Repository navigation
Dependency upgrades by priority #147
Description
Vendored dependencies and CI actions that need upgrading, by priority.
P1
- PCRE2 10.42 -> 10.42 backports or 10.49. The tree is the plain 10.42 tarball from Migrate to pcre2 HaxeFoundation/hxcpp#1037 with none of the fixes upstream backported to its
release/pcre2-10.42branch, including a heap overflow inpcre2_match()with(*LIMIT_HEAP=n)(AddressSanitizer: heap-buffer-overflow PCRE2Project/pcre2#275), which EReg reaches with a hostile pattern. Quick path: take the backports. Full path: 10.49 adds four source files topcre2_sources.xml, moves sljit todeps/sljit, and changes some regex semantics ({,3}is a quantifier since 10.43).
P2
- mbedTLS 3.6.7. Current, with no open advisories, but the 3.6 LTS ends in March 2027. The next LTS, 4.1 (to 2029), is a real port: crypto moves to TF-PSA-Crypto,
mbedtls-files.xmlneeds rebuilding,mbedtls_ssl_conf_rng, the ctr_drbg/entropy contexts andmbedtls_oid_get_attr_short_nameare gone, and errors become PSA codes. Upstream is still on 2.28 (mbedtls3 migration HaxeFoundation/hxcpp#1113). - SQLite 3.51.2 -> 3.54.0. 3.51.3 fixes a WAL-reset database corruption bug, and 3.53.2 fixes an FTS5 heap overflow (FTS5 is opt-in here). Drop-in amalgamation swap.
- GitHub Actions. checkout, upload-artifact and download-artifact are pinned to
@v4, which run on Node 20. GitHub has removed Node 20 and forces them onto Node 24 with a warning. Move to checkout@v7, upload-artifact@v7 and download-artifact@v8 (v8 fails on hash mismatch by default).
P3
- zlib 1.3.1 -> 1.3.2. Audit fixes, none in the deflate/inflate paths hxcpp uses (Fix a macOS latest build from zlib be outdated HaxeFoundation/hxcpp#1356).
- Tracy 0.13.1 -> 0.14.1. The protocol changed, so current Tracy viewers cannot connect to
HXCPP_TRACYbuilds. - cppia sljit 0.93. Park: no advisories, and an upgrade means porting
CppiaCompilerto a much-changed API. Worth checking whether the JIT's writable and executable mappings work on Apple silicon withoutMAP_JIT.
Not needed: the MySQL client is hxcpp's own (it already supports caching_sha2_password and TLS here), and Haxe 4.3.7, setup-haxe and release-action are current.
Activity
dimensionscape commentedon Oct 15, 2026
Lime ties into this. Its static_link builds (iOS, tvOS,
-static) skip Lime's own mbedTLS 2.28.7 and compile its curl 7.87 against ours throughproject/thirdparty/mbedtls-files.xmlandmbedtls-flags.xml, so they now get 3.6. A 4.1 port needs Lime on a curl with mbedTLS 4 support at the same time, and Lime moving its own copy to 3.6 would leave one version everywhere.dimensionscape commentedon Oct 15, 2026
Plan for mbedTLS: Lime 8.4.0 moves its own copy to 3.6 LTS with a current curl, so Lime and libhxcpp share one version. The 4.1 port is a joint release, libhxcpp 7.0.0 with a Lime major, since Lime's static builds compile against our bundled copy. It lands before the 3.6 LTS ends in March 2027.
Move the GitHub Actions off Node 20
Apply PCRE2's security backports to the vendored 10.42
Update SQLite to 3.54.0
Update zlib to 1.3.2
dimensionscape commentedon Oct 21, 2026
Done for 6.0.0:
(*LIMIT_HEAP=n)heap overflow (b9f8458)Left out of 6.0.0: the mbedTLS 4.1 port, now #255, since 3.6 is supported until March 2027; and sljit, parked because it has no advisories and an upgrade means porting the cppia JIT to a much-changed API.