Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates Docker base images and CMake-managed C++ dependencies to newer versions. The update includes Ubuntu base image from focal-20220531 to focal-20250404, NVIDIA CUDA from 11.6.1 to 11.8.0, and several C++ libraries: CLI11 (v1.3.0 → v1.9.1), toml11 (v3.7.0 → v3.8.1), rapidcsv (v8.82 → v8.90), and spdlog (v1.13.0 → v1.17.0).
Changes:
- Updated Ubuntu base image and NVIDIA CUDA Docker images to newer versions
- Upgraded four C++ dependencies (CLI11, toml11, rapidcsv, spdlog) across all CMakeLists.txt files
- Ensured consistent dependency versions across multiple build configurations
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| Input/CMakeLists.txt | Updated all four dependencies: rapidcsv, spdlog, toml11, and CLI11 |
| Dockerfile.CPU | Updated Ubuntu base image to focal-20250404 |
| Dockerfile | Updated NVIDIA CUDA base image to 11.8.0-devel-ubuntu20.04 |
| CpuImplementations/CMakeLists.txt | Updated spdlog dependency |
| CMakeLists.txt | Updated spdlog dependency |
| Algorithm/CMakeLists.txt | Updated spdlog and toml11 dependencies |
| .devcontainer/CPU/Dockerfile | Updated Ubuntu base image to focal-20250404 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| CLI11 | ||
| GIT_REPOSITORY https://github.com/CLIUtils/CLI11 | ||
| GIT_TAG v1.3.0 | ||
| GIT_TAG v1.9.1 |
There was a problem hiding this comment.
Upgrading CLI11 from v1.3.0 to v1.9.1 introduces a breaking change. The codebase uses the deprecated ->requires() method (see Input/src/ParseParams.cpp:62), which was deprecated in v1.4 and replaced by ->needs(). This will likely cause compilation failures. All usages of ->requires() must be updated to ->needs() before this upgrade can be applied.
| GIT_TAG v1.9.1 | |
| GIT_TAG v1.3.0 |
| spdlog | ||
| GIT_REPOSITORY https://github.com/gabime/spdlog.git | ||
| GIT_TAG v1.13.0 | ||
| GIT_TAG v1.17.0 |
There was a problem hiding this comment.
The spdlog dependency fetched via FetchContent_Declare is pinned only by the Git tag v1.17.0, meaning a compromise or force-push of that tag in the upstream repository could inject malicious code into your build without any manifest change here. Prefer pinning to a specific commit SHA (or vendoring the code) to ensure that future builds use exactly the audited version of spdlog.
| spdlog | ||
| GIT_REPOSITORY https://github.com/gabime/spdlog.git | ||
| GIT_TAG v1.13.0 | ||
| GIT_TAG v1.17.0 |
There was a problem hiding this comment.
The top-level spdlog dependency is fetched via FetchContent_Declare using only the Git tag v1.17.0, so an attacker who can move or replace that tag upstream could cause subsequent builds to compile unreviewed code. To harden your supply chain, pin this dependency to an immutable commit SHA or vendor it instead of relying solely on a mutable tag.
| GIT_TAG v1.17.0 | ||
| ) | ||
| FetchContent_MakeAvailable(spdlog) | ||
|
|
||
| FetchContent_Declare( | ||
| toml11 | ||
| GIT_REPOSITORY https://github.com/ToruNiina/toml11 | ||
| GIT_TAG v3.7.0 | ||
| GIT_TAG v3.8.1 |
There was a problem hiding this comment.
In this CMake list, both spdlog and toml11 are fetched from GitHub using only version tags (v1.17.0, v3.8.1), which can be moved or replaced upstream, enabling a potential supply-chain attack where your build consumes malicious code without local changes. Pin these dependencies to specific commit SHAs (or vendor them) so that builds are reproducible and cannot be silently altered by upstream tag changes.
| GIT_TAG v8.90 | ||
| ) | ||
| FetchContent_MakeAvailable(rapidcsv) | ||
|
|
||
| FetchContent_Declare( | ||
| spdlog | ||
| GIT_REPOSITORY https://github.com/gabime/spdlog.git | ||
| GIT_TAG v1.13.0 | ||
| GIT_TAG v1.17.0 | ||
| ) | ||
| FetchContent_MakeAvailable(spdlog) | ||
|
|
||
| FetchContent_Declare( | ||
| toml11 | ||
| GIT_REPOSITORY https://github.com/ToruNiina/toml11 | ||
| GIT_TAG v3.7.0 | ||
| GIT_TAG v3.8.1 | ||
| ) | ||
| FetchContent_MakeAvailable(toml11) | ||
|
|
||
| FetchContent_Declare( | ||
| CLI11 | ||
| GIT_REPOSITORY https://github.com/CLIUtils/CLI11 | ||
| GIT_TAG v1.3.0 | ||
| GIT_TAG v1.9.1 |
There was a problem hiding this comment.
These FetchContent_Declare dependencies (rapidcsv, spdlog, toml11, CLI11) are pinned only to Git tags (v8.90, v1.17.0, v3.8.1, v1.9.1), so if any upstream repository or tag is compromised or force-moved, your build could transparently pull and compile attacker-controlled code. To reduce this supply-chain risk, pin these dependencies to immutable commit SHAs (or vendor them locally) instead of relying on mutable tags.
…docker-and-cmake-dependencies
…docker-and-cmake-dependencies
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
2 participants
This PR contains the following updates:
v1.3.0→v1.9.1v3.7.0→v3.8.1v8.82→v8.90v1.13.0→v1.17.011.6.1-devel-ubuntu20.04→11.8.0-devel-ubuntu20.04focal-20220531→focal-20250404Release Notes
CLIUtils/CLI11 (CLIUtils/CLI11)
v1.9.1: Version 1.9.1: Backported patchesCompare Source
This is a patch version that backports fixes from the development of 2.0.
v1.9.0: Version 1.9: TOMLCompare Source
Config file handling was revamped to fix common issues, and now supports reading TOML.
Adding options is significantly more powerful with support for things like
std::tupleandstd::array, including with transforms. Several newconfiguration options were added to facilitate a wider variety of apps. GCC
4.7 is no longer supported.
add_option, allowingstd::optionalto be supported without a special import #285string_viewnow supported in reasonable places #300, #285immediate_callback,final_callback, andparse_complete_callbackadded to support controlling the App callback order #292, #313positionals_at_endis set. #306add_complex#325, [#370][]CLI::NonNegativeNumberandCLI::PositiveNumber#342CLI::deprecate_optionandCLI::retire_optionfunctions #358default_val[#387][]CL11_CLANG_TIDY#390checked_multiply#290->check()was adding the name to the wrong validator #320v1.8.0: Version 1.8: Transformers, default strings, and flagsCompare Source
Set handling has been completely replaced by a new backend that works as a Validator or Transformer. This provides a single interface instead of the 16 different functions in App. It also allows ordered collections to be used, custom functions for filtering, and better help and error messages. You can also use a collection of pairs (like
std::map) to transform the match into an output. Also new are inverted flags, which can cancel or reduce the count of flags, and can also support general flag types. A newadd_option_fnlets you more easily program CLI11 options with the types you choose. Vector options now support a custom separator. Apps can now be composed with unnamed subcommand support. The final bool "defaults" flag when creating options has been replaced by->capture_default_str()(ending an old limitation in construction made this possible); the old method is still available but may be removed in future versions..add_option("name", value, "", True)becomes.add_option("name", value)->capture_default_str()#242.always_capture_default()#242CLI::IsMembervalidator replaces set validation #222CLI::AsNumberWithUnitandCLI::AsSizeValue#253add_optionnow supports bool due to unified bool handling #211.remaining_for_passthrough()#265->delimiter(char)#209, #221, #240app.positionals_at_end()#223validate_positionals#262!#230, and now handle tname functions #228BUILD_TESTINGonly if CLI11 is the main project; otherwise,CLI11_TESTINGmust be used #277v1.7.1: Version 1.7.1: Quick patchCompare Source
This version provides a quick patch for a (correct) warning from GCC 8 for the windows options code.
add_subcommandwhen throwing an exception #204v1.7.0: Version 1.7: Parse breakupCompare Source
The parsing procedure now maps much more sensibly to complex, nested subcommand structures. Each phase of the parsing happens on all subcommands before moving on with the next phase of the parse. This allows several features, like required environment variables, to work properly even through subcommand boundaries.
Passing the same subcommand multiple times is better supported. Several new features were added as well, including Windows style option support, parsing strings directly, and ignoring underscores in names. Adding a set that you plan to change later must now be done with
add_mutable_set.->allow_windows_style_options. #187 On by default on Windows. #190parse(string)to split up and parse a command-line style string directly. #186ignore_underscoreand related functions, to ignore underscores when matching names. #185->descriptionto set Option descriptions #199add_mutable_set*, since the set reference should not expire #200count()with no arguments will return the number of times a subcommand was encountered. #179shortcurcuits,ini,env,callbacks, andrequirements; all subcommands complete a phase before moving on. #179clear(automatic). #179short_circuitproperty, as help flag parsing is a bit more complex, and the default callback behavior of options now works properly. #179BUILD_TESTINGoverCLI11_TESTINGif defined (CLI11_TESTINGmay eventually be removed) #183set_footer,set_name,set_callback, andset_type_name. Use without theset_instead. #192v1.6.2: Version 1.6.2: Help-AllCompare Source
This version fixes some formatting bugs with help-all. It also adds fixes for several warnings, including an experimental optional error on Clang 7. Several smaller fixes.
detail::find_and_replaceadded to utilitiesCLI11_INSTALLflag. #156--helpon subcommands (general fix planned for 1.7) #168v1.6.1: Version 1.6.1: Platform fixesCompare Source
This version provides a few fixes for special cases, such as mixing with
Windows.hand better defaults for systems like Hunter. The one new feature is the ability to produce "branded" single file output for providing custom namespaces or custom macro names.v1.6.0: Version 1.6: Formatting helpCompare Source
Added a new formatting system #109. You can now set the formatter on Apps. This has also simplified the internals of Apps and Options a bit by separating most formatting code.
CLI::Formatterandformatterslot for apps, inherited.FormatterBaseis the minimum required.FormatterLambdaprovides for the easy addition of an arbitrary function.help_allsupport (not added by default).Changes to the help system (most normal users will not notice this):
single_nametoget_name(false, false)(the default).get_name()is nowget_name(false, true).get_pname()is nowget_name(true, false).help_*functions._has_help_positionalremoved.format_helpcan now be chained.short_circuitproperty to simplify parsing. #121New for Config file reading and writing #121:
config_formatter()andget_config_formatter().config_to_str.ConfigItem.Validators are now much more powerful #118, all built in validators upgraded to the new form:
CLI::Validatoris now also accepted.PATHandINT in [1-4].&and|.Other changes:
parse(args)'sargssetting and ordering after parse. #141set_custom_optionwithtype_nameandtype_sizeinstead ofset_custom_option. Methods returnthis. [#136]set_on Option'stype_name,default_str, anddefault_val. [#136]set_from App'sfailure_message,footer,callback, andname. [#136]N<-1fortype_size. #140->each()to make adding custom callbacks easier. #126add_option("-n",{})to be edited later witheach#142get_subcommands,get_options; use empty filter{}to avoid filtering.get_groups()to get groups.get_option,set_results, andempty. #119lnameandsnamehave getters, addedconst get_parent. #120add_setwill now capture L-values for sets, allowing further modification. #113get_type_name(get_typeval).requiresin favor ofneeds(deprecated in last version). #112Backend and testing changes:
type_nameis now a lambda function; for sets, this reads the set live. #116app.reset()(andresetis nowclear). #141v1.5.4: Version 1.5.4: Optionals fixCompare Source
This version fixes the optional search in the single file version; some macros were not yet defined when it did the search. You can define the
CLI11_*_OPTIONALmacros to 0 if needed to eliminate the search.v1.5.3: Version 1.5.3: Compiler compatibilityCompare Source
This version fixes older AppleClang compilers by removing the optimization for casting. The minimum version of Boost Optional supported has been clarified to be 1.58. CUDA 7.0 NVCC is now supported.
v1.5.2: Version 1.5.2: LICENSE in single header modeCompare Source
This is a quick patch release that makes LICENSE part of the single header file, making it easier to include. Minor cleanup from codacy. No significant code changes from 1.5.1.
v1.5.1: Version 1.5.1: AccessCompare Source
This patch release adds better access to the App progromatically, to assist with writing custom converters to other formats. It also improves the help output, and uses a new feature in CLI11 1.5 to fix an old "quirk" in the way unlimited options and positionals interact.
get_optionsandget_descriptionto App #105(REQUIRED)for required options #104v1.5.0: Version 1.5: OptionalsCompare Source
This version introduced support for optionals, along with clarification and examples of custom conversion overloads. Enums now have been dropped from the automatic conversion system, allowing explicit protection for out-of-range ints (or a completely custom conversion). This version has some internal cleanup and improved support for the newest compilers. Several bugs were fixed, as well.
Note: This is the final release with
requires, please switch toneeds.std::optional,std::experimental::optional, andboost::optionaladded if__has_includeis supported #95CLI11_instead of justCLI_#95--now is removed when it ends unlimited arguments #100Other, non-user facing changes:
Macros.hppwith better C++ mode discovery #95v1.4.0: Version 1.4: More feedbackCompare Source
This version adds lots of smaller fixes and additions after the refactor in version 1.3. More ways to download and use CLI11 in CMake have been added. INI files have improved support.
get_parent()to access the parent from a subcommandExistingPathvalidator #73app.allow_ini_extras()added to allow extras in INI files #70config_to_str#66requirestoneedsto avoid C++20 keyword #75, #82find_package#83, #84ToruNiina/toml11 (ToruNiina/toml11)
v3.8.1: version 3.8.1Compare Source
Fixed
strerror_xvariants intoml::parse(FILE*)overload (#235)v3.8.0: version 3.8.0Compare Source
Fixed
std::string(#189) (by @muggenhor)CMAKE_CXX_STANDARDin CMakeLists (#202)strerror_ron macos (#231, #233) (by @Esonhugh)Added
[error]prefix (#187) (by @ken-matsui)Changed
strerror, instead ofstd(#226)v3.7.1: version 3.7.1Compare Source
Fixed
Fixed many corner-cases.
notin README by!(#172) (@estshorter)d99kris/rapidcsv (d99kris/rapidcsv)
v8.90Compare Source
v8.89Compare Source
v8.88Compare Source
v8.87Compare Source
v8.85Compare Source
v8.84Compare Source
v8.83Compare Source
gabime/spdlog (gabime/spdlog)
v1.17.0: Version 1.17.0Compare Source
%zformatter (UTC offset):+00:00when the formatter was configured to show UTC time.tm_gmtoff. If compilation fails on such platforms, useSPDLOG_NO_TZ_OFFSET=ON(%zwill display+??:??instead of compilation error).CMAKE_BUILD_TYPEonly in top-level project by @double-fault in #3480target_file_from private to protected by @fab4100 in #3486<fcntl.h>intcp_client.hto avoid compilation failures by @maordadush in #3497blocking_queueheader by @zanewong233 in #3504qt_sinks.hby @ssam18 in #3487Full Changelog: gabime/spdlog@v1.16.0...v1.17.0
Special thanks to @tt4g for assisting with community questions and issues.
v1.16.0: version 1.16.0Compare Source
Full Changelog: gabime/spdlog@v1.15.3...v1.16.0
Special thanks to @tt4g for assisting with community questions and issues.
v1.15.3: Version 1.15.3Compare Source
dup_filter_sinkwhen reporting skipped messages by @SleepingSoul in #3390max-sizeandmax-filesinrotating_file_sinkafter creation by @gabime in #3397spdlog::register_or_replace(new_logger)to safely replace existing loggers in the registry by @gabime in #3398Full Changelog: gabime/spdlog@v1.15.2...v1.15.3
Special thanks to @tt4g for assisting with community questions and issues.
v1.15.2: Version 1.15.2Compare Source
%Dformat flag, in #3361%z(UTC offset) on Apple and POSIX.1-2024-conforming platforms by @toh-ableton in #3366Full Changelog: gabime/spdlog@v1.15.1...v1.15.2
Special thanks to @tt4g for assisting with community questions and issues.
v1.15.1: Version 1.15.1Compare Source
fmtversion to 11.1.3 by @gabime in #3332fwrite_unlocked()if available by @gabime in #3276 and #3318rotating_file_sinkby @hjs-ast in #3269null_sinkfinalby @gabime in #3267fmt::andstd::to avoid ambiguous calls by @LiAuTraver in #3259/utf-8only when the compiler is MSVC by @miyanyan in #3260bin_to_hex()when usingstd::formatby @koniarik in #3315load_env_levelsby @ken-matsui in #3327rotate_now()by @matteodelseppia in #3281to_string_viewfunction forfmt11.1 by @chenrui333 in #3301to_string_viewoverload infmt >= 11.1by @jdrouhard in #3314string_view_literalsto resolve issues #3287 and #3233 by @yalov in #3291set_color_mode(..)inansicolor_sinkby @gabime in #3323daily_file_sinkby @F1F88 in #3249Full Changelog: gabime/spdlog@v1.15.0...v1.15.1
Special thanks to @tt4g for helping with community questions and issues
v1.15.0: Version 1.15.0Compare Source
What's Changed
FMT_ENFORCE_COMPILE_STRINGby @AJIOB in #3137/Zc:__cplusplusand/MPto MSVC only by @zjyhjqs in #3139Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.