feat: SG-42145: Common dependency updates (aja, atomic_ops, gc, openjph, pcre2 and spdlog) by mcoliver · Pull Request #1075 · AcademySoftwareFoundation/OpenRV

mcoliver · 2026-01-22T08:09:22Z

Summarize your change.

Created a script to check common dependencies against their most recent releases. Useful for seeing if there are updates to dependency packages. I used that script to identify a few that were behind on bug fixes, security updates, and features. None are breaking changes.

Describe the reason for the change.

There were quite a few dependencies that were running old versions. Newer versions fix bugs and security issues along with exposing new features that can be harnessed for future performance optimizations and feature extensions.

Fixes:
#1096
#1097
#1098
#1099
#1100
#1102
#1103
#1104
#1106
#1108
#1105
#1110
#1111

Describe what you have tested and on which operating system.

builds locally. Will monitor CICD on the PR. Tested various images and videos affected by the packages that were updated with success (jpeg, webp, png, libraw, etc..)

Add a list of changes, and note any that might need special attention during the review.

I linked out to each changelog and commit diff for the various dependencies. I made a best effort to ensure there are no breaking changes and stuck to minor version updates.

One thing to note: Libraw does deprecate some older cameras but also adds support for a bunch of new ones along with other new features. Feels like a worthwhile tradeoff but should be noted. https://github.com/LibRaw/LibRaw/blob/d20315b6e7b0162d3b0d7820dcbaf4de716b3e77/Changelog.txt#L50

If possible, provide screenshots.

linux-foundation-easycla · 2026-01-22T09:04:43Z

The committers listed above are authorized under a signed CLA.

✅ login: mcoliver / name: Michael Oliver (121b9e6, 143ecc1, 165ca81, 2a64ced, 33dd79b, 36022b5, 3acd88f, 3af701c, 3f4cb38, 4a6c394, 4d05310, 5314d9c, 76f2b22, 7a61a24, 7fac095, 80c05ad, 89838fa, 9339e85, 94627f3, 964f54d, 9a67375, 9d52904, 9d9f7d0, 9eb8494, a5799a6, a702adc, b1d7e3d, b23bc2a, c7df307, cb66a8f, e38529d, eaaf248, f3e4638, f5b29cb)

mcoliver · 2026-01-23T18:48:41Z

pre-commit.ci autofix

mcoliver · 2026-01-28T01:20:33Z

@cedrik-fuoco-adsk apologies for all the ci/cd build runs to iron out the kinks. Setting up all the dev envs to build locally is not possible for me at the moment. I just pushed the last one that should fix the debug windows build name for openjph. That should be the last one

mcoliver · 2026-02-10T19:59:28Z

@cedrik-fuoco-adsk would it be helpful for me to break this into separate PR's per dependency? I know it's a lot of upgrades all at once.

cedrik-fuoco-adsk · 2026-02-11T14:53:05Z

I think it's ok @mcoliver. They all do different things. Having a single build with everything should help with the testing. The two main one that really need testing are AJA and OIIO.

Copilot

Pull request overview

This PR updates several third-party dependency versions used by the CMake dependency build system and adds a helper script to compare the pinned versions in CYCOMMON.cmake against upstream Git tags.

Changes:

Bump multiple common dependency versions/hashes in cmake/defaults/CYCOMMON.cmake (e.g., spdlog, pcre2, gc, openjpeg/openjph, libpng, libraw, webp, dav1d, etc.).
Adjust several dependency build recipes (download artifacts switched to .tar.gz in a few places; OpenJPH naming updated for Debug postfix handling; Windows /utf-8 flags added for spdlog/OIIO).
Add check_dependency_versions.py to scan CYCOMMON.cmake and report latest upstream tags.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
cmake/dependencies/spdlog.cmake	Switch spdlog download to tarball; add Windows UTF-8 compile flag handling.
cmake/dependencies/pcre2.cmake	Switch PCRE2 download artifact from zip to tarball.
cmake/dependencies/openjph.cmake	Update OpenJPH library naming for Debug postfix (notably on Windows).
cmake/dependencies/oiio.cmake	Add Windows UTF-8 compile flag handling for OIIO consumers/build.
cmake/dependencies/gc.cmake	Switch bdwgc download artifact from zip to tarball.
cmake/dependencies/atomic_ops.cmake	Update atomic_ops download URL to tagged release under bdwgc repo.
cmake/dependencies/aja.cmake	Adjust Windows Debug naming selection and force mbedtls runtime setting in Debug.
cmake/defaults/CYCOMMON.cmake	Central version/hash bumps for common dependencies.
check_dependency_versions.py	New script to compare pinned dependency versions vs latest upstream tags.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cedrik-fuoco-adsk · 2026-02-19T19:40:22Z

Hi @mcoliver,

Do you mind splitting libpng in other PR?

We would like to merge libpng faster because the new version fixes a CVE.
If you don't have time, I can create another PR for libpng.

Numerous improvements, supported hardware, and bug fixes aja-video/libajantv2@ntv2_17_1_0...ntv2_17_6_0 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

bdwgc/libatomic_ops@0445739...v7.10.0 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

You can run this script to quickly check for new versions of common dependencies. It checks releases first and then tags. Best effort to discover the latest release or tag that conforms to the versioning schema per package. Ignores rc, beta, dev, test, pre, and alpha named versions. There is some messiness out there with versioning. Signed-off-by: Michael Oliver <mcoliver@gmail.com>

Performance improvements and optimizations videolan/dav1d@1.4.3...1.5.3 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

fixes build errors aja-video/libajantv2@ntv2_17_6_0...ntv2_17_6_0_hotfix1 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

doctest/doctest@v2.4.9...v2.4.12 https://github.com/doctest/doctest/blob/master/CHANGELOG.md Signed-off-by: Michael Oliver <mcoliver@gmail.com>

numerous security and bug fixes. libexpat/libexpat@R_2_6_3...R_2_7_3 https://github.com/libexpat/libexpat/blob/master/expat/Changes Signed-off-by: Michael Oliver <mcoliver@gmail.com>

numerous bug fixes and features https://github.com/bdwgc/bdwgc/blob/master/ChangeLog bdwgc/bdwgc@v8.2.2...v8.2.10 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

Bug fixes and feature updates https://github.com/uclouvain/openjpeg/blob/master/CHANGELOG.md uclouvain/openjpeg@v2.5.0...v2.5.4 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

numerous bug fixes and enhancements aous72/OpenJPH@0.21.3...0.26.0 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

bug fixes, security fixes, and feature improvements https://github.com/gabime/spdlog/releases gabime/spdlog@v1.11.0...v1.17.0 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

Numerous changes and fixes https://github.com/webmproject/libwebp/blob/45102247a82396fabac5241c64305b13ed711335/ChangeLog#L741 webmproject/libwebp@v1.2.1...v1.6.0 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

LibRaw/LibRaw@0.21.1...0.22.0 https://github.com/LibRaw/LibRaw/blob/d20315b6e7b0162d3b0d7820dcbaf4de716b3e77/Changelog.txt#L3 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

forgot to update the hash Signed-off-by: Michael Oliver <mcoliver@gmail.com>

formatting Signed-off-by: Michael Oliver <mcoliver@gmail.com>

apparently it wants to squash this all into one line. ¯\_(ツ)_/¯ Signed-off-by: Michael Oliver <mcoliver@gmail.com>

uses lib64 since v0.24. https://github.com/aous72/OpenJPH/releases/tag/0.24.0 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

updated hash to be accurate Signed-off-by: Michael Oliver <mcoliver@gmail.com>

Windows builds failing on spdlog and oiio because they bundle fmt which requires a utf-8 flag when compiling on windows. Error was D:\a\OpenRV\OpenRV\_build\RV_DEPS_SPDLOG\install\include\spdlog\fmt\bundled\base.h(465,28): error C2338: static_assert failed: 'Unicode support requires compiling with /utf-8' [D:\a\OpenRV\OpenRV\_build\src\lib\base\TwkUtil\TwkUtil.vcxproj] Signed-off-by: Michael Oliver <mcoliver@gmail.com>

openjph now support debug envs so lets support them as well https://github.com/aous72/OpenJPH/blob/8e597d11715552a6c63e3963d940fa29a4c5831b/src/core/CMakeLists.txt#L119 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

fixed formatting Signed-off-by: Michael Oliver <mcoliver@gmail.com>

format fixes Signed-off-by: Michael Oliver <mcoliver@gmail.com>

Builds failing with LINK : fatal error LNK1181: cannot open input file '..\..\..\..\RV_DEPS_AJA\install\lib\ajantv2_vs143_MT.lib' Install log references Installing: D:/a/OpenRV/OpenRV/_build/RV_DEPS_AJA/install/lib/ajantv2.lib so let's change the lib name Signed-off-by: Michael Oliver <mcoliver@gmail.com>

Signed-off-by: Michael Oliver <mcoliver@gmail.com>

need to move the debug postfix. According to CICD build logs windows debug wants to build D:/a/OpenRV/OpenRV/_build/RV_DEPS_OPENJPH/build/src/core/Debug/openjph.0.26d.lib Signed-off-by: Michael Oliver <mcoliver@gmail.com>

AJA updated the release lib name to match macos/linux, but kept the _vs143_MT suffix for the debug lib. Signed-off-by: Michael Oliver <mcoliver@gmail.com>

bedcrypto.lib(md.obj) : error LNK2019: unresolved external symbol __imp_ferror referenced in function mbedtls_md_file Signed-off-by: Michael Oliver <mcoliver@gmail.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Michael Oliver <mcoliver@gmail.com>

Signed-off-by: Michael Oliver <mcoliver@gmail.com>

mcoliver · 2026-03-03T03:24:27Z

@cedrik-fuoco-adsk I pulled the AJA stuff out

Hi @mcoliver,

Do you mind splitting libpng in other PR?

We would like to merge libpng faster because the new version fixes a CVE. If you don't have time, I can create another PR for libpng.

@cedrik-fuoco-adsk I can but a lot of these other dependency updates also have CVE fixes. Would be great to get them all in. I pulled out the AJA update which seemed to be the last hang up for a clean build. What do you think about merging this one? If not I'll put some effort in to pull out the libpng one and make a new pr. Also sorry for the delay on this. I have had some things going on but have time this week to help out with openrv so will be more responsive.

cedrik-fuoco-adsk · 2026-03-03T13:31:06Z

Hi @mcoliver,

The main issue we’re running into is the QA time bottleneck. Each dependency update requires validation to ensure nothing regresses, and bundling them all into a single PR significantly increases the turnaround time. It would be much more manageable to split this into smaller PRs, ideally one per dependency.

Here are the current priorities:

libPNG: I’ve opened a PR with the latest version, including the CVE fix: build: SG-42121: Update libPNG to 1.6.55 to address CVE-2026-25646 #1149
OpenImageIO 3.x: There are a few issues in your PR that still need to be addressed: feat: SG-42131 - Migrate to OpenImageIO 3.x and build it with OpenColorIO #1087
AJA: We’ll need to open a new PR for this one

In parallel, I’m working on refactoring the staging code and preparing the infrastructure to support find_package in OpenRV. Having smaller, dependency-specific PRs will also help reduce file conflicts as that work progresses.

I realize this means extra effort on your side, but smaller PRs will make reviews, QA, and integration smoother for everyone.

One possible grouping would be:

All the following dependencies in a single PR:

ATOMIC_OPS
DOCTEST
EXPAT
PCRE2
SPDLOG
GC

Separate PRs for these:

DAV1D
OPENJPEG
OPENJPH
LIBRAW
WEBP

Let me know if you’d like me to help split these up or take on some of them.

eloisebrosseau · 2026-03-03T14:15:25Z

@mcoliver FYI, I have the AJA update in another branch for something else I am working on, so you don't need to create a new PR to fix the issues you are experiencing with it!

mcoliver · 2026-03-03T14:24:50Z

Hi @mcoliver,

The main issue we’re running into is the QA time bottleneck. Each dependency update requires validation to ensure nothing regresses, and bundling them all into a single PR significantly increases the turnaround time. It would be much more manageable to split this into smaller PRs, ideally one per dependency.

Here are the current priorities:

libPNG: I’ve opened a PR with the latest version, including the CVE fix: build: SG-42121: Update libPNG to 1.6.55 to address CVE-2026-25646 #1149

OpenImageIO 3.x: There are a few issues in your PR that still need to be addressed: feat: Migrate to OpenImageIO 3.x and build it with OpenColorIO #1087

AJA: We’ll need to open a new PR for this one

In parallel, I’m working on refactoring the staging code and preparing the infrastructure to support find_package in OpenRV. Having smaller, dependency-specific PRs will also help reduce file conflicts as that work progresses.

I realize this means extra effort on your side, but smaller PRs will make reviews, QA, and integration smoother for everyone.

One possible grouping would be:

All the following dependencies in a single PR:

ATOMIC_OPS

DOCTEST

EXPAT

PCRE2

SPDLOG

GC

Separate PRs for these:

DAV1D

OPENJPEG

OPENJPH

LIBRAW

WEBP

Let me know if you’d like me to help split these up or take on some of them.

Thanks @cedrik-fuoco-adsk I'll submit smaller PR's. On the homebrew front I have a working setup that allows me to build with homebrew packages. Need to clean a few things up but will submit for your review if you have not started yet on your own effort there.

mcoliver · 2026-03-03T15:01:58Z

Separate PR's submitted for each dependency. Closing this PR.

mcoliver requested review from bernie-laberge, cedrik-fuoco-adsk and eloisebrosseau as code owners January 22, 2026 08:09

mcoliver force-pushed the dependency_updates branch from 0bb1b7b to c3b2c76 Compare January 22, 2026 09:39

mcoliver mentioned this pull request Jan 27, 2026

[Bug]: Building OpenRV on RHEL 9.6, hitting an error with the AJA driver #993

Open

1 task

eloisebrosseau requested a review from Copilot February 17, 2026 16:56

Copilot started reviewing on behalf of eloisebrosseau February 17, 2026 16:57 View session

Copilot AI reviewed Feb 17, 2026

View reviewed changes

Comment thread cmake/dependencies/oiio.cmake Outdated

Comment thread cmake/dependencies/openjph.cmake

Comment thread cmake/dependencies/openjph.cmake

Comment thread cmake/dependencies/spdlog.cmake Outdated

cedrik-fuoco-adsk added the community Contribution from the Open RV Community label Feb 17, 2026

cedrik-fuoco-adsk changed the title ~~Common dependency updates~~ SG-42145: Common dependency updates Feb 18, 2026

cedrik-fuoco-adsk added the tracked label Feb 18, 2026

cedrik-fuoco-adsk changed the title ~~SG-42145: Common dependency updates~~ feat: SG-42145: Common dependency updates Feb 19, 2026

cedrik-fuoco-adsk changed the title ~~feat: SG-42145: Common dependency updates~~ feat: SG-42145: Common dependency updates (aja, atomic_ops, gc, openjph, pcre2 and spdlog) Feb 20, 2026

mcoliver force-pushed the dependency_updates branch from 3cfe6a5 to 50afb51 Compare March 3, 2026 02:52

mcoliver added 10 commits March 2, 2026 19:01

update aja 17.1 to 17.6

3acd88f

Numerous improvements, supported hardware, and bug fixes aja-video/libajantv2@ntv2_17_1_0...ntv2_17_6_0 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

libatomicops 7.7 -> 7.10

121b9e6

bdwgc/libatomic_ops@0445739...v7.10.0 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

dav1d 1.4.3 -> 1.5.3

7fac095

Performance improvements and optimizations videolan/dav1d@1.4.3...1.5.3 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

17.6.0.hotfix1

f3e4638

fixes build errors aja-video/libajantv2@ntv2_17_6_0...ntv2_17_6_0_hotfix1 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

doctest 2.4.9 -> 2.4.12

a5799a6

doctest/doctest@v2.4.9...v2.4.12 https://github.com/doctest/doctest/blob/master/CHANGELOG.md Signed-off-by: Michael Oliver <mcoliver@gmail.com>

expat 2.6.3 -> 2.7.3

eaaf248

numerous security and bug fixes. libexpat/libexpat@R_2_6_3...R_2_7_3 https://github.com/libexpat/libexpat/blob/master/expat/Changes Signed-off-by: Michael Oliver <mcoliver@gmail.com>

gc 8.2.2 -> 8.2.10

94627f3

numerous bug fixes and features https://github.com/bdwgc/bdwgc/blob/master/ChangeLog bdwgc/bdwgc@v8.2.2...v8.2.10 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

openjpeg 2.5.0 -> 2.5.4

4a6c394

Bug fixes and feature updates https://github.com/uclouvain/openjpeg/blob/master/CHANGELOG.md uclouvain/openjpeg@v2.5.0...v2.5.4 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

openjph 0.21.3 -> 0.26.0

36022b5

numerous bug fixes and enhancements aous72/OpenJPH@0.21.3...0.26.0 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

mcoliver and others added 19 commits March 2, 2026 19:01

spdlog 1.11 -> 1.17

3af701c

bug fixes, security fixes, and feature improvements https://github.com/gabime/spdlog/releases gabime/spdlog@v1.11.0...v1.17.0 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

webp 1.2.1 -> 1.6.0

9d52904

Numerous changes and fixes https://github.com/webmproject/libwebp/blob/45102247a82396fabac5241c64305b13ed711335/ChangeLog#L741 webmproject/libwebp@v1.2.1...v1.6.0 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

libraw 0.21.1 -> 0.22.0

2a64ced

LibRaw/LibRaw@0.21.1...0.22.0 https://github.com/LibRaw/LibRaw/blob/d20315b6e7b0162d3b0d7820dcbaf4de716b3e77/Changelog.txt#L3 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

update libraw hash for 0.22

9eb8494

forgot to update the hash Signed-off-by: Michael Oliver <mcoliver@gmail.com>

forgot to ruff format

e38529d

formatting Signed-off-by: Michael Oliver <mcoliver@gmail.com>

cmake-format fix for ci

9d9f7d0

apparently it wants to squash this all into one line. ¯\_(ツ)_/¯ Signed-off-by: Michael Oliver <mcoliver@gmail.com>

openjph now but the libs on linux in lib64

964f54d

uses lib64 since v0.24. https://github.com/aous72/OpenJPH/releases/tag/0.24.0 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

hash updated

9339e85

updated hash to be accurate Signed-off-by: Michael Oliver <mcoliver@gmail.com>

add debug support for openjph

5314d9c

openjph now support debug envs so lets support them as well https://github.com/aous72/OpenJPH/blob/8e597d11715552a6c63e3963d940fa29a4c5831b/src/core/CMakeLists.txt#L119 Signed-off-by: Michael Oliver <mcoliver@gmail.com>

fixed formatting

33dd79b

fixed formatting Signed-off-by: Michael Oliver <mcoliver@gmail.com>

format fixes

76f2b22

format fixes Signed-off-by: Michael Oliver <mcoliver@gmail.com>

formatting fix

9a67375

Signed-off-by: Michael Oliver <mcoliver@gmail.com>

fix windows debug version name

b23bc2a

need to move the debug postfix. According to CICD build logs windows debug wants to build D:/a/OpenRV/OpenRV/_build/RV_DEPS_OPENJPH/build/src/core/Debug/openjph.0.26d.lib Signed-off-by: Michael Oliver <mcoliver@gmail.com>

aja debug lib name update

c7df307

AJA updated the release lib name to match macos/linux, but kept the _vs143_MT suffix for the debug lib. Signed-off-by: Michael Oliver <mcoliver@gmail.com>

fixes debug build issues where mbedtls defaults to dynamic links.

4d05310

bedcrypto.lib(md.obj) : error LNK2019: unresolved external symbol __imp_ferror referenced in function mbedtls_md_file Signed-off-by: Michael Oliver <mcoliver@gmail.com>

Apply suggestions from code review

165ca81

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Michael Oliver <mcoliver@gmail.com>

remove AJA updates as it's causing failing builds

3f4cb38

Signed-off-by: Michael Oliver <mcoliver@gmail.com>

mcoliver force-pushed the dependency_updates branch from 50afb51 to 3f4cb38 Compare March 3, 2026 03:03

mcoliver added 3 commits March 2, 2026 19:08

fix lib name

f5b29cb

Signed-off-by: Michael Oliver <mcoliver@gmail.com>

use proper implname and path

a702adc

Signed-off-by: Michael Oliver <mcoliver@gmail.com>

Merge branch 'main' into dependency_updates

cb66a8f

mcoliver closed this Mar 3, 2026

mcoliver deleted the dependency_updates branch March 3, 2026 17:14

Conversation

mcoliver commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summarize your change.

Describe the reason for the change.

Describe what you have tested and on which operating system.

Add a list of changes, and note any that might need special attention during the review.

If possible, provide screenshots.

Uh oh!

linux-foundation-easycla Bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mcoliver commented Jan 23, 2026

Uh oh!

mcoliver commented Jan 28, 2026

Uh oh!

mcoliver commented Feb 10, 2026

Uh oh!

cedrik-fuoco-adsk commented Feb 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cedrik-fuoco-adsk commented Feb 19, 2026

Uh oh!

mcoliver commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cedrik-fuoco-adsk commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eloisebrosseau commented Mar 3, 2026

Uh oh!

mcoliver commented Mar 3, 2026

Uh oh!

mcoliver commented Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mcoliver commented Jan 22, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Jan 22, 2026 •

edited

Loading

mcoliver commented Mar 3, 2026 •

edited

Loading

cedrik-fuoco-adsk commented Mar 3, 2026 •

edited

Loading