chore(dependencies): refresh bundled third-party libraries - #5306
Merged
Conversation
Security update. From the libpng release notes: 'libpng 1.6.56 has two more security fixes.' Source: https://github.com/pnggroup/libpng/releases/tag/v1.6.56 Bundled file pnglibconf.h is preserved as-is since it is a pre-configured build artifact (not shipped in the release tarball).
Security update. From the libharu 2.4.6 release notes: includes TTF security fixes and resolves memory allocation errors, compatibility with newer Delphi versions, and Windows 32-bit build fixes. Source: https://github.com/libharu/libharu/releases/tag/v2.4.6
Key fixes in this range: - WAL-reset database corruption bug (critical) - Incorrect results from nested EXISTS queries (3.51.2 fix retained) - Query planner, ALTER TABLE, REINDEX EXPRESSIONS improvements - New SQL and C-language interfaces SQLite 3.52.0 was withdrawn due to backwards-compatibility issues, so we jump straight from 3.51.2 to 3.53.0. Source: https://www.sqlite.org/2026/sqlite-amalgamation-3530000.zip
Key fixes in 11.0.3, 11.0.4, 11.1.0: - Thread-local context duplication across shared libraries - Nullptr checks in macro-free logging functions - New backend worker poll loop hooks - New optional QUILL_USE_SEQUENTIAL_THREAD_ID feature (not enabled by POCO) Only ThreadUtilities.h changed among the three files that derive the ENABLE_FASTLOGGER platform whitelist in the top-level CMakeLists.txt (ThreadUtilities.h, BackendWorkerLock.h, Rdtsc.h). The change adds a new opt-in code path but leaves the existing platform branches intact, so the whitelist does not need to be updated. Source: https://github.com/odygrd/quill/releases/tag/v11.1.0
Add two helper scripts under dependencies/: - check-upstream-versions.sh: queries each bundled library's upstream (GitHub releases API, plus scraping for sqlite/libpng/7zip) and compares against the '# Version:' comment in each dependencies/<lib>/ CMakeLists.txt (with a README.md fallback for libraries without that comment). Prints a table and exits 1 if any updates are available. Uses jq when present, falls back to grep/sed. Honors GITHUB_TOKEN to raise the rate limit. - update-bundled-dep.sh: downloads an upstream release tarball and refreshes the currently-bundled subset of files by matching each bundled file by relative path (with basename fallback) in the upstream tree, then updates the '# Version:' and '# Source:' URL comments in CMakeLists.txt and the version cell in README.md. Handles tar.gz, tar.xz, tar.bz2 and zip archives. For sqlite3, derives the year-dependent download URL automatically. Also: - Replace non-ASCII em-dashes in README.md with ASCII equivalents to comply with the ASCII-only project convention. - Bump the stale expat row in the README (2.7.4 -> 2.7.5) to match the bundled source, which was updated in an earlier commit without touching the README table.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refresh four bundled third-party libraries and add tooling to check and
update bundled dependencies going forward.
Library updates
All update commits were built and verified locally. For Quill, the
three source files that drive the
ENABLE_FASTLOGGERplatform whitelistin the top-level
CMakeLists.txt(ThreadUtilities.h,BackendWorkerLock.h,Rdtsc.h) were diffed -- onlyThreadUtilities.hchanged and the change is an opt-in feature (
QUILL_USE_SEQUENTIAL_THREAD_ID)that leaves existing platform branches intact, so the whitelist does not
need updating.
Note: libpng was further updated from 1.6.56 to 1.6.57 in a follow-up
commit pushed directly to main (55492bf) after this PR was merged,
because 1.6.57 was released upstream in the interim.
Tooling
Two new helper scripts under
dependencies/:check-upstream-versions.sh: queries each bundled library's upstream(GitHub releases API, plus scraping for sqlite / libpng / 7zip) and
compares to the
# Version:comment in eachdependencies/<lib>/CMakeLists.txt(with a README.md fallback). Printsa table and exits 1 if any updates are available. Honors
GITHUB_TOKENto raise the API rate limit. Usable from CI as a freshness check.
update-bundled-dep.sh: downloads an upstream release tarball andrefreshes the currently-bundled subset of files by matching each
bundled file by relative path (basename fallback) in the upstream tree,
then updates the
# Version:/# Source:URL comments inCMakeLists.txtand the version cell inREADME.md. Handles tar.gz,tar.xz, tar.bz2, and zip archives; for sqlite3 it derives the
year-dependent download URL automatically.
Also replaces non-ASCII em-dashes in
dependencies/README.mdwith ASCIIequivalents to comply with the project's ASCII-only convention, and bumps
the stale
expatrow in the README (2.7.4 -> 2.7.5) to match thebundled source, which was updated in an earlier commit without touching
the README table.
Test plan
cmake --build --target _BUNDLED_PNGthenPDF-- libpng 1.6.56 and 1.6.57 compile, PDF linkscmake --build --target _BUNDLED_HPDFthenPDF-- libharu 2.4.6 compiles, PDF linkscmake --build --target _BUNDLED_SQLITE3thenDataSQLite-- SQLite 3.53.0 compiles and DataSQLite linkscmake --build --target Foundation-- Quill 11.1.0 headers compile viaFastLogger.cpp./dependencies/check-upstream-versions.sh-- all tracked libraries report "up to date"