GH-51007: [C++] Make uriparser an external dependency - #51244
Open
imtherealnaska wants to merge 1 commit into
Open
GH-51007: [C++] Make uriparser an external dependency#51244imtherealnaska wants to merge 1 commit into
imtherealnaska wants to merge 1 commit into
Conversation
imtherealnaska
requested review from
assignUser,
jonkeane,
kou,
pitrou and
raulcd
as code owners
September 8, 2026 18:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rationale for this change
Updating the uriparser version so as to include security fixes. Rather than refreshing vendored copy , this makes uriparser and external dependency.
What changes are included in this PR?
AI generated, because there are too many changes and might miss some
uriparseradded toARROW_THIRDPARTY_DEPENDENCIES, with abuild_uriparser()ExternalProject pinned to 1.0.2 (docs, tests, toolsand
wchar_tsupport disabled; static;URI_STATIC_BUILDon theinterface; registered in
ARROW_BUNDLED_STATIC_LIBS).REQUIRED_VERSION "1.0.2", so every build gets a uriparser carrying allfixes through 1.0.2.
cmake_modules/FinduriparserAlt.cmake. Upstream ships a CMake packageconfig, but Debian/Ubuntu's
liburiparser-devinstalls onlyliburiparser.pc, so the module triesfind_package(CONFIG)first, thenpkg-config, then a plain library search.
ARROW_STATIC_INSTALL_INTERFACE_LIBSgainsuriparser::uriparserforSYSTEM builds, so static consumers link correctly.
subprojects/uriparser.wrap(method = cmake, same tarballand checksum as the CMake pin) plus a
cmake.subprojectfallback, sincemeson has no BUNDLED equivalent.
cpp/src/arrow/vendored/uriparser/(28 files) and itsLICENSE.txtsection removed;
util/uri.ccnow includes<uriparser/Uri.h>.PKGBUILDandmsys2_setup.sh,r_windows_build.sh, the-Duriparser_SOURCEpassthrough incpp_build.sh, and the dependencylist in
building.rst.NOTICE : Having 1.0.2 as floor means ,nearly every distro has to build it from source until they catch up.
Are these changes tested?
All existing tests pass.
Verified on Ubuntu 22.04:
Are there any user-facing changes?
Now Arrow requires uriparser or builds it . No user facing changes as such because no API changes .
This PR contains a "Critical Fix". It has security fixes that has gone in uriparser.
AI Usage: