2 plus native libargon2 | Synchronous native work, cost limits and caller-owned worker admission |
| OIDC | jose 0.11.0, oidc 0.2.0, upstream cryptographic dependencies | Algorithm/key policy, verification, claims and remote-client trust |
| Outbound fetch | Uri 4.4.0; tls-eio/tls-lwt 2.1.2 and existing TLS/X509 stack | Separate client packages; hostname/IP authentication, ALPN, framing and cleanup |
The fetch examples use ca-certs 1.0.3 for system trust discovery; it adds bos 0.3.0 and rresult 0.7.0 to the harness closure. The client libraries accept an explicit authenticator and do not depend on CA-store discovery. The normal and coverage locks include these dependencies. This boundary review is not a refreshed comprehensive advisory audit.
These are separate trust boundaries, not reasons to write replacement crypto. The development harness also installs comparison, test and profiling packages; its entire lock inventory is not the dependency set of every production package. Review installed package closures separately from the all-packages workspace.
The macOS archive-install inventory records the
actual opam package versions and declared licenses for the a21d8ee installation.
Its 110 entries include build tools and compiler/configuration packages; they are
not all runtime dependencies. This resolution used the pinned central repository
and local PostgreSQL fix, separately from Dune's overlay-based locks. In particular,
it selected ctypes 0.24.0 and ocamlfind 1.9.9~preview. The installed native/bytecode
consumer controls passed, but that does not transfer all locked-workspace evidence
to these versions. Final platform, advisory and distribution review remains open.
The application library depends on eio interfaces. Backend selection belongs
to the executable; examples select eio_main explicitly. An isolated installed
consumer reproduced the old unnecessary eio_main requirement, and now builds
and runs application composition in native and bytecode modes without
eio_main, eio_posix, eio_linux or Lwt installed. This bounded package cleanup
does not justify merging independent database/authentication packages.
The Caqti cancellation fix below is distinct from the unresolved
postgresql.5.4.0 bytecode crash. Use native PostgreSQL
executables until that binding is corrected and validated.
A real in-flight cancellation control reproduced a stuck driver busy flag and
failed disconnect. The local 3.0.1+httpkit1 driver patch clears the flag in a
finalizer even when reset cleanup fails or is cancelled. It does not make I/O
uncancellable. The isolated patched-driver probe and existing PostgreSQL/SQLite
regressions passed before adopting the patch; the regular suite now includes the
observed-query cancellation schedule.
The local repository and installation requirement
are explicit. The original archive checksum, patch checksum and patch copies in
both locks are retained. httpkit-db-eio requires the patched version; ordinary
opam installation cannot fall back to the known-broken version. Core/HTTP/engine
dependency boundaries are unchanged. This is a local patch, not a claimed
upstream release or upstream security approval.
Dune marks the serialized repository list complete false because a local
directory has no remote Git revision. The selected package recipes and embedded
patches remain locked; the local repository files are committed and included in
the release source fingerprint. Re-resolving requires this checkout's local
repository, in addition to the existing pinned remote repositories.
GitHub's public repository-advisory API was queried for Mirage Crypto, Caqti,
Eio, Lwt, ocaml-argon2, reference libargon2, ocaml-jose and ocaml-oidc. The first
six and ocaml-oidc returned empty published-advisory lists. Empty lists do not
cover unpublished reports, other advisory databases, all transitives, or OS
libraries. Raw responses and repository metadata are retained locally under
_artifacts/production-slices/22-*-advisories.json and 22-*-repository.json.
JOSE publishes CVE-2023-23928 / GHSA-7jj9-6qwv-wpm7:
versions below 0.8.2 failed to verify HS256 signatures. Our lock already uses
0.11.0, and our OIDC profile permits only RS256 and ES256. This finding does not
establish exposure of the current OIDC implementation. It does expose missing
installation constraints: httpkit-oidc now requires at least the tested JOSE
0.11.0 release. Existing ordinary and coverage dependency versions are unchanged.
Native/bytecode authentication tests retain a valid signed-token control, mutate
every RSA signature byte, change a valid subject while retaining the old signature,
and reject HS256, none and empty signatures. These complement issuer, audience,
nonce, expiry, key-selection and duplicate-claim controls. They test our supported
profile, not every upstream JOSE algorithm.
The inspected upstream repositories were neither archived nor disabled. Last-push metadata ranges from 2024 for the Argon2 binding/reference implementation to September 2026 for several other libraries; this is activity evidence, not a maintenance-quality or security verdict. In particular, stable cryptographic code does not become unsafe merely because releases are infrequent.
otool -L on the local authentication/database test binaries shows native GMP,
libffi, libargon2, libpq and system SQLite linkage. Build-time pkg-config
versions are retained separately in 22-native-pkgconfig.log; they are not
substitutes for actual runtime-library versions. On this host the metadata and
linked library identities differ, so they must not be combined into a fabricated
single version inventory. Dune locks do not pin the runtime OS shared libraries.
Before release, retain the production image/OS package inventory, actual loaded library identities and applicable advisories; review the complete installed transitive closure, source/build provenance and licenses; and rerun installation, cryptographic negative controls and backend cancellation tests after dependency changes. Broader advisory coverage and a named independent review remain open. Do not infer production approval from this initial published-advisory pass.