[release/7.0-staging] Zlib: Update zlib to v1.2.13, intel-zlib to v1.2.13_jtk #89517
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Tagging subscribers to this area: @dotnet/area-infrastructure-libraries Issue DetailsBackport of #84602 to release/7.0-staging Customer ImpactTestingRiskIMPORTANT: If this backport is for a servicing release, please verify that:
|
carlossanlop
added
area-System.IO.Compression
and removed
area-Infrastructure-libraries
labels
|
Tagging subscribers to this area: @dotnet/area-system-io-compression Issue DetailsBackport of #84602 to release/7.0-staging Customer ImpactTestingRiskIMPORTANT: If this backport is for a servicing release, please verify that:
|
GrabYourPitchforks
added
the
Servicing-consider
carlossanlop
removed
the
Servicing-consider
|
Please add the servicing-consider label once you fill out the template. |
carlossanlop
added
the
Servicing-consider
carlossanlop
added
Servicing-approved
ghost
locked as resolved and limited conversation to collaborators
Backport of #84602 to release/7.0-staging
/cc @GrabYourPitchforks
Customer Impact
We're getting reports of compliance tooling flagging our distribution of zlib. (And we've gotten flagged internally by Component Governance on this.) While there are no current CVEs affecting how we use zlib, upgrading to the latest version will silence these alerts and restore the compliance status.
Testing
We have a full suite of unit tests and performance tests. Additionally, this change has been baking in the 8.0 preview branches for several months. No regressions have yet been reported.
Risk
Medium-low. Servicing a dependency always carries the risk of introducing new bugs. However, skimming through https://github.com/madler/zlib/commits/develop, I don't see any recent changes which indicate that 1.2.13 introduces serious bugs that needed addressing.
IMPORTANT: If this backport is for a servicing release, please verify that:
The PR target branch is
release/X.0-staging, notrelease/X.0.If the change touches code that ships in a NuGet package, you have added the necessary package authoring and gotten it explicitly reviewed.