Skip to content

GH-51007: [C++] Make uriparser an external dependency - #51244

Open
imtherealnaska wants to merge 1 commit into
apache:mainfrom
imtherealnaska:gh-51007-uriparser-external
Open

GH-51007: [C++] Make uriparser an external dependency#51244
imtherealnaska wants to merge 1 commit into
apache:mainfrom
imtherealnaska:gh-51007-uriparser-external

Conversation

@imtherealnaska

@imtherealnaska imtherealnaska commented Sep 8, 2026

Copy link
Copy Markdown

Rationale for this change

Updating the uriparser version so as to include security fixes. Rather than refreshing vendored copy , this makes uriparser and external dependency.

What changes are included in this PR?

AI generated, because there are too many changes and might miss some

  • uriparser added to ARROW_THIRDPARTY_DEPENDENCIES, with a
    build_uriparser() ExternalProject pinned to 1.0.2 (docs, tests, tools
    and wchar_t support disabled; static; URI_STATIC_BUILD on the
    interface; registered in ARROW_BUNDLED_STATIC_LIBS).
  • REQUIRED_VERSION "1.0.2", so every build gets a uriparser carrying all
    fixes through 1.0.2.
  • New cmake_modules/FinduriparserAlt.cmake. Upstream ships a CMake package
    config, but Debian/Ubuntu's liburiparser-dev installs only
    liburiparser.pc, so the module tries find_package(CONFIG) first, then
    pkg-config, then a plain library search.
  • ARROW_STATIC_INSTALL_INTERFACE_LIBS gains uriparser::uriparser for
    SYSTEM builds, so static consumers link correctly.
  • meson: new subprojects/uriparser.wrap (method = cmake, same tarball
    and checksum as the CMake pin) plus a cmake.subproject fallback, since
    meson has no BUNDLED equivalent.
  • cpp/src/arrow/vendored/uriparser/ (28 files) and its LICENSE.txt
    section removed; util/uri.cc now includes <uriparser/Uri.h>.
  • Packaging: 6 dockerfiles, conda, Brewfile, both vcpkg manifests, MSYS2
    PKGBUILD and msys2_setup.sh, r_windows_build.sh, the
    -Duriparser_SOURCE passthrough in cpp_build.sh, and the dependency
    list in building.rst.

NOTICE : Having 1.0.2 as floor means ,nearly every distro has to build it from source until they catch up.

Are these changes tested?

All existing tests pass.

Verified on Ubuntu 22.04:

  • With 0.9.6 (Distro bundled)present, it finds that the version is not suitable and falls back to building 1.0.2
  • Explicit -Duriparser_SOURCE=SYSTEM with 0.9.6 fails .
  • Also builds and passes 13/13 on macOS against Homebrew

Are there any user-facing changes?

Now Arrow requires uriparser or builds it . No user facing changes as such because no API changes .

This PR contains a "Critical Fix". It has security fixes that has gone in uriparser.

AI Usage:

  • Used for testing <-> building loop.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant