You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Update vendored zlib to 1.4 and prepare release 3.10.310.1 - #1558
Update the vendored zlib sources and bundled minizip files from 1.3.2 to the latest upstream release, 1.4, including its security and correctness fixes.
Record upstream commit 99623ef7097352da7993ba614161fd6a311e046e in cgmanifest.json.
Preserve the SDK's act_z_ symbol isolation and legacy Windows/CMake library names. Synchronize the CMake header template with 1.4's Windows large-file support, fix prefixed large-file macro redefinitions, populate pkg-config metadata, and run the existing 64-bit-offset examples on Windows too.
vcpkg behavior
The SDK's vcpkg recipes already select an external zlib package rather than the vendored copy (Apple uses the OS library). The public vcpkg registry currently provides zlib 1.3.2#3, so this PR cannot update that dependency just by replacing the SDK's sources. vcpkg needs its own zlib port update to 1.4; consumers then need a registry checkout/baseline that includes that update. Existing pinned baselines do not advance automatically. No unrelated registry PR or custom overlay is introduced here.
Validation
Windows x64, Visual Studio 2026: SDK build and all 29 selected compression, HTTP encoding/decoding, payload decoding, and zlib utility tests passed.
Linux x64, Ubuntu/WSL with GCC 13: SDK build and the same 29 selected tests passed.
Standalone zlib: both normal and 64-bit-offset example tests passed on Windows and Linux; Windows 64-bit static consumer also compiled under /W4 /WX and ran successfully.
Linux static-library symbol inspection: every defined global symbol retains the SDK's act_z_ prefix.
vcpkg native and registry feature contracts, package dependency contracts, and all 13 release-port tests passed. These are recipe contract checks, not a full vcpkg package installation.
Existing repository spellcheck lint and git diff --check passed.
Only targeted SDK suites were run; no selected tests were skipped. Existing unrelated GoogleTest CMake deprecations, MSVC warning-level override notices, and SQLite macro redefinition warnings remain. The standalone zlib build was also exercised without the SDK's third-party warning suppression.
CI runner compatibility
Replace the retired macos-14 iOS matrix lane with supported macos-26 and its installed iPhone 17 / iPad Pro 11-inch (M5) simulators. Keep the macos-15 lane and all eight debug/release phone/tablet combinations. Existing iOS deployment targets remain unchanged.
Verified supported labels and simulator inventories against GitHub's runner reference and the macOS 26 image inventory. Parsed workflow YAML and validated all expanded matrix combinations locally on Windows and Linux; existing spellcheck lint and whitespace checks passed. Actual Xcode/simulator execution requires hosted CI.
Use supported macos-26 runners and their installed iPhone 17 and iPad Pro 11-inch (M5) simulators. Preserve the macos-15 jobs, all eight debug/release phone/tablet combinations, and the existing iOS deployment targets.
Files changed:
.github/workflows/build-ios-mac.yml
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 75db4712-f7f2-445b-bb95-9881e4c13228
Integrate the concurrent main-branch merge without rewriting either commit history. The merge introduces no additional manual file edits.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 75db4712-f7f2-445b-bb95-9881e4c13228
Use Google's Maven Central mirror before the shared rate-limited endpoint while preserving full Java builds and CodeQL analysis. Prepare a distinct SwiftPM-compatible release version and pin the default Swift binary to the latest published artifact.
Files: lib/android_build/build.gradle, lib/include/public/Version.hpp, Package.swift
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7aef1c72-9845-4155-bc0c-969d69703c6e
Updates the SDK’s vendored zlib to 1.4, bringing upstream security and correctness fixes while retaining SDK-specific symbol isolation and legacy library names. External vcpkg dependencies remain unchanged.
Changes:
Refresh zlib and minizip sources, documentation, version metadata, and upstream provenance.
Update Windows large-file support, packaging metadata, and standalone build/test integration.
Refresh iOS CI runners, add an Android dependency mirror, and advance SDK/Swift package version references.
File
Description
zlib/zutil.c
Fix allocation cleanup.
zlib/zlib.pc.cmakein
Populate configured installation paths.
zlib/zlib.h
Update version, API documentation, and large-file aliases.
zlib/zlib.3
Update manual release information.
zlib/zconf.h.in
Update offset types and Windows large-file support.
zlib/zconf.h.cmakein
Synchronize CMake-generated offset definitions.
zlib/zconf.h
Update bundled offset definitions.
zlib/win32/README-WIN32.txt
Update Windows release references.
zlib/win32/Makefile.msc
Remove the fixed DLL base address.
zlib/uncompr.c
Use portable null-pointer macros.
zlib/trees.c
Bound character classification input.
zlib/treebuild.xml
Update package version metadata.
zlib/test/minigzip.c
Improve memory-mapping portability.
zlib/test/infcover.c
Extend invalid-dictionary coverage and allocation handling.
zlib/qnx/package.qpg
Update QNX library version references.
zlib/Makefile.in
Update version and AIX export generation.
zlib/inftrees.h
Adjust workaround decoding-table limits.
zlib/inftrees.c
Update version and invalid-code entries.
zlib/inflate.h
Track requested window and wrapper settings.
zlib/inflate.c
Fix reset, synchronization, dictionary, and copy handling.
zlib/infback.c
Correct fast-path window bookkeeping.
zlib/gzwrite.c
Fix buffering, zero-fill, and stalled-write handling.
zlib/gzread.c
Revise buffered errors, skipping, and stream-end handling.
zlib/gzlib.c
Harden file opening, seeking, and error state.
zlib/gzguts.h
Add portable blocking checks and offset limits.
zlib/deflate.c
Fix reset, priming, copying, and block completion.
zlib/crc32.c
Explicitly cast the initial braid checksum.
zlib/contrib/pascal/zlibpas.pas
Update Pascal version constants.
zlib/contrib/minizip/zip.h
Document extra-field size limits.
zlib/contrib/minizip/zip.c
Harden ZIP64 metadata, parsing, and cleanup.
zlib/contrib/minizip/unzip.h
Clarify truncated-string handling.
zlib/contrib/minizip/unzip.c
Validate ZIP64 locations and extra-field boundaries.
These zlib comments CoPilot made are perhaps accurate, but I would prefer to copy the library as is rather than making my own modifications, so I am resolving them.
The reason will be displayed to describe this comment to others. Learn more.
I would hold approval until the read error-path and minizip packaging issues below are addressed. All 29 targeted SDK tests passed locally, but they do not cover these cases. The sanitizer reproduction was inconclusive.
Address Copilot review 5796312309 and the matching maintainer comments in one round.
4489489986: reset x.next before gz_load so partial I/O errors retain a valid buffer pointer (zlib/gzread.c:272).
4489490045: put minizip before its private zlib/bzip2 dependencies and expose installed pkg-config headers (zlib/contrib/minizip/minizip.pc.txt:12).
4489490080: export include/minizip for both library targets and extend the installed-consumer test (zlib/contrib/minizip/CMakeLists.txt:168).
4489490115: use minizip's own version variables to preserve the standalone SONAME (zlib/contrib/minizip/CMakeLists.txt:187).
Files: zlib/gzread.c; zlib/contrib/minizip/CMakeLists.txt; zlib/contrib/minizip/minizip.pc.txt; zlib/contrib/minizip/test/find_package_test.cmake.in
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7aef1c72-9845-4155-bc0c-969d69703c6e
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
A failed seek with 32-bit z_off_t can still advance the stream position, violating the documented position-preservation guarantee and affecting subsequent writes.
Probe fopen64 with the library's large-file definition
zlib/contrib/minizip/CMakeLists.txt:67
On glibc, fopen64 is declared only when _LARGEFILE64_SOURCE is enabled, but this symbol check runs before that definition is supplied. A default configuration therefore records HAVE_FOPEN64 as false and enables USE_FILE32API on both libraries. With the 32-bit build guard removed, supported 32-bit Linux builds now silently use ftell/fseek with 32-bit long, breaking ZIP64 access beyond 2 GiB despite the platform providing the 64-bit APIs. Run this probe with the same large-file definition used by the library.
Cached BZip2 feature state leaks across installations
zlib/contrib/minizip/minizipConfig.cmake.in:8
Caching this package feature leaves stale dependency metadata when a consumer switches installations in the same build directory. After finding a BZip2-disabled minizip, finding a BZip2-enabled installation keeps the cached OFF value, skips find_dependency(BZip2), and leaves the exported libraries referring to an undefined BZip2::BZip2 target. Set this as a normal variable so it always reflects the installation being loaded.
Validate EOCD candidates before accepting comment signatures
zlib/contrib/minizip/unzip.c:486
A valid ZIP64 archive whose global comment ends in PK\x05\x06 is now rejected because the classic-directory search treats those comment bytes as the end-of-central-directory record and misses the real ZIP64 locator. Validate each candidate's fixed header and declared comment length before using its position, while retaining the immediate-predecessor restriction for the locator. The same issue prevents appending in zlib/contrib/minizip/zip.c:840–842.
Avoid signed overflow when seeking from a negative position
zlib/gzlib.c:395
pos can be negative: gzungetc() before the first read decrements x.pos from 0 to -1. A subsequent gzseek64(file, 1, SEEK_CUR) should consume that pushed-back byte and return 0, but GZ_OFF_MAX - pos overflows the signed offset type before this comparison (and rejects the seek on wrapping implementations). Only apply the upper-bound subtraction when pos is nonnegative; the following lower-bound check can still reject positions before the start.
Address Copilot comment 4492974289: route gzseek and gzseek64 through shared preflight so z_off_t range validation runs before any buffer, descriptor, or pending-position mutation (zlib/gzlib.c:371).
Avoid subtracting a negative pushed-back position from the maximum offset in the same preflight. Extend the existing gzip example tests to cover failed seeks at the offset limit and seeking back from gzungetc's negative position; both reproduced failures before this fix.
Files: zlib/gzlib.c; zlib/test/example.c
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7aef1c72-9845-4155-bc0c-969d69703c6e
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Unresolved issues can reject valid ZIP64 archives, break consumer configuration when switching BZip2 dependencies, and truncate or fail large-file offsets on 32-bit builds.
No open issues 🎉
3 previously missed issues
In code that hasn't changed since last review
Probe fopen64 with the library's large-file feature macro
zlib/contrib/minizip/CMakeLists.txt:67
This declaration check runs without _LARGEFILE64_SOURCE, so glibc reports HAVE_FOPEN64 as false even when the function is available. Both minizip targets then enable USE_FILE32API, which maps the 64-bit seek/tell functions to fseek/ftell in ioapi.h. With the 32-bit build restriction removed, offsets above LONG_MAX can now be truncated or fail. Run this probe with the same large-file feature macro used to compile the library.
Avoid caching the package's bzip2 dependency setting
zlib/contrib/minizip/minizipConfig.cmake.in:8
Caching this package property preserves the old value when a consumer reconfigures against a different minizip installation. For example, switching from a build without bzip2 to one with bzip2 leaves the cached value OFF, skips find_dependency(BZip2), and imports targets referencing an undefined BZip2::BZip2, causing generation to fail. Set this as a normal variable so it always reflects the loaded package's compiled dependencies.
Skip invalid EOCD signatures when searching for the real record
zlib/contrib/minizip/unzip.c:486
The classic end-of-central-directory (EOCD) search accepts signatures inside comments, so a valid ZIP64 archive whose comment ends with PK\x05\x06 now fails to open because the lookup misses the real ZIP64 locator and reads a truncated header. Validate each candidate's fixed header and declared comment length, continuing past invalid matches while retaining the adjacent-locator restriction. The same regression affects opening archives for append in zlib/contrib/minizip/zip.c:840–842; update both search helpers.
Probe fopen64 with the library's large-file feature macro so supported
platforms do not silently select the 32-bit file API. Preserve and restore
the caller's CMake check state around the related feature probes.
Verified at zlib/contrib/minizip/CMakeLists.txt:67-86.
Read BZip2 support from the installed package instead of a consumer cache,
so changing package variants also updates the required imported targets.
Verified at zlib/contrib/minizip/minizipConfig.cmake.in:4-8.
Skip EOCD signatures without a complete header and a comment ending at EOF,
while retaining the adjacent ZIP64 locator rule for read and append.
Verified at zlib/contrib/minizip/unzip.c:366-386 and zip.c:745-765.
Add shared/static archive regressions, large-offset callback checks, and
stale consumer-cache coverage. Reproduced the archive and package failures
on Windows and Linux before applying the production fixes.
Files changed:
- zlib/contrib/minizip/CMakeLists.txt
- zlib/contrib/minizip/minizipConfig.cmake.in
- zlib/contrib/minizip/unzip.c
- zlib/contrib/minizip/zip.c
- zlib/contrib/minizip/test/CMakeLists.txt
- zlib/contrib/minizip/test/archive-test.c
- zlib/contrib/minizip/test/find_package_test.cmake.in
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7aef1c72-9845-4155-bc0c-969d69703c6e
Addressed all three remaining minizip summary advisories from review 5801043339 in ddf90d2:
Large-file probe: detect fopen64 with _LARGEFILE64_SOURCE=1, matching library compilation, while preserving/restoring CMake's required-check state. Linux now detects the symbol and does not select USE_FILE32API.
BZip2 dependency state: read the installed package's feature setting as a normal variable instead of retaining a consumer cache option. Tests cover stale opposite-valued caches; an actual installed consumer also reconfigured and built OFF -> ON -> OFF without clearing its cache.
EOCD search: skip candidate signatures unless a complete 22-byte header is available and the declared comment ends at EOF. Both read and append continue backwards to the real record, and the adjacent ZIP64-locator rule remains unchanged.
Added shared/static regressions covering classic/ZIP64 read and append, self-extracting prefixes, truncated false signatures, incorrect comment lengths, scan-window boundaries, 65,535-byte comments, and seeks beyond 4 GiB. The archive and cached-dependency regressions failed on both Windows and Linux before the production fixes.
Validation: standalone suites 11/11 Windows VS 2026, 11/11 Linux BZip2 OFF, 11/11 Linux BZip2 ON; integrated upstream zlib+minizip 24/24 Windows, 28/28 Linux. No tests were skipped or filtered in these passing suites. Spelling checks and git diff --check pass. Local 32-bit Linux runtime testing is unavailable because the multilib CRT is not installed.
The identical fixes and regressions are also pushed to the existing upstream PR: madler/zlib#1375 (ed3cc8c89d8b0bd359759f2c7897ebcfd5a31a28).
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Human assessment is needed for omitted findings involving undefined behavior in fresh-stream gzip handling and unusable pkg-config metadata for static-only MinGW builds.
The new shared minizip test also needs its DLLs beside the executable on
Cygwin, where WIN32 is false. Use the same runtime-copy setup as Windows
instead of leaving the regression executable unable to start.
Files changed:
- zlib/contrib/minizip/test/CMakeLists.txt
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7aef1c72-9845-4155-bc0c-969d69703c6e
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Human assessment is needed to evaluate critical undefined behavior in normal gzip use alongside parallel-test races and platform-specific packaging failures.
Follow-up validation: 00c3446 fixes DLL deployment for the new shared archive regression on Cygwin (where WIN32 is false). The identical upstream follow-up now passes all 26 Cygwin tests, including both shared/static archive regressions, without excluding tests: https://github.com/madler/zlib/actions/runs/42235455471/job/127951741676
The three requested minizip advisories remain fixed. The latest Copilot review (5801785602) on this exact SDK head adds no inline comments, but its summary raises different, additional advisories involving normal/fresh-stream gzip undefined behavior, parallel-test races, and platform-specific packaging. These have not been resolved by this three-advisory batch and should not be confused with a fully clean review. The previous pass specifically mentioned static-only MinGW pkg-config metadata; that is also not addressed here.
Windows/Linux x64 suites and the Cygwin job pass. The wider SDK and upstream CI matrices are still running, with no failures currently reported on either new head.
Avoid evaluating an uninitialized output pointer when seeking fresh gzip
readers, and exercise fresh seeks in the existing gzip example. Give the
parallel example tests separate archives to prevent cross-test corruption.
Generate minizip pkg-config metadata from actual per-configuration library
names so static-only Windows/MinGW consumers find minizips and zs. Add an
installed metadata consumer that links using pkg-config output.
Verified: zlib/gzlib.c:434, zlib/CMakeLists.txt:228, and
zlib/contrib/minizip/CMakeLists.txt:313 in this repository.
Files changed:
- zlib/CMakeLists.txt
- zlib/gzlib.c
- zlib/test/example.c
- zlib/contrib/minizip/CMakeLists.txt
- zlib/contrib/minizip/minizip.pc.txt
- zlib/contrib/minizip/test/CMakeLists.txt
- zlib/contrib/minizip/test/pkg-config-test.cmake.in
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7aef1c72-9845-4155-bc0c-969d69703c6e
Addressed the three remaining summary advisories in ca92318:
Fresh-reader gzip seeks no longer evaluate an uninitialized output pointer when the skip count is zero. Added fresh seeks to offsets 0 and 1 to the existing gzip example. This was confirmed from source; the sanitizer baseline did not reproduce a diagnostic, so I am not claiming a before/after sanitizer failure.
Reproduced parallel example/example64 archive corruption before the fix. Each now uses its own filename; both pass 20 parallel repetitions on Windows and Linux. Upstream already isolates those filenames; this was specific to the SDK's older CMake layout.
Static-only minizip pkg-config metadata now names the actual libraries (including Windows/MinGW static suffixes and Debug postfixes). Added a consumer that links using the installed pkg-config output, not the CMake minizip target.
Validation: Windows VS 2026 shared/static minizip 11/11; Windows static-only 10/10 plus a native MSVC consumer compiled, linked and ran using actual pkg-config --msvc-syntax output. Linux mixed builds 13/13 each and static-only builds 12/12 each, with BZip2 both OFF and ON. Integrated upstream package tests passed on Windows and Linux. Linux MemorySanitizer/UBSan gzip examples passed. No tests were skipped; existing WILL_FAIL cases intentionally check invalid package requests.
Upstream packaging follow-up: madler/zlib#1375 (057660cc), including a real static-only MinGW pkg-config CI job. The fresh-reader guard is also being added to the existing upstream seek PR.
The new upstream exact-platform checks are now green: mingw64 passed 30/30 standard tests plus 4/4 static-only archive/pkg-config checks on 057660cc; Cygwin also passed. This validates the actual minizips/zs static archive names rather than relying only on Linux or MSVC. The upstream fresh-reader fix is now published as afb49d12 in madler/zlib#1376.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Human assessment is needed to evaluate critical undefined behavior from an uninitialized pointer in gzip handling and pkg-config metadata defects that can break downstream consumers.
gzdirect calls gz_skip_have after header detection even when no output
is buffered. Avoid its zero-count arithmetic on an uninitialized pointer
and exercise gzdirect in the existing fresh-reader tests.
Include imported dependency search directories in pkg-config output and
resolve BZip2 names per configuration instead of assuming bz2. This also
covers non-system BSD dependency prefixes. Stop manually adding zlib's
library directory in the consumer test so it must come from the metadata.
Verified: zlib/gzread.c:300, zlib/gzread.c:700, and
zlib/contrib/minizip/CMakeLists.txt:388 in this repository.
Files changed:
- zlib/gzread.c
- zlib/test/example.c
- zlib/contrib/minizip/CMakeLists.txt
- zlib/contrib/minizip/test/pkg-config-test.cmake.in
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7aef1c72-9845-4155-bc0c-969d69703c6e
The follow-up review (5805099783) still flagged gzip pointer initialization and metadata, without inline locations. A further source trace found a second real gzip path: gzdirect() calls gz_skip_have() after header detection even when x.have is zero, so that helper also needed the zero-count guard. Fixed in eca744f and covered by calling gzdirect() before fresh-reader seeks. Windows/Linux examples and Linux MemorySanitizer/UBSan tests pass. Upstream: d97e3053 in madler/zlib#1376.
The new upstream pkg-config consumer also exposed an OpenBSD failure. Dependency metadata now includes imported library search directories (e.g. BZip2 under /usr/local/lib), and resolves BZip2 filenames per configuration rather than hardcoding bz2. The consumer test no longer supplies zlib's library directory separately, so all library paths must come from the .pc file. Linux mixed/static-only BZip2 OFF/ON consumers pass; native MSVC links and runs using only pkg-config-provided library flags. The fresh OpenBSD/MinGW/Cygwin CI run is pending on upstream 5107ca28.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Human assessment is needed because minizip’s pkg-config metadata can omit non-system zlib include paths, while manually supplied paths in the consumer test can mask resulting build failures.
Minizip public headers include zlib.h, so consumers need the imported
zlib include paths even when that installation is outside system paths.
Remove find_package and all manually supplied dependency paths from the
pkg-config consumer so the test cannot hide incomplete metadata.
Reproduced MSVC C1083 for zlib.h before the fix. The same consumer now
compiles, links and runs using only pkg-config cflags and library flags.
Verified: zlib/contrib/minizip/CMakeLists.txt:390 in this repository.
Files changed:
- zlib/contrib/minizip/CMakeLists.txt
- zlib/contrib/minizip/minizip.pc.txt
- zlib/contrib/minizip/test/CMakeLists.txt
- zlib/contrib/minizip/test/pkg-config-test.cmake.in
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 7aef1c72-9845-4155-bc0c-969d69703c6e
Fixed the new external-zlib-header advisory from review 5805277855 in eb7d0ef. Minizip's public headers include zlib.h, so pkg-config now exports the imported zlib target's include directories. Removed find_package(ZLIB) and all manually injected dependency include/library directories from the pkg-config consumer; it now uses only pkg-config output.
Reproduced the exact failure before the fix with native VS 2026: fatal C1083, cannot open zlib.h. The same consumer now compiles, links and runs using only pkg-config --cflags/--static --libs --msvc-syntax, with no supplied dependency paths. All five Linux consumer configurations (mixed/static-only with BZip2 OFF/ON, plus integrated upstream) pass. No tests were skipped. Equivalent upstream fix: c16e80b9 in madler/zlib#1375.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Human assessment is needed because the published review omits a critical gzip seek overflow that can hang reads and a pkg-config defect that breaks absolute installation paths.
Reject unrepresentable pending skip distances after gzungetc before changing
stream state. Preserve absolute GNUInstallDirs paths in pkg-config metadata
without changing relative-path relocation. Keep this batch limited to the
two remaining review advisories.
Files changed:
- zlib/gzlib.c
- zlib/test/example.c
- zlib/contrib/minizip/CMakeLists.txt
- zlib/contrib/minizip/minizip.pc.txt
- zlib/contrib/minizip/test/pkg-config-test.cmake.in
Validated Windows VS 2026 and Linux gzip examples, Linux UBSan, default
minizip suites, and real absolute-path pkg-config consumers on both systems.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 45505750-df85-4f9b-bfe4-c489a562f9e1
Addressed only the two advisories in review 5805454467, in 95ba388:
Gzip seek overflow: add a two-line bounds check before computing the pending skip distance. A reader positioned before byte zero by gzungetc now rejects an unrepresentable distance without changing position. The existing example regression reproduced the failure on Windows and Linux; it also exercises gzseek64 explicitly.
Absolute pkg-config install paths: preserve absolute CMAKE_INSTALL_LIBDIR/CMAKE_INSTALL_INCLUDEDIR values rather than prepending exec_prefix. Relative-path relocation remains unchanged. Adapt the existing pkg-config consumer to locate an absolute library directory.
Validation: gzip examples 2/2 on Windows VS 2026 and 2/2 on Linux; Linux UBSan 2/2. Default static minizip suites 10/10 Windows and 12/12 Linux. Targeted absolute-layout checks 2/2 Windows and 4/4 Linux, plus real pkg-config-only consumers compiled, linked and ran on both platforms. Those consumers fail against the unchanged metadata with missing public headers. Existing spelling checks and git diff --check pass.
Absolute-layout validation is deliberately scoped to archive/install/pkg-config behavior: the broader package-discovery harness assumes a relative installation layout, and a deeply nested Windows scratch build also hit path-length errors. I have not expanded this batch into unrelated harness or vendored-zlib cleanups. No selected tests were skipped; existing WILL_FAIL tests intentionally reject invalid component requests. Hosted CI on the new commit remains pending.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Baiju Meswani (baijumeswani)
left a comment
Summary
99623ef7097352da7993ba614161fd6a311e046eincgmanifest.json.act_z_symbol isolation and legacy Windows/CMake library names. Synchronize the CMake header template with 1.4's Windows large-file support, fix prefixed large-file macro redefinitions, populate pkg-config metadata, and run the existing 64-bit-offset examples on Windows too.vcpkg behavior
The SDK's vcpkg recipes already select an external zlib package rather than the vendored copy (Apple uses the OS library). The public vcpkg registry currently provides zlib 1.3.2#3, so this PR cannot update that dependency just by replacing the SDK's sources. vcpkg needs its own zlib port update to 1.4; consumers then need a registry checkout/baseline that includes that update. Existing pinned baselines do not advance automatically. No unrelated registry PR or custom overlay is introduced here.
Validation
/W4 /WXand ran successfully.act_z_prefix.git diff --checkpassed.Only targeted SDK suites were run; no selected tests were skipped. Existing unrelated GoogleTest CMake deprecations, MSVC warning-level override notices, and SQLite macro redefinition warnings remain. The standalone zlib build was also exercised without the SDK's third-party warning suppression.
CI runner compatibility
Replace the retired
macos-14iOS matrix lane with supportedmacos-26and its installediPhone 17/iPad Pro 11-inch (M5)simulators. Keep the macos-15 lane and all eight debug/release phone/tablet combinations. Existing iOS deployment targets remain unchanged.Verified supported labels and simulator inventories against GitHub's runner reference and the macOS 26 image inventory. Parsed workflow YAML and validated all expanded matrix combinations locally on Windows and Linux; existing spellcheck lint and whitespace checks passed. Actual Xcode/simulator execution requires hosted CI.