fix(build): Support CMake v4+ and GCC 15 toolchains, and upgrade C++ dependencies (fixes #795).

[jackluo923]

Description

Makes CLP capable of building with CMake v4+ and GCC 15, and batches in a set of low-risk dependency upgrades while the build is already being touched.

Scope: this removes the blockers so an environment providing CMake v4+ is accepted. It does not switch CLP to CMake v4 — when CLP's install-cmake.sh has to provide CMake itself, it still installs v3, exactly as before.

Background

Two independent toolchain shifts were breaking CLP.

CMake v4+ changed two things that affect CLP. v4.0 made a cmake_minimum_required minimum below v3.5 a hard error, so any dependency declaring less no longer configures. v4.4 then started validating the warning categories in -W arguments passed to CMake itself, rejecting any it doesn't recognize where earlier versions let them through. The first of these surfaced on macOS, where brew install cmake had moved to v4 — that's #795, filed in April 2025. CLP's response then was to pin CMake <4 in #1271, which capped the problem rather than fixing it.

Separately, libstdc++ 15 stopped transitively including <cstdint>, so yaml-cpp v0.7.0 fails to compile with 'uint16_t' was not declared in this scope. CMake plays no part here — this hits GCC 15 on any CMake version.

The blockers

Five dependencies blocked CMake v4, and all five had to be fixed for support to mean anything. Four simply declare a minimum below the v3.5 threshold; the fifth trips the v4.4 flag validation instead, which is why it moves the ceiling to v4.4 rather than v4.0:

Blocker	Breaks on	Fix
yaml-cpp 0.7.0 declares CMake v3.4	v4.0+	upgrade to v0.9.0
ANTLR's test build fetches a googletest declaring CMake v2.8.12	v4.0+	disable ANTLR's tests
libarchive 3.5.1 declares CMake v2.8.12	v4.0+	upgrade to 3.8.9
mariadb-connector-cpp 1.1.5 declares CMake v3.1 on non-Apple platforms	v4.0+	upgrade to 1.1.8
mongo-c-driver passes a malformed compiler-warning flag (bundled inside mongo-cxx-driver)	v4.4+	upgrade mongo-cxx-driver to r4.4.1

The mongo-cxx-driver upgrade is the critical one. The bundled driver passes -Werror — a compiler flag — through a try_compile()'s CMAKE_FLAGS, and v4.4 reads it as a CMake warning category instead, failing with The warning category "error ..." is not known. Upstream moved the flag to COMPILE_DEFINITIONS in mongo-c-driver#2346.

Without that upgrade, "CMake v4 support" would mean only v4.0 through v4.3 — yet v4.4 is what Homebrew, the musllinux base image, and a plain pipx install cmake all provide today.

zlib, Microsoft.GSL, and nlohmann_json declare v3.12, v3.14, and v3.5 respectively — all at or above v3.5 — so v4 accepts them unchanged, and their upgrades below are maintenance rather than v4 fixes.

The GCC 15 failure needs no separate change: yaml-cpp v0.9.0 fixes the <cstdint> include as well, so one upgrade closes both toolchain shifts.

Prior work

Two earlier attempts preceded this one.

@Bill-hbrhbr hit the CMake v4 problem in #794 (April 2025) and bumped yaml-cpp to an unreleased commit; when that didn't land, they added the <4 pin in #1271, which this PR removes. yaml-cpp v0.9.0 is now a released version declaring a compatible minimum. They also proposed -DANTLR_BUILD_CPP_TESTS=OFF earlier, in #1479 (October 2025, still open), as part of standardizing the dependency install tasks rather than as a CMake v4 fix.

@4ertus2 hit it again on Ubuntu 26.04 in #2453, arriving at the same ANTLR flag independently. This PR carries their yaml-cpp upgrade and ANTLR change, with two deviations: -DCMAKE_POLICY_VERSION_MINIMUM=3.5, which forces v4 to accept older declarations, isn't carried over — it's redundant once yaml-cpp declares v3.5 — and -DANTLR_BUILD_CPP_TESTS=OFF follows the existing alphabetical ordering.

Dependency upgrades

None required changes to CLP's own source.

Dependency	From	To	Rationale	Risk
yaml-cpp	0.7.0	0.9.0	Fixes the GCC 15 <cstdint> failure; also raises its declared minimum to CMake v3.5.	Medium-low
mongo-cxx-driver	r4.1.1	r4.4.1	Required for CMake v4.4+, for the reason described above. The upstream fix (mongo-c-driver#2346) merged 2026-07-13, and r4.4.1 is the only release carrying it — r4.1.2, r4.1.4, r4.2.0, r4.3.0, r4.3.1, and r4.4.0 were each verified still broken.	Medium
mariadb-connector-cpp	1.1.5	1.1.8	Declares CMAKE_MINIMUM_REQUIRED(VERSION 3.1) on non-Apple platforms (VERSION 3.23 on Apple), which v4 rejects; upstream raised the else-branch to v3.5 in 1.1.8, and 1.1.6/1.1.7 still declare 3.1. Reached only through task package → deps:spider. Distinct from the MariaDB C connector CLP core uses (libmariadb), which comes from distro packages and is unaffected.	Low
libarchive	3.5.1–3.8.0, by distro	3.8.9	3.5.1 declares CMake v2.8.12, which v4 rejects; libarchive raised it to CMake v3.17 in its v3.7.9. Also retires a Dec 2020 pin.	Low
SQLite3	v3.36.0	v3.53.4	Maintenance; the pin dated from 2021. SQLite's C API guarantees make it a drop-in source swap.	Low
Catch2	v3.8.0	v3.15.3	Maintenance; seven minors behind.	Low
Microsoft.GSL	v4.0.0	v4.2.2	Maintenance; dates from 2022.	Low
nlohmann_json	v3.11.3	v3.12.0	Maintenance.	Low
simdjson	v4.6.4	v4.6.6	Maintenance; patch-level.	Very low
utfcpp	v4.0.6	v4.1.1	Maintenance.	Low
zlib	v1.3.1	v1.3.2	Maintenance and security hygiene.	Low
date	v3.0.1	v3.0.5	Maintenance; dates from 2021.	Low

On r4.4.1's recency: it was published 2026-07-23, roughly two weeks before this PR, and is both the newest release and the oldest carrying the fix — there is no version to fall back to. It is a three-minor jump from r4.1.1 across the 16 CLP source files using mongocxx/bsoncxx. Reviewers may prefer to let it age; the alternative is keeping the CMake ceiling, since CMake v4.4+ can't be supported without it.

Build-configuration changes

Change	Rationale	Risk
install-cmake.sh: accept CMake v4+	Only the version check is relaxed; the pipx install keeps its <4 bound, so no environment changes which CMake it uses.	Low
install-cmake.sh: prepend pipx's application directory when needed	pipx ensurepath updates shell startup files but not the running process, so a freshly installed CMake could fail to resolve at the version check, exiting 127. Guarded on command -v, so it is a no-op where the directory is already on PATH (including all four images, which set PIPX_BIN_DIR).	Low
docs: drop the < 4.0.0 CMake constraint	components-core/index.md still documented the ceiling this PR removes, citing #795 as the reason. Also refreshes the dependency version table.	Very low
ANTLR: -DANTLR_BUILD_CPP_TESTS=OFF	We never run ANTLR's tests, so this also drops a configure-time network fetch and a googletest compile from every dependency build.	Very low
mongocxx: GitHub source archive + BUILD_VERSION	The r4.4.1 release tarball was packaged on macOS and carries 2,317 AppleDouble (._*) entries, which collide in the examples' target names. The GitHub archive is clean but omits VERSION_CURRENT, so the version must be passed explicitly.	Low
All four images: PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/local/lib64/pkgconfig	From v3.8.2 libarchive installs to lib64 on RHEL-family distros, but pkg-config doesn't search there, so it never finds libarchive's .pc file. pkg_check_modules finding nothing isn't an error, so -lz silently drops off the link line and clp fails on inflateEnd. Naming both directories fixes the lookup itself, and holds whichever of the two a given distro installs into.	Low
centos-stream-9: build the compression stack from source	Changes libarchive there from dynamically to statically linked. It was the only distro taking LZMA/LZ4/Zstandard/libarchive from its package manager, leaving libarchive on 3.5.3 while the others moved to 3.8.9. All four now build from source as on the other distros, and the dnf packages are dropped so there's one copy of each. Relies on the PKG_CONFIG_PATH entry above.	Medium
GLT: link yaml-cpp::yaml-cpp	The unnamespaced target is deprecated in v0.8.0 (removal in v0.10.0) and emits developer warnings.	Very low
ubuntu-jammy: build libarchive after liblzma/lz4/zstd	libarchive may statically link those three, and this was the only distro building it first.	Low

The CMake floor stays at v3.23, required by ystdlib's use of FILE_SET: CMake 3.22.6 fails with install TARGETS given unknown argument "FILE_SET" even with the declared minimum lowered, and 3.23.3 configures cleanly.

Deliberately not upgraded

Everything above is drop-in. The following are major-version bumps with breaking APIs, most needing CLP source changes, and some constrained by other components:

Dependency	Current	Latest	Why deferred
fmt / spdlog	11.2.0 / v1.15.3	12.2.0 / v1.17.0	Must move in lockstep, and fmt 12 is a major release against 38 CLP source files. Also gated externally: clp-plugin-presto-connector pins fmt to Velox's version.
Protobuf / abseil	v31.1 / 20250512.0	v35.1 / 20260526.0	Four majors of generated-code churn; abseil must match Protobuf, and opentelemetry-cpp and mongo-cxx-driver build against them.
opentelemetry-cpp	v1.27.0	v1.28.0	Builds against absl, Protobuf, and nlohmann_json, all held back above.
msgpack-cxx	cpp-7.0.0	cpp-8.0.0	Major version; also needs find_package(msgpack-cxx 7.0.0 REQUIRED) updated.
Boost	1.87.0	1.91.0	Very large surface area.

Checklist

• The PR satisfies the contribution guidelines.
• This is a breaking change and that has been indicated in the PR title, OR this isn't a breaking change.
• Necessary docs have been updated, OR no docs need to be updated.

Validation performed

Eight environments built end-to-end (task deps:core then task core), each producing 24/24 dependencies and all 7 binaries, with no CLP source changes. Those eight were arm64 builds only; the CMake v4 matrix below adds x86-64 and unit tests.

Shipped configuration

Every CLP image rebuilt from this branch. CMake comes from install-cmake.sh under its unchanged <4 bound, so all four stay on v3:

Image	OS	libc	Compiler	CMake
ubuntu-jammy	Ubuntu 22.04	glibc	GCC 11.4.0	3.31.10
centos-stream-9	CentOS Stream 9	glibc	GCC 11.5.0	3.31.10
manylinux_2_28	AlmaLinux 8	glibc 2.28	GCC 14.2.1	3.31.10
musllinux_1_2	Alpine	musl	GCC 14.2.0	3.31.10

CMake v4 and GCC 15

Every run overrides install-cmake.sh's <4 install bound, so the capability is demonstrated rather than assumed:

Environment	Compiler	CMake	x86-64	arm64
ubuntu-jammy	GCC 11.4.0	4.4.0	✓	✓
centos-stream-9	GCC 11.5.0	4.4.0	✓	✓
manylinux_2_28	GCC 14.2.1	4.4.0	✓	✓
musllinux_1_2	GCC 14.2.0	4.4.0	✓	✓
Ubuntu 26.04	GCC 15.2.0	4.4.0	✓	✓
macOS 15	AppleClang 17.0.0	4.4.0	—	✓

✓ = all dependencies and 7/7 binaries built, and the unit-test suite passed (159 test cases, ~5.77M assertions). macOS has no x86-64 row because the runner is arm64.

• The four images' x86-64 results, and the macOS result, come from a scratch branch identical to this one except that install-cmake.sh installs v4 — the only way to make CI exercise the v4 path, since this PR's own jobs always build with v3. Both runs are green: clp-artifact-build (every job, including package-image-amd64 and the *-binaries jobs that run the test suite) and clp-core-build-macos.
• The macOS row reproduces the configuration reported in Resolve compilation errors for the newest CMake releases (version >= 4.0.0) #795, on the platform it was reported on.
• Ubuntu 26.04 exercises both toolchain shifts at once — install-all.sh ran unmodified, and task deps:core built yaml-cpp 0.9.0, the release whose <cstdint> fix GCC 15 needs.
• All other rows are local runs.

Each fix confirmed against the failure it resolves

Fix	Failure without it
yaml-cpp 0.9.0	0.7.0 fails to compile under GCC 15, on CMake 3.31
ANTLR -DANTLR_BUILD_CPP_TESTS=OFF	ANTLR fails to configure under CMake 4.2.3 with tests enabled
libarchive 3.8.9	3.5.1 fails to configure under CMake 4.2.3
mongo-cxx-driver r4.4.1	r4.1.1 configures under 4.2.3 and 4.3.4, fails under 4.4.0
mariadb-connector-cpp 1.1.8	1.1.5 fails task package under 4.4.0 — found by CI, not by any local run
PKG_CONFIG_PATH	libarchive 3.8.9 builds only 2 of 7 binaries on manylinux_2_28 (inflateEnd); 3.8.0 builds 7/7
install-cmake.sh accepts v4	CMake 4.2.3 was a hard error; a system with no CMake still installs 3.31.10, not v4
install-cmake.sh PATH fix	Script exits 127 with cmake: command not found when pipx's directory isn't already on PATH

Other checks

• Spider dependencies. task deps:spider — the only path reaching mariadb-connector-cpp — built under CMake 4.4.0 on ubuntu-jammy x86-64 after the 1.1.8 upgrade, with no configure errors. The environment builds above use task deps:core + task core, which never reach it.
• Unit tests on CMake 3.31. Also pass in CI on centos-stream-9, manylinux_2_28 x86-64, musllinux_1_2 x86-64, ubuntu-jammy, and macOS (shared and static).
• PKG_CONFIG_PATH scope. CLP consumes pkg-config output only as find_library/find_path hints, a version string, and the static-dependency name list — no -L reaches the link line, so all that matters is that the .pc is found.
• All new SHA256 checksums were computed from freshly downloaded archives, and task lint:yaml passes.

Known gaps

• Some newer distros need two small script changes before they build — RHEL 10, AlmaLinux 10, CentOS Stream 10, and Debian 12/13 no longer ship JDK 11 or software-properties-common, which CLP's install scripts still request. Neither is needed: ANTLR runs on Java 21, and CLP never uses software-properties-common. This is pre-existing and unrelated to this PR; with both applied locally, the two † rows built cleanly.

Summary by CodeRabbit

• Improvements

  • Build environments now discover locally installed libraries more reliably across common library directories.
  • CMake 4 installations are supported, while automated installation remains compatible with CMake 3.23 and later.
  • Updated libarchive and related compression libraries improve build consistency across supported platforms.
  • Updated core dependency versions and download sources, including Catch2, SQLite, yaml-cpp, zlib, and others.
  • Improved MongoDB C++ Driver configuration and checksum handling for SQLite sources.

• Bug Fixes

  • Corrected YAML library linking to improve executable builds.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The changes update source dependency versions, libarchive installation, pkg-config discovery, CMake version handling, and yaml-cpp linkage across supported build environments.

Changes

Build dependency and toolchain updates

Layer / File(s)	Summary
Libarchive installation and discovery components/core/tools/scripts/lib_install/..., components/core/tools/docker-images/...	Installs libarchive 3.8.9 with compression dependencies and configures pkg-config paths for /usr/local/lib and /usr/local/lib64.
CMake version and package handling components/core/tools/scripts/lib_install/pipx-packages/install-cmake.sh	Accepts preinstalled CMake 4 or newer. pipx installations remain below version 4.
Dependency manifest and linkage refresh taskfiles/deps/main.yaml, docs/src/dev-docs/components-core/index.md, components/core/src/glt/glt/CMakeLists.txt	Updates dependency versions, archives, checksums, MongoDB and SQLite configuration, ANTLR test settings, documentation, and the namespaced yaml-cpp target.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• y-scope/clp#2357: Shares the manylinux and musllinux dependency-image installation workflow.
• y-scope/clp#2453: Updates the same yaml-cpp dependency and documented version.

Suggested reviewers: junhaoliao

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main build-toolchain and C++ dependency upgrades in the pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@components/core/tools/scripts/lib_install/pipx-packages/install-cmake.sh`:
- Around line 17-21: Update the CMake requirement documented in the
components-core development documentation to match the policy represented by
installed_version_major_max_plus_1: accept CMake 3.23.0 and newer, including
version 4+. Remove or revise the stale “less than 4.0.0” constraint note while
preserving the existing minimum-version requirement.
- Around line 23-36: Update the pre-install condition in install-cmake.sh to
install the pipx CMake package whenever cmake is missing or its detected version
is below the same minimum required by the existing installed-version failure
check. Reuse the existing required_version_major_min and
required_version_minor_min policy so acceptable system installations remain
unchanged, and ensure version detection occurs before deciding whether
installation is needed.
- Around line 24-30: Update the installation branch in install-cmake.sh after
pipx install/ensurepath to make the directory reported by pipx environment
--value PIPX_BIN_DIR available in the current process before the
installed_version command resolves cmake. Preserve the existing PATH behavior
when CMake is already installed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d6eb2cde-2cda-440a-ad4b-b49ecc88c060

📥 Commits

Reviewing files that changed from the base of the PR and between 155fbda and 8419c98.

📒 Files selected for processing (11)

• components/core/src/glt/glt/CMakeLists.txt
• components/core/tools/docker-images/clp-env-base-centos-stream-9/Dockerfile
• components/core/tools/scripts/lib_install/centos-stream-9/install-packages-from-source.sh
• components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh
• components/core/tools/scripts/lib_install/libarchive.sh
• components/core/tools/scripts/lib_install/manylinux_2_28/install-packages-from-source.sh
• components/core/tools/scripts/lib_install/musllinux_1_2/install-packages-from-source.sh
• components/core/tools/scripts/lib_install/pipx-packages/install-cmake.sh
• components/core/tools/scripts/lib_install/ubuntu-jammy/install-packages-from-source.sh
• docs/src/dev-docs/components-core/index.md
• taskfiles/deps/main.yaml

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/src/dev-docs/components-core/index.md`:
- Line 47: Synchronize the log-surgeon revision between the dependency table
entry and the build manifest: update the documented revision in the log-surgeon
row to match the revision configured by the relevant dependency manifest entry,
or update both consistently if the installed revision is intentionally changing.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2dc914bb-e6a6-4925-83f8-43f58974b90c

📥 Commits

Reviewing files that changed from the base of the PR and between b2a814a and a10dc73.

📒 Files selected for processing (11)

• components/core/src/glt/glt/CMakeLists.txt
• components/core/tools/docker-images/clp-env-base-centos-stream-9/Dockerfile
• components/core/tools/scripts/lib_install/centos-stream-9/install-packages-from-source.sh
• components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh
• components/core/tools/scripts/lib_install/libarchive.sh
• components/core/tools/scripts/lib_install/manylinux_2_28/install-packages-from-source.sh
• components/core/tools/scripts/lib_install/musllinux_1_2/install-packages-from-source.sh
• components/core/tools/scripts/lib_install/pipx-packages/install-cmake.sh
• components/core/tools/scripts/lib_install/ubuntu-jammy/install-packages-from-source.sh
• docs/src/dev-docs/components-core/index.md
• taskfiles/deps/main.yaml

💤 Files with no reviewable changes (1)

• components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh

[sitaowang1998]

Tested that e2e compression+search workflows succeeds for:

• Celery for both compression and search
• Spider for compression and Celery for search

[gibber9809]

LGTM. I don't expect any of these dependency updates to be a problem for clp-s, but still tested that:

• Unit tests pass as expected
• Core integration tests pass as expected