GH-51007: [C++] Make uriparser an external dependency by imtherealnaska · Pull Request #51244 · apache/arrow

imtherealnaska · 2026-09-08T18:33:36Z

Rationale for this change

Updating the uriparser version so as to include security fixes. Rather than refreshing vendored copy , this makes uriparser and external dependency.

What changes are included in this PR?

uriparser added to ARROW_THIRDPARTY_DEPENDENCIES, with a
build_uriparser() using FetchContent pinned to 1.0.2 (docs, tests, tools
and wchar_t support disabled; static; URI_STATIC_BUILD on the
interface; registered in ARROW_BUNDLED_STATIC_LIBS).
REQUIRED_VERSION "0.9.6" for SYSTEM builds, so supported platforms can
use the uriparser their distro already ships instead of building from
source. The bundled build still uses 1.0.2.
New cmake_modules/FinduriparserAlt.cmake. Upstream ships a CMake package
config, but Debian/Ubuntu's liburiparser-dev installs only
liburiparser.pc, so the module tries find_package(CONFIG) first, then
pkg-config, then a plain library search.
ARROW_STATIC_INSTALL_INTERFACE_LIBS gains uriparser::uriparser for
SYSTEM builds, so static consumers link correctly.
meson: new subprojects/uriparser.wrap (method = cmake, same tarball
and checksum as the CMake pin) plus a cmake.subproject fallback, since
meson has no BUNDLED equivalent.
cpp/src/arrow/vendored/uriparser/ (28 files) and its LICENSE.txt
section removed; util/uri.cc now includes <uriparser/Uri.h>.
Packaging: 6 dockerfiles, conda, Brewfile, both vcpkg manifests, MSYS2
PKGBUILD and msys2_setup.sh, r_windows_build.sh, the
-Duriparser_SOURCE passthrough in cpp_build.sh, and the dependency
list in building.rst.

NOTICE : The floor is 0.9.6 rather than 1.0.2, so supported platforms
such as Ubuntu 22.04 can use their distro package and CI does not have to
build uriparser from source.

Are these changes tested?

All existing tests pass.

Verified on Ubuntu 22.04:

With 0.9.6 (Distro bundled)present, it finds that the version is not suitable and falls back to building 1.0.2
Explicit -Duriparser_SOURCE=SYSTEM with 0.9.6 fails .
Also builds and passes 13/13 on macOS against Homebrew

Are there any user-facing changes?

Now Arrow requires uriparser or builds it . No user facing changes as such because no API changes .

This PR contains a "Critical Fix". It has security fixes that has gone in uriparser.

AI Usage:

Used for testing <-> building loop.

GitHub Issue: [C++] Bump vendored uriparser #51007

kou · 2026-09-14T08:03:44Z

    packages+=("${MINGW_PACKAGE_PREFIX}-gflags")
    packages+=("${MINGW_PACKAGE_PREFIX}-grpc")
    packages+=("${MINGW_PACKAGE_PREFIX}-gtest")
+    packages+=("${MINGW_PACKAGE_PREFIX}-uriparser")


Can we revert this because we already have it in this list?

kou · 2026-09-14T08:08:13Z

+if(URIPARSER_ROOT)
+  find_library(URIPARSER_LIB
+               NAMES uriparser
+               PATHS ${URIPARSER_ROOT}
+               PATH_SUFFIXES ${ARROW_LIBRARY_PATH_SUFFIXES}
+               NO_DEFAULT_PATH)
+  find_path(URIPARSER_INCLUDE_DIR
+            NAMES uriparser/Uri.h
+            PATHS ${URIPARSER_ROOT}
+            NO_DEFAULT_PATH
+            PATH_SUFFIXES ${ARROW_INCLUDE_PATH_SUFFIXES})
+else()


We don't need this check. We need to check only CMake package and pkg-config package.

kou · 2026-09-14T08:09:09Z

+            NO_DEFAULT_PATH
+            PATH_SUFFIXES ${ARROW_INCLUDE_PATH_SUFFIXES})
+else()
+  find_package(PkgConfig QUIET)


Could you add QUIET only when uriparserAlt_FIND_QUIETLY?

kou · 2026-09-14T08:09:42Z

+            PATH_SUFFIXES ${ARROW_INCLUDE_PATH_SUFFIXES})
+else()
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(URIPARSER_PC liburiparser)


Could you add QUIET when uriparserAlt_FIND_QUIETLY?

Could you add IMPORTED_TARGET?

kou · 2026-09-14T08:10:24Z

+                 NO_DEFAULT_PATH
+                 PATH_SUFFIXES ${ARROW_LIBRARY_PATH_SUFFIXES})
+    set(URIPARSER_VERSION "${URIPARSER_PC_VERSION}")
+  else()


We don't need this because we want to use CMake target instead of variables.

We don't need this because we want to use CMake target instead of variables.

Didnt really get this. I have made some changes , please see if they work.

kou · 2026-09-14T08:10:33Z

+    find_library(URIPARSER_LIB
+                 NAMES uriparser
+                 PATH_SUFFIXES ${ARROW_LIBRARY_PATH_SUFFIXES})
+    find_path(URIPARSER_INCLUDE_DIR
+              NAMES uriparser/Uri.h
+              PATH_SUFFIXES ${ARROW_INCLUDE_PATH_SUFFIXES})


We don't need this fallback.

kou · 2026-09-14T08:12:21Z

+  externalproject_add(uriparser_ep
+                      ${EP_COMMON_OPTIONS}
+                      CMAKE_ARGS ${URIPARSER_CMAKE_ARGS}
+                      INSTALL_DIR ${URIPARSER_PREFIX}
+                      URL ${ARROW_URIPARSER_SOURCE_URL}
+                      URL_HASH "SHA256=${ARROW_URIPARSER_BUILD_SHA256_CHECKSUM}"
+                      BUILD_BYPRODUCTS "${URIPARSER_STATIC_LIB}")


Could you use FetchContent instead of ExternalProject?

Sure. Will refactor .

kou · 2026-09-14T08:12:57Z

+                   HAVE_ALT
+                   TRUE
+                   REQUIRED_VERSION
+                   "1.0.2"


Can we require 0.9.6 or later for Ubuntu 22.04?

Specifically for ubuntu ? or do you want me to have the distribution bundled minimum for other distros as well? fedora has 1.0 and likewise.

No. I think that Ubuntu 22.04 ships the oldest uriparser in our supported (CI checked) platforms. If we don't require 1.0.2 or later features, I want to accept older versions in supported platforms such as Ubuntu 22.04:

Suggested change

"1.0.2"

"0.9.6"

If we accept older versions, we can reduce our CI time because we don't need to build bundled uriparser.

I will update with >= 0.9.6

kou · 2026-09-14T08:16:27Z


-arrow_util_deps = [threads_dep]
+uriparser_dep = dependency(
+    'liburiparser',


Does this search both of CMake package and pkg-config package?

added uriparser as well so we can check for both the names

kou · 2026-09-28T06:17:42Z

@github-actions crossbow submit -g r

github-actions · 2026-09-28T06:20:38Z

Revision: c885134

Submitted crossbow builds: ursacomputing/crossbow @ actions-f0e03a3a56

Task	Status
r-binary-packages
r-recheck-most
test-r-alpine-linux-cran
test-r-arrow-backwards-compatibility
test-r-depsource-system
test-r-dev-duckdb
test-r-devdocs
test-r-extra-packages
test-r-fedora-clang
test-r-gcc-11
test-r-gcc-12
test-r-install-local
test-r-install-local-minsizerel
test-r-linux-as-cran
test-r-linux-rchk
test-r-linux-sanitizers
test-r-linux-valgrind
test-r-m1-san
test-r-macos-as-cran
test-r-offline-maximal
test-r-ubuntu-22.04
test-r-versions
test-r-wasm

kou · 2026-09-28T06:21:44Z

Could you check CI results and update the PR description?

raulcd

@imtherealnaska could you rebase main, several of the CI failures are old and have been fixed on main. I want to assess the state of the PR as we would prefer to merge this before the 26.0.0 release and the feature freeze is expected for tomorrow.

raulcd · 2026-09-30T07:37:55Z

The lint failure requires fixing, see the diff on the job failure:

 diff --git a/cpp/cmake_modules/FinduriparserAlt.cmake b/cpp/cmake_modules/FinduriparserAlt.cmake
index 7ef10f1841..0dd810d4fc 100644
--- a/cpp/cmake_modules/FinduriparserAlt.cmake
+++ b/cpp/cmake_modules/FinduriparserAlt.cmake
@@ -53,9 +53,10 @@ if(uriparser_PC_FOUND)
   set(uriparserAlt_VERSION "${uriparser_PC_VERSION}")
 endif()
 
-find_package_handle_standard_args(uriparserAlt
-                                  REQUIRED_VARS uriparser_PC_FOUND
-                                  VERSION_VAR uriparserAlt_VERSION)
+find_package_handle_standard_args(
+  uriparserAlt
+  REQUIRED_VARS uriparser_PC_FOUND
+  VERSION_VAR uriparserAlt_VERSION)

…u and distro bundled version

…on to 0.9.6

imtherealnaska · 2026-09-30T11:24:42Z

@imtherealnaska could you rebase main, several of the CI failures are old and have been fixed on main. I want to assess the state of the PR as we would prefer to merge this before the 26.0.0 release and the feature freeze is expected for tomorrow.

I had some more changes for Dockerfiles. I have tested them . MinIO failures should be fixed from rebase.

imtherealnaska · 2026-09-30T13:41:03Z

of the 3 jobs failing 2 are MINGW at parquet-reader-test and are fixed by this PR . Conda forge is not sure

imtherealnaska · 2026-09-30T14:03:25Z

I think the conda job failure is also because of simdjson 5.0.1 bug , but the env change in this PR forces a fresh solve so it's exposed i think . Should I pin simdjson in ci/conda_env_cpp.txt ? (on a different PR ? )

raulcd · 2026-09-30T14:54:12Z

@github-actions crossbow submit -g r

github-actions · 2026-09-30T14:57:36Z

Revision: 525b820

Submitted crossbow builds: ursacomputing/crossbow @ actions-a46fa27440

Task	Status
r-binary-packages
r-recheck-most
test-r-alpine-linux-cran
test-r-arrow-backwards-compatibility
test-r-depsource-system
test-r-dev-duckdb
test-r-devdocs
test-r-extra-packages
test-r-fedora-clang
test-r-gcc-11
test-r-gcc-12
test-r-install-local
test-r-install-local-minsizerel
test-r-linux-as-cran
test-r-linux-rchk
test-r-linux-sanitizers
test-r-linux-valgrind
test-r-m1-san
test-r-macos-as-cran
test-r-offline-maximal
test-r-ubuntu-22.04
test-r-versions
test-r-wasm

imtherealnaska requested review from assignUser, jonkeane, kou, pitrou and raulcd as code owners September 8, 2026 18:33

github-actions Bot added Component: C++ Component: Documentation awaiting review Awaiting review labels Sep 8, 2026

imtherealnaska mentioned this pull request Sep 8, 2026

Bumping vendored uriparser #51123

Closed

kou reviewed Sep 14, 2026

View reviewed changes

pitrou removed their request for review September 21, 2026 15:19

github-actions Bot added awaiting committer review Awaiting committer review and removed awaiting review Awaiting review labels Sep 28, 2026

raulcd reviewed Sep 30, 2026

View reviewed changes

github-actions Bot added awaiting changes Awaiting changes awaiting change review Awaiting change review and removed awaiting committer review Awaiting committer review awaiting changes Awaiting changes labels Sep 30, 2026

imtherealnaska added 6 commits September 30, 2026 16:44

apacheGH-51007: [C++] Make uriparser an external dependency

3407398

Fixes duplicate mention of uriparser , and cmakelists changes

9db4aa4

Update uriparser dependency version to >=0.9.6 So as to include ubunt…

9a92366

…u and distro bundled version

Refactor uriparser build process to use FetchContent and update versi…

d7f4de0

…on to 0.9.6

linting and ucrt64 fixes

8bee94c

Declare uriparser in packaging metadata

525b820

imtherealnaska force-pushed the gh-51007-uriparser-external branch from 9b47937 to 525b820 Compare September 30, 2026 11:17

Conversation

imtherealnaska commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rationale for this change

What changes are included in this PR?

Are these changes tested?

Are there any user-facing changes?

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

imtherealnaska Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kou commented Sep 28, 2026

Uh oh!

github-actions Bot commented Sep 28, 2026

Uh oh!

kou commented Sep 28, 2026

Uh oh!

raulcd left a comment

Choose a reason for hiding this comment

Uh oh!

raulcd commented Sep 30, 2026

Uh oh!

imtherealnaska commented Sep 30, 2026

Uh oh!

imtherealnaska commented Sep 30, 2026

Uh oh!

imtherealnaska commented Sep 30, 2026

Uh oh!

raulcd commented Sep 30, 2026

Uh oh!

github-actions Bot commented Sep 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

imtherealnaska commented Sep 8, 2026 •

edited

Loading

imtherealnaska Sep 21, 2026 •

edited

Loading