[zlib] Update to 1.3.2

[dg0yt]

Continued from #50538 by @scschaefer.
Resolves #50060.
Closes #50843.

Downstream fixes as needed:

• to avoid the new ZLIB CMake config package when the actual use is ZLIB_LIBRARIES,
• to adapt to the new binary names on windows (z, zs) and to the debug suffix now on all platforms (d),
• to fix arbitary installation order bugs in the cone of destruction,
• to avoid a symbol name clash for crc32 with port elfutils.
  (The symbol was already there, maybe the signature changed a little bit. I don't know why it didn't occur earlier.)

serf got a little bit more work, to ensure that all three deps are handled in a consistent way and to not mix debug and release paths.

qt5-base[postgresqlplugin](windows & !static) was probably already broken with libpq 18.3 - it is not in the cone of destruction for libpq. It should be reviewed and tested with the fixes to libpq (separate PR).

[scschaefer]

Thank you, @dg0yt, for continuing the zlib-update! And once again sorry I couldn't continue working on the update. 😞

[BillyONeal]

Thank you so much! I'm sorry that the arm64-linux configuration has been such a thorn in everyone's side. This time it looks like it might be legitimate though :(

[dg0yt]

This time it looks like it might be legitimate though :(

I think it is a race, and I will just run CI again.

[dg0yt]

This time it looks like it might be legitimate though :(

I think it is a race, and I will just run CI again.

The ffmpeg situation (fftools/Makefile et al.) is like this Makefile:

first:
	$(MAKE) clean
	$(MAKE) build

clean:
	rm -Rf subdir

build: subdir/secondary-output

subdir/secondary-output: | subdir

subdir/secondary-output: subdir/primary-output
	cp subdir/primary-output subdir/secondary-output

subdir/primary-output:
	touch subdir/primary-output

subdir:
	sleep 2
	mkdir subdir

which even without concurrency produces

/tmp/foo$ LANG=C make
make clean
make[1]: Entering directory '/tmp/foo'
rm -Rf subdir
make[1]: Leaving directory '/tmp/foo'
make build
make[1]: Entering directory '/tmp/foo'
touch subdir/primary-output
touch: cannot touch 'subdir/primary-output': No such file or directory
make[1]: *** [Makefile:16: subdir/primary-output] Error 1
make[1]: Leaving directory '/tmp/foo'
make: *** [Makefile:3: first] Error 2

The secondary output (fftools/resources/graph.html.o) depends on the subdir (fftools/resources) and transitively on primary output (fftools/resources/graph.html.c from fftools/resources/graph.html.gz). Compiling the C source is depending on the subdir, but creating the primary outputs is independent.

A fix might apply the approach chosen for the first target, but it is out of scope for this PR.

[dg0yt]

All checks have passed. Use it or loose it.

[BillyONeal]

THANK YOU 1000%

[Neustradamus]

@dg0yt: Thanks for your work and thanks to @BillyONeal for merging!

It fixes the CVE-2026-27171:

• https://www.cvedetails.com/vulnerability-list/vendor_id-13265/product_id-111843/Zlib-Zlib.html

Linked to:

• [zlib] Update to v1.3.2. #50538
• [zlib] Update to 1.3.2. #50843
• [zlib] update to 1.3.2 #50060