GH-51007: [C++] Make uriparser an external dependency by imtherealnaska · Pull Request #51244 · apache/arrow

imtherealnaska · 2026-09-08T18:33:36Z

Rationale for this change

The vendored uriparser in cpp/src/arrow/vendored/uriparser/ is 0.9.3, which is old and misses upstream security fixes. Instead of refreshing the vendored copy, this makes uriparser an external dependency like our other third-party dependencies.

What changes are included in this PR?

Add uriparser to ARROW_THIRDPARTY_DEPENDENCIES
Add build_uriparser() that builds uriparser 1.0.2 with FetchContent for uriparser_SOURCE=BUNDLED (static; docs, tests, tools and wchar_t support are disabled). The built library is bundled into arrow_bundled_dependencies.
Require uriparser 0.9.6 or later for uriparser_SOURCE=SYSTEM. All uriparser APIs used by Arrow are available in 0.9.6, so supported platforms such as Ubuntu 22.04 can use their distribution package.
Add cmake_modules/FinduriparserAlt.cmake. It tries uriparser's CMake package configuration first and falls back to pkg-config (liburiparser.pc), because Debian and Ubuntu's liburiparser-dev provides only the pkg-config file.
Add uriparser::uriparser to ARROW_STATIC_INSTALL_INTERFACE_LIBS for uriparser_SOURCE=SYSTEM, so that static library users link uriparser.
meson: Use the system uriparser 0.9.6 or later if available. Otherwise, build uriparser 1.0.2 via subprojects/uriparser.wrap with the CMake subproject support.
Remove cpp/src/arrow/vendored/uriparser/ and its section in LICENSE.txt.
Packaging: Install uriparser in our Docker images, conda environment, Brewfile, vcpkg manifests, MSYS2 setup and Linux packages build environments.
Packaging: Pass -Duriparser_SOURCE in ci/scripts/cpp_build.sh.
Packaging: Add uriparser to the dependency list in docs/source/developers/cpp/building.rst.

NOTICE : The floor is 0.9.6 rather than 1.0.2, so supported platforms such as Ubuntu 22.04 can use their distro package and CI does not have to build uriparser from source.

Are these changes tested?

All existing tests pass.

Are there any user-facing changes?

Now Arrow requires uriparser or builds it . No user facing changes as such because no API changes .

This PR contains a "Critical Fix". It has security fixes that has gone in uriparser.

AI Usage:

Used for testing <-> building loop.

GitHub Issue: [C++] Bump vendored uriparser #51007

kou · 2026-09-14T08:03:44Z

    packages+=("${MINGW_PACKAGE_PREFIX}-gflags")
    packages+=("${MINGW_PACKAGE_PREFIX}-grpc")
    packages+=("${MINGW_PACKAGE_PREFIX}-gtest")
+    packages+=("${MINGW_PACKAGE_PREFIX}-uriparser")


Can we revert this because we already have it in this list?

kou · 2026-09-14T08:08:13Z

+if(URIPARSER_ROOT)
+  find_library(URIPARSER_LIB
+               NAMES uriparser
+               PATHS ${URIPARSER_ROOT}
+               PATH_SUFFIXES ${ARROW_LIBRARY_PATH_SUFFIXES}
+               NO_DEFAULT_PATH)
+  find_path(URIPARSER_INCLUDE_DIR
+            NAMES uriparser/Uri.h
+            PATHS ${URIPARSER_ROOT}
+            NO_DEFAULT_PATH
+            PATH_SUFFIXES ${ARROW_INCLUDE_PATH_SUFFIXES})
+else()


We don't need this check. We need to check only CMake package and pkg-config package.

kou · 2026-09-14T08:09:09Z

+            NO_DEFAULT_PATH
+            PATH_SUFFIXES ${ARROW_INCLUDE_PATH_SUFFIXES})
+else()
+  find_package(PkgConfig QUIET)


Could you add QUIET only when uriparserAlt_FIND_QUIETLY?

kou · 2026-09-14T08:09:42Z

+            PATH_SUFFIXES ${ARROW_INCLUDE_PATH_SUFFIXES})
+else()
+  find_package(PkgConfig QUIET)
+  pkg_check_modules(URIPARSER_PC liburiparser)


Could you add QUIET when uriparserAlt_FIND_QUIETLY?

Could you add IMPORTED_TARGET?

kou · 2026-09-14T08:10:24Z

+                 NO_DEFAULT_PATH
+                 PATH_SUFFIXES ${ARROW_LIBRARY_PATH_SUFFIXES})
+    set(URIPARSER_VERSION "${URIPARSER_PC_VERSION}")
+  else()


We don't need this because we want to use CMake target instead of variables.

We don't need this because we want to use CMake target instead of variables.

Didnt really get this. I have made some changes , please see if they work.

kou · 2026-09-14T08:10:33Z

+    find_library(URIPARSER_LIB
+                 NAMES uriparser
+                 PATH_SUFFIXES ${ARROW_LIBRARY_PATH_SUFFIXES})
+    find_path(URIPARSER_INCLUDE_DIR
+              NAMES uriparser/Uri.h
+              PATH_SUFFIXES ${ARROW_INCLUDE_PATH_SUFFIXES})


We don't need this fallback.

kou · 2026-09-14T08:12:21Z

+  externalproject_add(uriparser_ep
+                      ${EP_COMMON_OPTIONS}
+                      CMAKE_ARGS ${URIPARSER_CMAKE_ARGS}
+                      INSTALL_DIR ${URIPARSER_PREFIX}
+                      URL ${ARROW_URIPARSER_SOURCE_URL}
+                      URL_HASH "SHA256=${ARROW_URIPARSER_BUILD_SHA256_CHECKSUM}"
+                      BUILD_BYPRODUCTS "${URIPARSER_STATIC_LIB}")


Could you use FetchContent instead of ExternalProject?

Sure. Will refactor .

kou · 2026-09-14T08:12:57Z

+                   HAVE_ALT
+                   TRUE
+                   REQUIRED_VERSION
+                   "1.0.2"


Can we require 0.9.6 or later for Ubuntu 22.04?

Specifically for ubuntu ? or do you want me to have the distribution bundled minimum for other distros as well? fedora has 1.0 and likewise.

No. I think that Ubuntu 22.04 ships the oldest uriparser in our supported (CI checked) platforms. If we don't require 1.0.2 or later features, I want to accept older versions in supported platforms such as Ubuntu 22.04:

Suggested change

"1.0.2"

"0.9.6"

If we accept older versions, we can reduce our CI time because we don't need to build bundled uriparser.

I will update with >= 0.9.6

kou · 2026-09-14T08:16:27Z


-arrow_util_deps = [threads_dep]
+uriparser_dep = dependency(
+    'liburiparser',


Does this search both of CMake package and pkg-config package?

added uriparser as well so we can check for both the names

kou · 2026-09-28T06:17:42Z

@github-actions crossbow submit -g r

github-actions · 2026-09-28T06:20:38Z

Revision: c885134

Submitted crossbow builds: ursacomputing/crossbow @ actions-f0e03a3a56

Task	Status
r-binary-packages
r-recheck-most
test-r-alpine-linux-cran
test-r-arrow-backwards-compatibility
test-r-depsource-system
test-r-dev-duckdb
test-r-devdocs
test-r-extra-packages
test-r-fedora-clang
test-r-gcc-11
test-r-gcc-12
test-r-install-local
test-r-install-local-minsizerel
test-r-linux-as-cran
test-r-linux-rchk
test-r-linux-sanitizers
test-r-linux-valgrind
test-r-m1-san
test-r-macos-as-cran
test-r-offline-maximal
test-r-ubuntu-22.04
test-r-versions
test-r-wasm

kou · 2026-09-28T06:21:44Z

Could you check CI results and update the PR description?

raulcd

@imtherealnaska could you rebase main, several of the CI failures are old and have been fixed on main. I want to assess the state of the PR as we would prefer to merge this before the 26.0.0 release and the feature freeze is expected for tomorrow.

raulcd · 2026-09-30T07:37:55Z

The lint failure requires fixing, see the diff on the job failure:

 diff --git a/cpp/cmake_modules/FinduriparserAlt.cmake b/cpp/cmake_modules/FinduriparserAlt.cmake
index 7ef10f1841..0dd810d4fc 100644
--- a/cpp/cmake_modules/FinduriparserAlt.cmake
+++ b/cpp/cmake_modules/FinduriparserAlt.cmake
@@ -53,9 +53,10 @@ if(uriparser_PC_FOUND)
   set(uriparserAlt_VERSION "${uriparser_PC_VERSION}")
 endif()
 
-find_package_handle_standard_args(uriparserAlt
-                                  REQUIRED_VARS uriparser_PC_FOUND
-                                  VERSION_VAR uriparserAlt_VERSION)
+find_package_handle_standard_args(
+  uriparserAlt
+  REQUIRED_VARS uriparser_PC_FOUND
+  VERSION_VAR uriparserAlt_VERSION)

…u and distro bundled version

…on to 0.9.6

imtherealnaska · 2026-09-30T11:24:42Z

@imtherealnaska could you rebase main, several of the CI failures are old and have been fixed on main. I want to assess the state of the PR as we would prefer to merge this before the 26.0.0 release and the feature freeze is expected for tomorrow.

I had some more changes for Dockerfiles. I have tested them . MinIO failures should be fixed from rebase.

imtherealnaska · 2026-09-30T13:41:03Z

of the 3 jobs failing 2 are MINGW at parquet-reader-test and are fixed by this PR . Conda forge is not sure

imtherealnaska · 2026-09-30T14:03:25Z

I think the conda job failure is also because of simdjson 5.0.1 bug , but the env change in this PR forces a fresh solve so it's exposed i think . Should I pin simdjson in ci/conda_env_cpp.txt ? (on a different PR ? )

raulcd · 2026-09-30T14:54:12Z

@github-actions crossbow submit -g r

github-actions · 2026-09-30T14:57:36Z

Revision: 525b820

Submitted crossbow builds: ursacomputing/crossbow @ actions-a46fa27440

Task	Status
r-binary-packages
r-recheck-most
test-r-alpine-linux-cran
test-r-arrow-backwards-compatibility
test-r-depsource-system
test-r-dev-duckdb
test-r-devdocs
test-r-extra-packages
test-r-fedora-clang
test-r-gcc-11
test-r-gcc-12
test-r-install-local
test-r-install-local-minsizerel
test-r-linux-as-cran
test-r-linux-rchk
test-r-linux-sanitizers
test-r-linux-valgrind
test-r-m1-san
test-r-macos-as-cran
test-r-offline-maximal
test-r-ubuntu-22.04
test-r-versions
test-r-wasm

kou

+1

I've updated the description.

raulcd

Thanks so much @imtherealnaska ! I am going to merge, I don't expect failures but if there are any failures on any of the extended CI checks we can fix them as part of the release preparation.

imtherealnaska requested review from assignUser, jonkeane, kou, pitrou and raulcd as code owners September 8, 2026 18:33

github-actions Bot added Component: C++ Component: Documentation awaiting review Awaiting review labels Sep 8, 2026

imtherealnaska mentioned this pull request Sep 8, 2026

Bumping vendored uriparser #51123

Closed

kou reviewed Sep 14, 2026

View reviewed changes

pitrou removed their request for review September 21, 2026 15:19

github-actions Bot added awaiting committer review Awaiting committer review and removed awaiting review Awaiting review labels Sep 28, 2026

raulcd reviewed Sep 30, 2026

View reviewed changes

github-actions Bot added awaiting changes Awaiting changes awaiting change review Awaiting change review and removed awaiting committer review Awaiting committer review awaiting changes Awaiting changes labels Sep 30, 2026

imtherealnaska added 6 commits September 30, 2026 16:44

apacheGH-51007: [C++] Make uriparser an external dependency

3407398

Fixes duplicate mention of uriparser , and cmakelists changes

9db4aa4

Update uriparser dependency version to >=0.9.6 So as to include ubunt…

9a92366

…u and distro bundled version

Refactor uriparser build process to use FetchContent and update versi…

d7f4de0

…on to 0.9.6

linting and ucrt64 fixes

8bee94c

Declare uriparser in packaging metadata

525b820

imtherealnaska force-pushed the gh-51007-uriparser-external branch from 9b47937 to 525b820 Compare September 30, 2026 11:17

kou approved these changes Oct 1, 2026

View reviewed changes

github-actions Bot added awaiting merge Awaiting merge and removed awaiting change review Awaiting change review labels Oct 1, 2026

raulcd approved these changes Oct 1, 2026

View reviewed changes

raulcd merged commit 1998ed3 into apache:main Oct 1, 2026
63 of 66 checks passed

raulcd removed the awaiting merge Awaiting merge label Oct 1, 2026

This was referenced Oct 1, 2026

[C++] Bump vendored uriparser #51007

Closed

[CI][Python][Packaging] Wheels fail building UriParser #51675

Closed

Conversation

imtherealnaska commented Sep 8, 2026 • edited by kou Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rationale for this change

What changes are included in this PR?

Are these changes tested?

Are there any user-facing changes?

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

imtherealnaska Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kou commented Sep 28, 2026

Uh oh!

github-actions Bot commented Sep 28, 2026

Uh oh!

kou commented Sep 28, 2026

Uh oh!

raulcd left a comment

Choose a reason for hiding this comment

Uh oh!

raulcd commented Sep 30, 2026

Uh oh!

imtherealnaska commented Sep 30, 2026

Uh oh!

imtherealnaska commented Sep 30, 2026

Uh oh!

imtherealnaska commented Sep 30, 2026

Uh oh!

raulcd commented Sep 30, 2026

Uh oh!

github-actions Bot commented Sep 30, 2026

Uh oh!

kou left a comment

Choose a reason for hiding this comment

Uh oh!

raulcd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

imtherealnaska commented Sep 8, 2026 •

edited by kou

Loading

imtherealnaska Sep 21, 2026 •

edited

Loading