Skip to content

[zlib] Update to v1.3.2.#50538

Closed
scschaefer wants to merge 7 commits into
microsoft:masterfrom
scschaefer:zlib
Closed

[zlib] Update to v1.3.2.#50538
scschaefer wants to merge 7 commits into
microsoft:masterfrom
scschaefer:zlib

Conversation

@scschaefer

@scschaefer scschaefer commented Mar 18, 2026

Copy link
Copy Markdown
Contributor

Fixes #50060

  • Changes comply with the maintainer guide.
  • SHA512s are updated for each updated download.
  • The "supports" clause reflects platforms that may be fixed by this new version, or no changes were necessary.
  • Any fixed CI baseline and CI feature baseline entries are removed from that file, or no entries needed to be changed.
  • All patch files in the port are applied and succeed.
  • The version database is fixed by rerunning ./vcpkg x-add-version --all and committing the result.
  • Exactly one version is added in each modified versions file.

dg0yt
dg0yt reviewed Mar 19, 2026
View reviewed changes
Comment thread ports/zlib/portfile.cmake Outdated
dg0yt
dg0yt reviewed Mar 19, 2026
View reviewed changes
Comment thread ports/zlib/portfile.cmake Outdated
dg0yt
dg0yt reviewed Mar 19, 2026
View reviewed changes
Comment thread ports/zlib/portfile.cmake Outdated
dg0yt
dg0yt reviewed Mar 19, 2026
View reviewed changes
Comment thread ports/zlib/vcpkg-cmake-wrapper.cmake Outdated
dg0yt
dg0yt reviewed Mar 19, 2026
View reviewed changes
Comment thread ports/zlib/portfile.cmake Outdated
@dg0yt

dg0yt commented Mar 19, 2026

Copy link
Copy Markdown
Contributor

Before this is merged, someone needs to check mingw.

@AenBleidd

AenBleidd commented Mar 19, 2026

Copy link
Copy Markdown
Contributor

@dg0yt, what exactly needs to be checked on MinGW? I can test a general build if this is enough

@scschaefer
Fixed _ZLIB_supported_components.
f69a87e 
Irrelevant of the actual configuration for shared and/or static compilation, ZLIBConfig.cmake always assumes that both are available.
@dg0yt

dg0yt commented Mar 20, 2026

Copy link
Copy Markdown
Contributor

@dg0yt, what exactly needs to be checked on MinGW? I can test a general build if this is enough

The exported link library name must be checked:

  • static vs. dynamic
  • release vs. debug
  • cmake config, cmake module (wrapper) and pkgconfig

@scschaefer

scschaefer commented Mar 27, 2026

Copy link
Copy Markdown
Contributor Author

To be perfectly honest, I don't really know how to proceed at this point.
The failing windows ports, seem to try to link to the old library name, thus I guess it's hard-coded.
And I have no idea why the Linux and Android ports are failing to find ZLIB::ZLIB via CMake.
Anyones got an idea?

@dg0yt

dg0yt commented Mar 27, 2026

Copy link
Copy Markdown
Contributor

Read CI logs, or inspect locally. Build a test project. Enable CMake tracing in the test projected if needed.

x64-linux CI has three failing ports. e.g. elfutils:

/usr/bin/ld: /mnt/vcpkg-ci/installed/x64-linux/debug/lib/libz.a(crc32.c.o): in function `crc32':
/mnt/vcpkg-ci/b/zlib/src/v1.3.2-700164f843.clean/crc32.c:946: multiple definition of `crc32'; ../libelf/libelf.a(crc32.o):/mnt/vcpkg-ci/b/elfutils/x64-linux-dbg/lib/.././../src/elfutils-0-f31cfd13fb.clean/lib/crc32.c:95: first defined here
collect2: error: ld returned 1 exit status

crc32 is probably a new symbol in libz.

Does the config provide ZLIB::ZLIB? It should, if it is to act as a drop-in replacement. Without it, projects will stumble over CMAKE_FIND_PACKAGE_PREFER_CONFIG. Typical issue when projects introduce CMake config while an established Find module is widely used.

@AenBleidd AenBleidd mentioned this pull request Mar 30, 2026
Closed
7 tasks
@dg0yt

dg0yt commented Apr 3, 2026

Copy link
Copy Markdown
Contributor

Do you need help with this update?

@Neustradamus

Neustradamus commented Apr 10, 2026

Copy link
Copy Markdown

Note: There is a duplicate here:

Linked to:

@Neustradamus

Neustradamus commented Apr 10, 2026

Copy link
Copy Markdown

Dear all,

Any progress on it?

Important: Zlib 1.3.2 fixes the CVE-2026-27171:

@Neustradamus Neustradamus mentioned this pull request Apr 10, 2026
Closed
@dg0yt

dg0yt commented Apr 11, 2026

Copy link
Copy Markdown
Contributor

@scschaefer Again: Do you need help with this update?

@scschaefer

scschaefer commented Apr 13, 2026

Copy link
Copy Markdown
Contributor Author

Hi @dg0yt and @Neustradamus,

Sorry, I was out sick the last two weeks.
And yes, help would be appreciated, especially as I won't be able to spend that much more time on this pull request, as I have other work projects I need to focus on at the moment. 🤔

@dg0yt

dg0yt commented Apr 14, 2026

Copy link
Copy Markdown
Contributor

I can easily reproduce the crc32 conflict on x64-linux with port elfultils. I see that madler/zlib@7eab3fd#diff-32aa519b0ec0b4a9782894001a94161f9d05c23aa58d77dfbd19b77a17af03e2L947-R945 changed the signature but I don't understand yes how this could trigger the new clash. There are no tickets in zlib, but maybe static library linkage isn't used in similar ways outside vcpkg.

mike-malburg added a commit to TechSmith/ThirdParty-Packages-vcpkg that referenced this pull request Apr 15, 2026
@mike-malburg
Update zlib to 1.3.2 using scschaefer/vcpkg fork
0b84fee 
The official Microsoft vcpkg repo does not yet have 1.3.2 available, due to the fact that the main author of the update has kind of run short on time to see his contribution through.  It is failing some of the tests for some of the other packages in the vcpkg repo.  Zlib is a dependency for a LOT of other libraries.

I am pulling in his update as it seems to work for our use cases, and is the leading PR to make this update, and appears to be getting some help soon from another contributer.

- Microsoft-related issue: microsoft/vcpkg#50060
- Leading PR to resolve this: microsoft/vcpkg#50538
- Some dependent ports seem to be failing on Windows and Linux:
  - microsoft/vcpkg#50538 (comment)
  - microsoft/vcpkg#50538 (comment)
- Author comment that he needs help seeing this through: microsoft/vcpkg#50538 (comment)
- A leading vcpkg contributor offering help on 4/14/2026: microsoft/vcpkg#50538 (comment)
mike-malburg added a commit to TechSmith/ThirdParty-Packages-vcpkg that referenced this pull request Apr 16, 2026
@mike-malburg
Update zlib to 1.3.2 using scschaefer/vcpkg fork
b948875 
The official Microsoft vcpkg repo does not yet have 1.3.2 available, due to the fact that the main author of the update has kind of run short on time to see his contribution through.  It is failing some of the tests for some of the other packages in the vcpkg repo.  Zlib is a dependency for a LOT of other libraries.

I am pulling in his update as it seems to work for our use cases, and is the leading PR to make this update, and appears to be getting some help soon from another contributer.

- Microsoft-related issue: microsoft/vcpkg#50060
- Leading PR to resolve this: microsoft/vcpkg#50538
- Some dependent ports seem to be failing on Windows and Linux:
  - microsoft/vcpkg#50538 (comment)
  - microsoft/vcpkg#50538 (comment)
- Author comment that he needs help seeing this through: microsoft/vcpkg#50538 (comment)
- A leading vcpkg contributor offering help on 4/14/2026: microsoft/vcpkg#50538 (comment)
mike-malburg added a commit to TechSmith/ThirdParty-Packages-vcpkg that referenced this pull request Apr 17, 2026
@mike-malburg
Update zlib to 1.3.2 using scschaefer/vcpkg fork
6284e9c 
The official Microsoft vcpkg repo does not yet have 1.3.2 available, due to the fact that the main author of the update has kind of run short on time to see his contribution through.  It is failing some of the tests for some of the other packages in the vcpkg repo.  Zlib is a dependency for a LOT of other libraries.

I am pulling in his update as it seems to work for our use cases, and is the leading PR to make this update, and appears to be getting some help soon from another contributer.

- Microsoft-related issue: microsoft/vcpkg#50060
- Leading PR to resolve this: microsoft/vcpkg#50538
- Some dependent ports seem to be failing on Windows and Linux:
  - microsoft/vcpkg#50538 (comment)
  - microsoft/vcpkg#50538 (comment)
- Author comment that he needs help seeing this through: microsoft/vcpkg#50538 (comment)
- A leading vcpkg contributor offering help on 4/14/2026: microsoft/vcpkg#50538 (comment)
@dg0yt dg0yt mentioned this pull request Apr 18, 2026
Merged
@Neustradamus

Neustradamus commented Apr 23, 2026

Copy link
Copy Markdown

@dg0yt has done a PR here:

@BillyONeal has merged it.

It fixes the CVE-2026-27171:

Linked to:

@scschaefer scschaefer closed this Apr 24, 2026
@scschaefer scschaefer deleted the zlib branch April 24, 2026 05:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@dg0yt dg0yt dg0yt left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[zlib] update to 1.3.2

4 participants

@scschaefer @dg0yt @AenBleidd @Neustradamus