GH-55165: [C++] Force newer versions of Brotli by CurtHagenlocher · Pull Request #55167 · apache/arrow

CurtHagenlocher · 2026-10-23T23:40:49Z

Rationale for this change

It seemed like a good time for a change.

What changes are included in this PR?

Newer versions of the Brotli dependency are forced by the build.

Are these changes tested?

Presumably the relevant code paths already have tests.

Are there any user-facing changes?

No.

Was AI used for this PR?

PR code and description written by:

Human
AI

Reviewed before submission by:

Human
AI
Not reviewed

GitHub Issue: [C++] We should take a newer version of Brotli #55165

github-actions · 2026-10-23T23:41:58Z

⚠️ GitHub issue #55165 has been automatically assigned in GitHub to PR creator.

Copilot

🟡 Changes recommended

The Windows wheel image revision must also change to prevent cached images from bypassing the Brotli upgrade.

1 open issue

Bump Windows wheel image revision for Brotli update · New

What changed in this PR

This PR updates bundled Brotli versions across Arrow’s C++ build paths, addressing GH-55165.

Changes:

Updates the CMake dependency pin to Brotli 1.0.10 and its checksum.
Updates the Meson fallback to Brotli 1.1.1 with local build definitions and licensing.
Patches vcpkg to use Brotli 1.2.1 with an updated checksum.

File	Description
`cpp/thirdparty/versions.txt`	Updates the bundled Brotli version and checksum.
`cpp/subprojects/packagefiles/google-brotli/meson.build`	Adds local Meson build definitions for Brotli.
`cpp/subprojects/packagefiles/google-brotli/LICENSE.build`	Includes licensing for the Meson build definitions.
`cpp/subprojects/google-brotli.wrap`	Updates the source archive and selects the local build overlay.
`ci/vcpkg/ports.patch`	Updates the vcpkg Brotli version and checksum.

_{Review effort: Balanced}

…image - Apply meson-fmt to the vendored google-brotli meson.build (whitespace only). - Bump PYTHON_WHEEL_WINDOWS_IMAGE_REVISION so Windows wheel CI rebuilds its cached image with the patched vcpkg brotli 1.2.1 port instead of reusing the existing image built with 1.2.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

Compatibility of the new patch with the inaccessible pinned vcpkg port remains unverified and needs CI or human confirmation.

No open issues 🎉

1 resolved since last review

Bump Windows wheel image revision for Brotli update

_{Review effort: Balanced}

CurtHagenlocher · 2026-10-23T23:57:17Z

@github-actions crossbow submit wheel-windows-*

github-actions · 2026-10-23T23:59:35Z

Revision: 747092e

Submitted crossbow builds: ursacomputing/crossbow @ actions-41b08c9f7f

Task	Status
wheel-windows-cp311-cp311-amd64
wheel-windows-cp312-cp312-amd64
wheel-windows-cp313-cp313-amd64
wheel-windows-cp314-cp314-amd64
wheel-windows-cp314-cp314t-amd64
wheel-windows-cp315-cp315-amd64
wheel-windows-cp315-cp315t-amd64

CVE-2026-111497 (Brotli decoder out-of-bounds write) affects the Brotli 1.0.9 that Arrow 18 bundles. Apache Arrow ships fixes only in new major versions — the Brotli update (apache/arrow#55167, unmerged) targets main — so `pyarrow~=18.0` could never take it. pyarrow is now `>=18.0`; a rebuild installs 26.0.0 today (not fixed yet either) and the first fixed major on the rebuild after it ships. The manifest advertises the same constraint. The other packages keep `~=`: pandas 3, polars 2, DuckDB 2 and Pillow 13 change the API LLM-written code uses. With pyarrow 26.0.0, pandas 2.3.3, polars 1.44.2 and DuckDB 1.5.6, `pip check` is clean and parquet / DataFrame / DuckDB round-trips match pyarrow 18.1.0. ADR-0007 is amended and records what this release does not fix: DuckDB's vendored Brotli 1.1.0 (upstream fix unmerged) and Pillow's bundled libbrotlidec (WOFF2 only, not reached here). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

raulcd

Thanks for pushing this @CurtHagenlocher

raulcd · 2026-10-26T07:32:22Z

@@ -1,3 +1,28 @@
+diff --git a/ports/brotli/portfile.cmake b/ports/brotli/portfile.cmake
+index e55c69c3d1..7d7cb1d67e 100644
+--- a/ports/brotli/portfile.cmake


This is not necessary. We can bump the vcpkg version used on .env and avoid this patch.

raulcd · 2026-10-26T07:32:49Z

@@ -0,0 +1,19 @@
+Copyright (c) 2021 The Meson development team


None of this chanegs under cpp/subprojects/google-brotli seem necessary to me.

raulcd · 2026-10-26T07:34:15Z

 ARROW_BOOST_BUILD_SHA256_CHECKSUM=f51707c27359a0df0cac1beada86de31bb5eed5e8285592dadec384df99c2984
-ARROW_BROTLI_BUILD_VERSION=v1.0.9
-ARROW_BROTLI_BUILD_SHA256_CHECKSUM=f9e8d81d0405ba66d181529af42a3354f838c939095ff99930da6aa9cdf6fe46
+ARROW_BROTLI_BUILD_VERSION=v1.0.10


Is there any reason we don't bump to something newer here? Given that we are bumping our bundle dependency we could try and bump to latest (1.2.1) unless other dependencies have other constraints.

A basic conservatism, I suppose. Given that 1.0, 1.1 and 1.2 were all patched, it seemed possible that there were some incompatibilities between them. We could try 1.2.1 and see if anything breaks.

- Bump the vcpkg pin (.env, cpp/vcpkg.json, c_glib/vcpkg.json) to 61d7eaeb, the upstream commit that updates the brotli port to 1.2.1, and drop the brotli hunk from ci/vcpkg/ports.patch. - Drop the llvm hunk from ci/vcpkg/ports.patch: upstream restructured the port and the hunk no longer applies. - Revert the PYTHON_WHEEL_WINDOWS_IMAGE_REVISION bump; the image tag already changes with VCPKG. - Bump the bundled Brotli to v1.2.1. Brotli >= 1.1.0 names static libraries without the "-static" suffix and installs normally on Emscripten, so update build_brotli accordingly and stop building the CLI tool and tests. - Revert the Meson wrap changes; the C++ Meson build isn't used for any released artifact, so keep tracking WrapDB. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

Compatibility of the broader vcpkg update with the remaining local port patches is unverified and needs human confirmation.

No open issues 🎉

_{Review effort: Balanced}

Force newer versions of Brotli

9efb052

CurtHagenlocher requested review from assignUser, jonkeane, kou and raulcd as code owners October 23, 2026 23:40

Copilot AI balanced review requested due to automatic review settings October 23, 2026 23:40

github-actions Bot added Component: C++ awaiting review Awaiting review labels Oct 23, 2026

Copilot started reviewing on behalf of CurtHagenlocher October 23, 2026 23:42

View session

Copilot AI reviewed Oct 23, 2026

View reviewed changes

Comment thread ci/vcpkg/ports.patch Outdated

Copilot AI balanced review requested due to automatic review settings October 23, 2026 23:51

Copilot started reviewing on behalf of CurtHagenlocher October 23, 2026 23:52

View session

Copilot AI reviewed Oct 23, 2026

View reviewed changes

ctriley mentioned this pull request Oct 24, 2026

Mitigate CVE-2026-111497 in HTTP downloads mobility-solutions-inc/censusdis#46

Merged

rok approved these changes Oct 24, 2026

View reviewed changes

github-actions Bot added awaiting merge Awaiting merge and removed awaiting review Awaiting review labels Oct 24, 2026

raulcd reviewed Oct 26, 2026

View reviewed changes

github-actions Bot added awaiting changes Awaiting changes and removed awaiting merge Awaiting merge labels Oct 26, 2026

Copilot AI balanced review requested due to automatic review settings October 26, 2026 12:24

github-actions Bot added Component: GLib and removed awaiting changes Awaiting changes labels Oct 26, 2026

Copilot started reviewing on behalf of CurtHagenlocher October 26, 2026 12:24

View session

github-actions Bot added the awaiting change review Awaiting change review label Oct 26, 2026

Copilot AI reviewed Oct 26, 2026

View reviewed changes

Navigation Menu

Repository navigation

GH-55165: [C++] Force newer versions of Brotli - #55167

GH-55165: [C++] Force newer versions of Brotli#55167
CurtHagenlocher wants to merge 3 commits into
apache:mainfrom
CurtHagenlocher:newer_brotli

CurtHagenlocher commented Oct 23, 2026 •

edited by github-actions Bot

Loading

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

CurtHagenlocher commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

raulcd left a comment

Uh oh!

raulcd Oct 26, 2026

Uh oh!

raulcd Oct 26, 2026

Uh oh!

raulcd Oct 26, 2026

Uh oh!

CurtHagenlocher Oct 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		@@ -0,0 +1,19 @@
		Copyright (c) 2021 The Meson development team

Conversation

CurtHagenlocher commented Oct 23, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rationale for this change

What changes are included in this PR?

Are these changes tested?

Are there any user-facing changes?

Was AI used for this PR?

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

CurtHagenlocher commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

raulcd left a comment

Choose a reason for hiding this comment

Uh oh!

raulcd Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

raulcd Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

raulcd Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

CurtHagenlocher Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

CurtHagenlocher commented Oct 23, 2026 •

edited by github-actions Bot

Loading