On Wed, Jul 8, 2026 at 12:04 PM Giovanni Giacobbi <[email protected]> wrote:
> Greetings, > > For many years, PHP shipped with a bundled libgd as an alternative to the > system version. The bundled libgd is a custom version of upstream, > originally based on GD-2.0, and over time cherry-picked backports and > customizations, such as custom memory allocators, have been made. Due to > this divergence, it is difficult to assess exactly what the changes are in > the bundled library compared to upstream, as diffing against any upstream > branch or tag yields a massive diff with a lot of noise. > > A proper resync with upstream has been due for a long time, and very > needed, and I think it's great that this is happening, but I have some > concerns I would like to highlight, just to be on the safe side of things. > > In the past few years, upstream libgd repository has seen very low > activity, but recently development was restarted at a very fast pace, with > a lot of new interesting features being added to master and several fixes > to the stable branch. > > Last week GH-22532 [1] was opened for php-src to "Sync bundled libgd to > 2.4.0". > > Here is a quick recap on the upstream repository [2] at the time of > writing: > > libgd/GD-2.3: > - Last release 2.3.3, september 2011 > - Activity until may 2026 (src/ only): 38 commits, 21 files changed, 179 > insertions(+), 102 deletions(-) > - Activity since may 2026 (src/ only): 21 commits, 21 files changed, > 1.234 insertions(+), 386 deletions(-) > > libgd/master (GD-2.4): > - Never released > - Activity since may 2026 (src/ only): 68 commits, 136 files changed, > 67.954 insertions(+), 47.472 deletions(-) > > This is the statistics on the PR in php-src at the time of writing: > $ git diff --stat upstream/master...gh/22532 | tail -1 > 137 files changed, 142.451 insertions(+), 32.476 deletions(-) > > Moreover, this is what i obtain by diffing the tip of the PR with the > current libgd/master: > $ diff -ur libgd-src/src php-src/ext/gd/libgd | diffstat | tail -1 > 84 files changed, 93.108 insertions(+), 15.278 deletions(-) > > > I am NOT questioning the quality of the work, the new features in the > library look very promising and they would be a great addition to PHP, but > I have the following concerns I wanted to share: > > 1) This code was introduced in the upstream repository less than a month > ago, so it is relatively "young" > 2) libgd-2.4.0 was never released nor tagged, thus no major distros are > shipping it > 3) PHP-8.6 already tagged alpha1, giving overall a short timespan to test > the new bundled library > 4) Introducing features in ext/gd that exist only in libgd-2.4 would in > fact force the bundled library as the only build option > > Given the above, I'd like to hear people's opinions on the matter. My > concern is that hitting the PHP-8.6 timeline may end up forcing rushed > decisions, and it would be preferable to wait for libgd-2.4.0 to have an > actual upstream release, and to give time to a broader audience to test the > new features before we commit to shipping them. > > I don't see this as a problem. The update was long due and if we go early for 2.4, then both versions could stabilise in the same time. I think that syncing releases would be really great, then we could more easily follow 2.4 with fixes. Volker has also done a deep AI review which found some issues. Once all of those get addressed, it should be good enough for master merge IMHO. This should ideally happen before beta1 so it really depends if it's ready in time for that. Kind regards, Jakub
