fix(build): Support CMake v4+ and GCC 15 toolchains, and upgrade C++ dependencies (fixes #795).

jackluo923 · 4ertus2 · claude · jackluo923 · commit 428b4cc6b8c9 · 2026-08-02T23:49:15.000-04:00
CMake v4 removed compatibility with `cmake_minimum_required` below v3.5, breaking yaml-cpp, libarchive, and the googletest that ANTLR's test build fetches. CLP previously capped this by pinning CMake below v4, which has since become actively harmful: the install script fails outright wherever CMake v4+ is the system package, since it only installs the pinned version when no `cmake` is already present. All three blockers are fixed here and the pin is retired, closing #795, which was reported in April 2025 against macOS with Homebrew. Separately, libstdc++ 15 stopped transitively including <cstdint>, so yaml-cpp 0.7.0 fails to compile under GCC 15. The yaml-cpp upgrade addresses both that and its CMake v4 incompatibility. With the ceiling gone, the three places that uninstalled a working CMake so the pin could reinstall an older one are removed, and centos-stream-9 now uses dnf's CMake. Only ubuntu-jammy still needs the pipx install, since its apt CMake (3.22.1) is below the v3.23 floor that ystdlib requires. `install-cmake.sh` is renamed to `ensure-cmake.sh` to match its now-primary role of validating the available CMake rather than installing one. Also upgrades libarchive (3.5.1/3.8.0 -> 3.8.9), SQLite3 (3.36.0 -> 3.53.4), Catch2, Microsoft.GSL, nlohmann_json, simdjson, utfcpp, zlib, and date, which had drifted well behind upstream. None of these required changes to CLP's own source. Supersedes and credits #2453, which surfaced these failures on Ubuntu 26.04 — the first environment to hit both toolchain shifts at once. Co-authored-by: Artem Zuikov <chertus@gmail.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
diff --git a/components/core/src/glt/glt/CMakeLists.txt b/components/core/src/glt/glt/CMakeLists.txt
@@ -191,7 +191,7 @@ if(CLP_BUILD_EXECUTABLES)
                 nlohmann_json::nlohmann_json
                 ${STD_FS_LIBS}
                 clp::string_utils
-                yaml-cpp
+                yaml-cpp::yaml-cpp
                 ystdlib::error_handling
                 zstd::libzstd_static
         )
diff --git a/components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh b/components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh
@@ -5,6 +5,7 @@ set -o nounset
 set -o pipefail
 
 dnf install -y \
+    cmake \
     diffutils \
     gcc-c++ \
     git \
diff --git a/components/core/tools/scripts/lib_install/libarchive.sh b/components/core/tools/scripts/lib_install/libarchive.sh
@@ -67,7 +67,12 @@ cd ${extracted_dir}
 mkdir -p cmake-build-release
 cd cmake-build-release
 # NOTE: Disable Expat and OpenSSL so the static libarchive doesn't look for them at link time.
-cmake -DENABLE_EXPAT=OFF -DENABLE_OPENSSL=OFF ../
+# NOTE: Force the libdir to "lib" rather than letting `GNUInstallDirs` choose it. From v3.8.2
+# onwards, libarchive resolves it to "lib64" on 64-bit RHEL-family distros, but our images only put
+# "/usr/local/lib/pkgconfig" on `PKG_CONFIG_PATH`. A missed .pc file isn't an error, so
+# `pkg_check_modules` would silently yield no static dependencies and libarchive's `-lz` would drop
+# off the link line, failing much later with an undefined reference to `inflateEnd`.
+cmake -DCMAKE_INSTALL_LIBDIR=lib -DENABLE_EXPAT=OFF -DENABLE_OPENSSL=OFF ../
 make -j${num_cpus}
 
 # Check if checkinstall is installed
diff --git a/components/core/tools/scripts/lib_install/manylinux_2_28/install-packages-from-source.sh b/components/core/tools/scripts/lib_install/manylinux_2_28/install-packages-from-source.sh
@@ -15,4 +15,4 @@ lib_install_scripts_dir="${script_dir}/.."
 "${lib_install_scripts_dir}/liblzma.sh" 5.8.1
 "${lib_install_scripts_dir}/lz4.sh" 1.10.0
 "${lib_install_scripts_dir}/zstandard.sh" 1.5.7
-"${lib_install_scripts_dir}/libarchive.sh" 3.8.0
+"${lib_install_scripts_dir}/libarchive.sh" 3.8.9
diff --git a/components/core/tools/scripts/lib_install/musllinux_1_2/install-packages-from-source.sh b/components/core/tools/scripts/lib_install/musllinux_1_2/install-packages-from-source.sh
@@ -15,4 +15,4 @@ lib_install_scripts_dir="${script_dir}/.."
 "${lib_install_scripts_dir}/liblzma.sh" 5.8.1
 "${lib_install_scripts_dir}/lz4.sh" 1.10.0
 "${lib_install_scripts_dir}/zstandard.sh" 1.5.7
-"${lib_install_scripts_dir}/libarchive.sh" 3.8.0
+"${lib_install_scripts_dir}/libarchive.sh" 3.8.9
diff --git a/components/core/tools/scripts/lib_install/pipx-packages/install-cmake.sh b/components/core/tools/scripts/lib_install/pipx-packages/install-cmake.sh
@@ -9,33 +9,33 @@ if ! command -v pipx >/dev/null 2>&1; then
     exit 1
 fi
 
+# NOTE: ystdlib requires CMake v3.23.
 readonly required_version_major_min=3
 readonly required_version_minor_min=23
 readonly required_version_min="${required_version_major_min}.${required_version_minor_min}"
-readonly required_version_major_max=3
-readonly required_version_major_max_plus_1=$((required_version_major_max + 1))
+
+# NOTE: CLP builds with CMake v4+, but we don't install it by default. An environment that already
+# provides v4+ is accepted by the version check below; when we have to install CMake ourselves, we
+# stay on v3 so that adopting v4 remains a deliberate choice rather than a side effect of whatever
+# version happens to be newest.
+readonly installed_version_major_max_plus_1=4
 
 package_preinstalled=0
 if ! command -v cmake >/dev/null 2>&1; then
     package_preinstalled=1
-    # ystdlib requires CMake v3.23; ANTLR and yaml-cpp do not yet support CMake v4+
-    # (see https://github.com/y-scope/clp/issues/795).
-    pipx install --force "cmake>=${required_version_min},<${required_version_major_max_plus_1}"
+    pipx install --force "cmake>=${required_version_min},<${installed_version_major_max_plus_1}"
     pipx ensurepath
 fi
 
 installed_version=$(cmake -E capabilities | jq --raw-output ".version.string")
 installed_version_major=$(cmake -E capabilities | jq --raw-output ".version.major")
 installed_version_minor=$(cmake -E capabilities | jq --raw-output ".version.minor")
 
-# ystdlib requires CMake v3.23; ANTLR and yaml-cpp do not yet support CMake v4+
-# (see https://github.com/y-scope/clp/issues/795).
 if (("${installed_version_major}" < "${required_version_major_min}")) \
     || (("${installed_version_major}" == "${required_version_major_min}" && \
-    "${installed_version_minor}" < "${required_version_minor_min}")) \
-    || (("${installed_version_major}" >= "${required_version_major_max_plus_1}")); then
-    echo "Error: CMake version ${installed_version} is unsupported (require" \
-        "${required_version_min} ≤ version < ${required_version_major_max_plus_1})."
+    "${installed_version_minor}" < "${required_version_minor_min}")); then
+    echo "Error: CMake version ${installed_version} is unsupported (require version" \
+        "≥ ${required_version_min})."
 
     if ((0 == "${package_preinstalled}")); then
         echo "Please uninstall CMake and then re-run the install script."
diff --git a/components/core/tools/scripts/lib_install/ubuntu-jammy/install-packages-from-source.sh b/components/core/tools/scripts/lib_install/ubuntu-jammy/install-packages-from-source.sh
@@ -7,7 +7,9 @@ set -o pipefail
 script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
 lib_install_scripts_dir=$script_dir/..
 
-"$lib_install_scripts_dir"/libarchive.sh 3.5.1
+# NOTE: libarchive may statically link with LZMA, LZ4, and Zstandard, so we install them
+# beforehand.
 "$lib_install_scripts_dir"/liblzma.sh 5.8.1
 "$lib_install_scripts_dir"/lz4.sh 1.10.0
 "$lib_install_scripts_dir"/zstandard.sh 1.5.7
+"$lib_install_scripts_dir"/libarchive.sh 3.8.9
diff --git a/docs/src/dev-docs/components-core/index.md b/docs/src/dev-docs/components-core/index.md
@@ -40,26 +40,26 @@ The task will download, build, and install (within the build directory) the foll
 | [abseil-cpp](https://github.com/abseil/abseil-cpp)                       | 20250512.0     |
 | [ANTLR](https://www.antlr.org)                                           | v4.13.2        |
 | [Boost](https://github.com/boostorg/boost)                               | v1.87.0        |
-| [Catch2](https://github.com/catchorg/Catch2)                             | v3.8.0         |
-| [date](https://github.com/HowardHinnant/date)                            | v3.0.1         |
+| [Catch2](https://github.com/catchorg/Catch2)                             | v3.15.3        |
+| [date](https://github.com/HowardHinnant/date)                            | v3.0.5         |
 | [fmt](https://github.com/fmtlib/fmt)                                     | v11.2.0        |
 | [liblzma](https://github.com/tukaani-project/xz)                         | v5.8.1         |
 | [log-surgeon](https://github.com/y-scope/log-surgeon)                    | 840f262        |
 | [lz4](https://github.com/lz4/lz4)                                        | v1.10.0        |
-| [microsoft.gsl](https://github.com/microsoft/GSL)                        | v4.0.0         |
-| [mongo-cxx-driver](https://github.com/mongodb/mongo-cxx-driver)          | r4.1.1         |
+| [microsoft.gsl](https://github.com/microsoft/GSL)                        | v4.2.2         |
+| [mongo-cxx-driver](https://github.com/mongodb/mongo-cxx-driver)          | r4.4.1         |
 | [msgpack-cxx](https://github.com/msgpack/msgpack-c/tree/cpp_master)      | v7.0.0         |
-| [nlohmann_json](https://github.com/nlohmann/json)                        | v3.11.3        |
+| [nlohmann_json](https://github.com/nlohmann/json)                        | v3.12.0        |
 | [opentelemetry-cpp](https://github.com/open-telemetry/opentelemetry-cpp) | v1.27.0        |
 | [Protobuf](https://github.com/protocolbuffers/protobuf)                  | v31.1          |
-| [simdjson](https://github.com/simdjson/simdjson)                         | v4.6.4         |
+| [simdjson](https://github.com/simdjson/simdjson)                         | v4.6.6         |
 | [spdlog](https://github.com/gabime/spdlog)                               | v1.15.3        |
-| [SQLite3](https://www.sqlite.org/download.html)                          | v3.36.0        |
-| [utfcpp](https://github.com/nemtrif/utfcpp)                              | v4.0.6         |
+| [SQLite3](https://www.sqlite.org/download.html)                          | v3.53.4        |
+| [utfcpp](https://github.com/nemtrif/utfcpp)                              | v4.1.1         |
 | [xxHash](https://github.com/Cyan4973/xxHash)                             | v0.8.3         |
-| [yaml-cpp](https://github.com/jbeder/yaml-cpp)                           | v0.7.0         |
+| [yaml-cpp](https://github.com/jbeder/yaml-cpp)                           | v0.9.0         |
 | [ystdlib-cpp](https://github.com/y-scope/ystdlib-cpp)                    | 9ed78cd        |
-| [zlib](https://github.com/madler/zlib)                                   | v1.3.1         |
+| [zlib](https://github.com/madler/zlib)                                   | v1.3.2         |
 | [zstd](https://github.com/facebook/zstd)                                 | v1.5.7         |
 
 ### Environment
diff --git a/taskfiles/deps/main.yaml b/taskfiles/deps/main.yaml
@@ -190,6 +190,11 @@ tasks:
           BUILD_DIR: "{{.BUILD_DIR}}"
           EXTRA_ARGS:
             - "-DANTLR4_INSTALL=ON"
+
+            # ANTLR's test build `FetchContent`s a googletest whose CMakeLists declares
+            # `cmake_minimum_required(VERSION 2.8.12)`, which CMake v4+ rejects outright. We don't
+            # run ANTLR's tests, so disable them.
+            - "-DANTLR_BUILD_CPP_TESTS=OFF"
             - "-DCMAKE_BUILD_TYPE=Release"
             - "-DCMAKE_INSTALL_MESSAGE=LAZY"
 
@@ -249,8 +254,8 @@ tasks:
             - "-DCMAKE_CXX_STANDARD_REQUIRED=ON"
             - "-DCMAKE_INSTALL_MESSAGE=LAZY"
           LIB_NAME: "Catch2"
-          TARBALL_SHA256: "1ab2de20460d4641553addfdfe6acd4109d871d5531f8f519a52ea4926303087"
-          TARBALL_URL: "https://github.com/catchorg/Catch2/archive/refs/tags/v3.8.0.tar.gz"
+          TARBALL_SHA256: "b0299ae552918220a7a6e21e7de5b714777f4e8c883fb70c4bb23fe01df8c6e3"
+          TARBALL_URL: "https://github.com/catchorg/Catch2/archive/refs/tags/v3.15.3.tar.gz"
 
   date:
     internal: true
@@ -262,8 +267,8 @@ tasks:
             - "-DCMAKE_BUILD_TYPE=Release"
             - "-DCMAKE_INSTALL_MESSAGE=LAZY"
           LIB_NAME: "date"
-          TARBALL_SHA256: "7a390f200f0ccd207e8cff6757e04817c1a0aec3e327b006b7eb451c57ee3538"
-          TARBALL_URL: "https://github.com/HowardHinnant/date/archive/refs/tags/v3.0.1.tar.gz"
+          TARBALL_SHA256: "ef786edc203daec76475825640b3af247bd08e31fc52217e5ce8f76107b4bb05"
+          TARBALL_URL: "https://github.com/HowardHinnant/date/archive/refs/tags/v3.0.5.tar.gz"
 
   fmt:
     internal: true
@@ -401,28 +406,42 @@ tasks:
             - "-DCMAKE_INSTALL_MESSAGE=LAZY"
             - "-DGSL_TEST=OFF"
           LIB_NAME: "{{.G_GSL_LIB_NAME}}"
-          TARBALL_SHA256: "f0e32cb10654fea91ad56bde89170d78cfbf4363ee0b01d8f097de2ba49f6ce9"
-          TARBALL_URL: "https://github.com/microsoft/GSL/archive/refs/tags/v4.0.0.tar.gz"
+          TARBALL_SHA256: "59e2a0a0ea22e8bcf9db2dc4d4bd21212ac6595748295fc27a7e02cf75eac4b5"
+          TARBALL_URL: "https://github.com/microsoft/GSL/archive/refs/tags/v4.2.2.tar.gz"
 
   mongocxx:
     internal: true
     vars:
-      VERSION: "r4.1.1"
+      VERSION: "r4.4.1"
+
+      # The version without the leading "r", for `BUILD_VERSION` below.
+      VERSION_NUMBER: "4.4.1"
     run: "once"
     cmds:
       - task: "utils:install-remote-cmake-lib"
         vars:
           CMAKE_GEN_ARGS:
             - "-DBUILD_SHARED_AND_STATIC_LIBS=ON"
             - "-DBUILD_SHARED_LIBS_WITH_STATIC_MONGOC=ON"
+
+            # The GitHub-generated source tarball (see the `TARBALL_URL` note) omits the
+            # `VERSION_CURRENT` file that the release tarball carries, so the version can't be
+            # derived and has to be passed explicitly.
+            - "-DBUILD_VERSION={{.VERSION_NUMBER}}"
             - "-DCMAKE_BUILD_TYPE=Release"
             - "-DCMAKE_INSTALL_MESSAGE=LAZY"
             - "-DENABLE_SNAPPY=OFF"
             - "-DENABLE_UNINSTALL=OFF"
           LIB_NAME: "mongocxx"
-          TARBALL_SHA256: "19dff3cf834a3e09229260f22a0325820a7e30c78b294db91794dd934776b33a"
-          TARBALL_URL: "https://github.com/mongodb/mongo-cxx-driver/releases/download/{{.VERSION}}\
-          /mongo-cxx-driver-{{.VERSION}}.tar.gz"
+          TARBALL_SHA256: "f43d6d8d0783357d200f14b009f25f4563e6dffefd12c248cf31282a3c86157d"
+
+          # NOTE: We use the GitHub-generated source tarball rather than the release tarball, since
+          # the r4.4.1 release tarball was packaged on macOS and contains AppleDouble ("._*") files.
+          # Those match the examples' `GLOB_RECURSE "*.cpp"`, and `NAME_WE` resolves to an empty
+          # string for them, so every one collapses onto the same target name and configuration
+          # fails with a duplicate-target error.
+          TARBALL_URL: "https://github.com/mongodb/mongo-cxx-driver/archive/refs/tags/\
+          {{.VERSION}}.tar.gz"
 
   msgpack-cxx:
     internal: true
@@ -457,12 +476,12 @@ tasks:
             - "-DCMAKE_INSTALL_MESSAGE=LAZY"
             - "-DJSON_BuildTests=OFF"
           LIB_NAME: "nlohmann_json"
-          TARBALL_SHA256: "0d8ef5af7f9794e3263480193c491549b2ba6cc74bb018906202ada498a79406"
+          TARBALL_SHA256: "4b92eb0c06d10683f7447ce9406cb97cd4b453be18d7279320f7b2f025c10187"
 
           # NOTE: We use the GitHub-generated source tarball for this version rather than the
           # release tarball, since the latter is served from githubusercontent.com which is blocked
           # by some developers' firewalls. The contents of the former are a superset of the latter.
-          TARBALL_URL: "https://github.com/nlohmann/json/archive/refs/tags/v3.11.3.tar.gz"
+          TARBALL_URL: "https://github.com/nlohmann/json/archive/refs/tags/v3.12.0.tar.gz"
 
   opentelemetry-cpp:
     internal: true
@@ -531,8 +550,8 @@ tasks:
             - "-DCMAKE_BUILD_TYPE=Release"
             - "-DCMAKE_INSTALL_MESSAGE=LAZY"
           LIB_NAME: "simdjson"
-          TARBALL_SHA256: "b091107844fe928158c5c2265c20360fff312889ddf7ebc4528a0f0f8f2ff9cd"
-          TARBALL_URL: "https://github.com/simdjson/simdjson/archive/refs/tags/v4.6.4.tar.gz"
+          TARBALL_SHA256: "1cd4c4c18263d2ae1f0cd5d4ba8b14e679b5a419ca15988a0da4cf43c514f28d"
+          TARBALL_URL: "https://github.com/simdjson/simdjson/archive/refs/tags/v4.6.6.tar.gz"
 
   spdlog:
     internal: true
@@ -566,7 +585,7 @@ tasks:
       EXTRACTION_DIR: "{{.G_DEPS_CPP_DIR}}/{{.LIB_NAME}}-src"
       INSTALL_INCLUDE_DIR: "{{.G_DEPS_CPP_DIR}}/{{.LIB_NAME}}-install/include"
       INSTALL_SYMLINK: "{{.INSTALL_INCLUDE_DIR}}/{{.LIB_NAME}}"
-      ZIP_FILENAME_STEM: "sqlite-amalgamation-3360000"
+      ZIP_FILENAME_STEM: "sqlite-amalgamation-3530400"
       SRC_DIR: "{{.EXTRACTION_DIR}}/{{.ZIP_FILENAME_STEM}}"
     run: "once"
     deps:
@@ -575,9 +594,11 @@ tasks:
       - task: "yscope-dev-utils:remote:download-and-extract-zip"
         vars:
           CHECKSUM_FILE: "{{.G_DEPS_CPP_CHECKSUMS_DIR}}/{{.LIB_NAME}}.md5"
-          FILE_SHA256: "999826fe4c871f18919fdb8ed7ec9dd8217180854dd1fe21eea96aed36186729"
+          # NOTE: sqlite.org publishes SHA3-256 hashes, not SHA-256, so this value must be computed
+          # from the downloaded archive rather than copied from the download page.
+          FILE_SHA256: "1e71ddf93849c6a6ecf58b827c0692073d2dd7ee40196158068f7b29f422e87d"
           OUTPUT_DIR: "{{.EXTRACTION_DIR}}"
-          URL: "https://www.sqlite.org/2021/{{.ZIP_FILENAME_STEM}}.zip"
+          URL: "https://www.sqlite.org/2026/{{.ZIP_FILENAME_STEM}}.zip"
       - "mkdir -p '{{.INSTALL_INCLUDE_DIR}}'"
       - "rm -f '{{.INSTALL_SYMLINK}}'"
       - "ln -s '{{.SRC_DIR}}' '{{.INSTALL_SYMLINK}}'"
@@ -599,9 +620,9 @@ tasks:
       - task: "yscope-dev-utils:remote:download-and-extract-tar"
         vars:
           CHECKSUM_FILE: "{{.G_DEPS_CPP_CHECKSUMS_DIR}}/{{.LIB_NAME}}.md5"
-          FILE_SHA256: "6920a6a5d6a04b9a89b2a89af7132f8acefd46e0c2a7b190350539e9213816c0"
+          FILE_SHA256: "1ca68016f0abc24172998e39ce0d8f8e2b7a26f7579a0ff85d4e1b9a7aea56f8"
           OUTPUT_DIR: "{{.UTFCPP_OUTPUT_DIR}}"
-          URL: "https://github.com/nemtrif/utfcpp/archive/refs/tags/v4.0.6.tar.gz"
+          URL: "https://github.com/nemtrif/utfcpp/archive/refs/tags/v4.1.1.tar.gz"
       - >-
         echo "set(
         CLP_UTFCPP_INCLUDE_DIRECTORY \"{{.UTFCPP_OUTPUT_DIR}}\"
@@ -635,8 +656,8 @@ tasks:
             - "-DCMAKE_BUILD_TYPE=Release"
             - "-DCMAKE_INSTALL_MESSAGE=LAZY"
           LIB_NAME: "yaml-cpp"
-          TARBALL_SHA256: "43e6a9fcb146ad871515f0d0873947e5d497a1c9c60c58cb102a97b47208b7c3"
-          TARBALL_URL: "https://github.com/jbeder/yaml-cpp/archive/refs/tags/yaml-cpp-0.7.0.tar.gz"
+          TARBALL_SHA256: "25cb043240f828a8c51beb830569634bc7ac603978e0f69d6b63558dadefd49a"
+          TARBALL_URL: "https://github.com/jbeder/yaml-cpp/archive/refs/tags/yaml-cpp-0.9.0.tar.gz"
 
   ystdlib:
     internal: true
@@ -669,8 +690,8 @@ tasks:
             - "-DCMAKE_INSTALL_PREFIX={{.G_DEPS_CPP_DIR}}/{{.LIB_NAME}}-install"
             - "-DZLIB_BUILD_EXAMPLES=OFF"
           LIB_NAME: "{{.LIB_NAME}}"
-          TARBALL_SHA256: "9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23"
-          TARBALL_URL: "https://github.com/madler/zlib/releases/download/v1.3.1/zlib-1.3.1.tar.gz"
+          TARBALL_SHA256: "bb329a0a2cd0274d05519d61c667c062e06990d72e125ee2dfa8de64f0119d16"
+          TARBALL_URL: "https://github.com/madler/zlib/releases/download/v1.3.2/zlib-1.3.2.tar.gz"
 
   zstd:
     internal: true

Original file line number	Diff line number	Diff line change
`@@ -191,7 +191,7 @@ if(CLP_BUILD_EXECUTABLES)`
`191`	`191`	`nlohmann_json::nlohmann_json`
`192`	`192`	`${STD_FS_LIBS}`
`193`	`193`	`clp::string_utils`
`194`		`- yaml-cpp`
	`194`	`+ yaml-cpp::yaml-cpp`
`195`	`195`	`ystdlib::error_handling`
`196`	`196`	`zstd::libzstd_static`
`197`	`197`	`)`