Re: Concerns about syncing bundled libgd to upstream 2.4 (GH-22532)

On Wed, 8 Jul 2026 at 11:01, Giovanni Giacobbi <giovanni@giacobbi.net> wrote: > > Greetings, > > For many years, PHP shipped with a bundled libgd as an alternative to the system version. The > bundled libgd is a custom version of upstream, originally based on GD-2.0, and over time > cherry-picked backports and customizations, such as custom memory allocators, have been made. Due to > this divergence, it is difficult to assess exactly what the changes are in the bundled library > compared to upstream, as diffing against any upstream branch or tag yields a massive diff with a lot > of noise. > > A proper resync with upstream has been due for a long time, and very needed, and I think > it's great that this is happening, but I have some concerns I would like to highlight, just to > be on the safe side of things. > > In the past few years, upstream libgd repository has seen very low activity, but recently > development was restarted at a very fast pace, with a lot of new interesting features being added to > master and several fixes to the stable branch. > > Last week GH-22532 [1] was opened for php-src to "Sync bundled libgd to 2..4.0". > > Here is a quick recap on the upstream repository [2] at the time of writing: > > libgd/GD-2.3: > - Last release 2.3.3, september 2011 > - Activity until may 2026 (src/ only): 38 commits, 21 files changed, 179 insertions(+), 102 > deletions(-) > - Activity since may 2026 (src/ only): 21 commits, 21 files changed, 1.234 insertions(+), 386 > deletions(-) > > libgd/master (GD-2.4): > - Never released > - Activity since may 2026 (src/ only): 68 commits, 136 files changed, 67..954 insertions(+), > 47.472 deletions(-) > > This is the statistics on the PR in php-src at the time of writing: > $ git diff --stat upstream/master...gh/22532 | tail -1 > 137 files changed, 142.451 insertions(+), 32.476 deletions(-) > > Moreover, this is what i obtain by diffing the tip of the PR with the current libgd/master: > $ diff -ur libgd-src/src php-src/ext/gd/libgd | diffstat | tail -1 > 84 files changed, 93.108 insertions(+), 15.278 deletions(-) > > > I am NOT questioning the quality of the work, the new features in the library look very > promising and they would be a great addition to PHP, but I have the following concerns I wanted to > share: > > 1) This code was introduced in the upstream repository less than a month ago, so it is > relatively "young" > 2) libgd-2.4.0 was never released nor tagged, thus no major distros are shipping it > 3) PHP-8.6 already tagged alpha1, giving overall a short timespan to test the new bundled > library > 4) Introducing features in ext/gd that exist only in libgd-2.4 would in fact force the bundled > library as the only build option > > Given the above, I'd like to hear people's opinions on the matter. My concern is that > hitting the PHP-8.6 timeline may end up forcing rushed decisions, and it would be preferable to wait > for libgd-2.4.0 to have an actual upstream release, and to give time to a broader audience to test > the new features before we commit to shipping them. > > Kind regards > Giovanni Giacobbi > @thg2k > > > [1] https://github.com/php/php-src/pull/22532/ > > [2] > git log --oneline gd-2.3.3..53cb765b -- src | wc -l > git diff --stat gd-2.3.3..53cb765b -- src | tail -1 > > git log --oneline 53cb765b..GD-2.3 -- src | wc -l > git diff --stat 53cb765b..GD-2.3 -- src | tail -1 > > git log --oneline 185b1f56..master -- src | wc -l > git diff --stat 185b1f56..master -- src | tail -1 > I think it's too late in PHP 8.6 to merge it now. I also don't see any need to rush things. Just wait until libgd 2.4 is released and merge the changes into the next PHP version.