Repository navigation
GDAL v3.13.3 - #236
Merged
Merged
GDAL v3.13.3#236
Conversation
Upstream bug-fix release (2026-08-18). `GDAL_COMMIT_VER` resolves to the existing `v3.13.3` tag (e5a93434). Verified before bumping: - `shared/patch/CMakeLists.txt.patch` still applies. `swig/csharp/CMakeLists.txt` is byte-identical between v3.13.2 and v3.13.3, so the C# binding patch carries over unchanged. - PROJ stays at 9.8.0. 9.8.1 has been available since 2026-04-10 and was skipped across 3.13.0, 3.13.1 and 3.13.2, so holding it is the existing intent rather than an oversight. - vcpkg baseline unchanged (release 2026.07.29); no dependency moves with this.
PROJ 9.8.0 -> 9.8.1 (2026-04-10). Tag `9.8.1` exists upstream and `PROJ_COMMIT_VER` takes the bare version, so no format change. expat override 2.7.4 -> 2.7.5, which is three CVE fixes (CVE-2026-32776, -32777, -32778) at no risk to the GLIBC 2.35 floor. The floor problem is specific to 2.8.0+, and not for the reason the 2b42672 message implies: arc4random appears in xmlparse.c as far back as 2.7.4, but 2.7.x has no `EXPAT_WITH_ARC4RANDOM` CMake option, so vcpkg's CMake build never detects or links it. 2.8.0 added that detection defaulting to AUTO, which resolves to ON against glibc 2.36 and pulls arc4random_buf@GLIBC_2.36 in. So 2.7.5 behaves exactly like 2.7.4 here, and ci/check-glibc-floor.sh verifies it. Deliberately unchanged: - arrow stays 23.0.1. The `std::log2p1` guard does not exist at 23.0.1; it was introduced later and is still present at 25.0.1 behind `__apple_build_version__ && !__cpp_lib_bitops`, which is exactly the Apple Clang misfire. apache/arrow#49841 is still open. - vcpkg baseline stays 2026.07.29 - still the newest release tag. - HDF4 stays 4.3.1 - already the latest release (2025-06-30). Still held back by the pin: 16 further expat CVE fixes in 2.8.0-2.8.3, including 13 in 2.8.2. Taking those needs an overlay port passing -DEXPAT_WITH_ARC4RANDOM=OFF -DEXPAT_WITH_ARC4RANDOM_BUF=OFF, which would keep the floor while getting current. Not bundled here.
This was referenced Oct 14, 2026
This was referenced Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps GDAL to 3.13.3 (upstream bug-fix release, 2026-08-18), PROJ to 9.8.1, and the expat override to 2.7.5.
GDAL_COMMIT_VERresolves to the existingv3.13.3tag; PROJ's9.8.1tag follows the same unprefixed convention as before.expat 2.7.5 brings three CVE fixes (CVE-2026-32776, -32777, -32778) and stays inside 2.7.x, so it does not disturb the GLIBC 2.35 floor: the floor problem is specific to 2.8.0+, which added CMake detection for
arc4random(default AUTO) that resolves ON against a glibc 2.36 base. 2.7.x has no such option, so vcpkg's CMake build never links it.ci/check-glibc-floor.shconfirms the result on both arches.shared/patch/CMakeLists.txt.patchstill applies:swig/csharp/CMakeLists.txtis byte-identical between v3.13.2 and v3.13.3, verified withgit apply --checkagainst the 3.13.3 file. All three platforms apply this patch during the GDAL build.Unchanged, deliberately:
std::log2p1reference does not exist at 23.0.1; it was introduced later and is still present at 25.0.1 behind__apple_build_version__ && !__cpp_lib_bitops, which is the Apple Clang misfire. [C++] error: no member named 'log2p1' in namespace 'std' apache/arrow#49841 remains open.2026.07.29- still the newest release tag.The expat override still holds back 16 further CVE fixes across 2.8.0-2.8.3, 13 of them in 2.8.2. Taking those does not require accepting a higher floor: an overlay port passing
-DEXPAT_WITH_ARC4RANDOM=OFF -DEXPAT_WITH_ARC4RANDOM_BUF=OFFwould build current expat and keep 2.35. Left for a separate change.