Vendored projects are very out of date

[dvzrv]

Hi! I package sfizz for Arch Linux.

We usually try to build using our system provided libraries as bundling is problematic. This is also the case for header only things such as lv2 and vst3sdk.
Unfortunately sfizz carries very old versions of both by now and it would be great if they would be kept in sync with upstream releases.

From a distribution perspective it would be great if:

• the project would detect system-wide provided libraries with higher priority than the bundled ones.
• Update the bundled dependencies.
• Additionally, it would be great to have a bot automatically bump the versions of the dependencies, so that they can be automatically integration tested by CI.

[dvzrv]

One outcome of this is, that sfizz can not be built with current vst3sdk: steinbergmedia/vst3_public_sdk#41

[paulfd]

The reason I pinned vstgui at the time was that it lead to deeply corrupted output on Linux. Since 4.11 was still new, I figured maybe the implementation did not see so much Linux exposure yet. Then life caught on. I'll see if it's resolved as soon as I can.

[redtide]

Also Abseil seems a bit problematic to update on sfizz side, see sfztools/sfizz#1154. Though it builds fine when using C++17 (VST3 requires it). Anyway you can already build using all the required system libraries with new additional CMake options added in sfztools/sfizz#1145. I tested also with the current Arch vst3sdk version and the latest; some random crashes when removing and re-adding the VST3 plugin in Carla, plus there are some patches to apply because some other unresolved issues.

[redtide]

• Additionally, it would be great to have a bot automatically bump the versions of the dependencies, so that they can be automatically integration tested by CI.

I hope CPM will be the right tool to handle it, but this will take a while.

[redtide]

Closing: the last missing update was merged in #1169.

A last thing:

the project would detect system-wide provided libraries with higher priority than the bundled ones.

I'm not sure about this with all the Linux/BSD distro and other platforms. I hope it's not a problem to let this as a manual task for users and packagers; possibly this might change in future, but any dependency could be problematic at any time for any reason, otherwise bundled libraries might not be there.