Update various library versions to meet the minimum required CMake version (>= 3.5) for compatibility with CMake 3.30.4.

[gigony]

This patch resolves the CMake errors caused by the minimum required CMake version (>= 3.5) when using CMake 3.30.4.

This patch upgrades fmt (7.0.1 -> 10.1.1), googletest (1.10.0 -> 1.16.0), cli11 (1.9.1 -> 2.5.0), json (3.9.1 -> 3.11.3), libjpeg-turbo (patch CMakeLists.txt), libopenjpeg(2.5.0 -> 2.5.3, patch CMakeLists.txt), libtiff(4.1.0 -> 4.5.0 -> 4.1.0, patch CMakeLists.txt), pugixml(1.11.1 -> 1.15), pybind11_json (0.2.9 -> 0.2.15), libcuckoo(patch CMakeLists.txt)

• https://github.com/rapidsai/cucim/actions/runs/14164457670/job/39675196646
• https://github.com/rapidsai/cucim/actions/runs/14164457670/job/39675194596

Cloning into 'deps-fmt-src'...
HEAD is now at f19b1a5 Update version
CMake Error at build-release/_deps/deps-fmt-src/CMakeLists.txt:1 (cmake_minimum_required):
  Compatibility with CMake < 3.5 has been removed from CMake.

  Update the VERSION argument <min> value.  Or, use the <min>...<max> syntax
  to tell CMake that the project requires at least <min> but has been updated
  to work with policies introduced by <max> or earlier.

  Or, add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to try configuring anyway.


-- Configuring incomplete, errors occurred!

Cloning into 'deps-googletest-src'...
HEAD is now at 703bd9c Googletest export
CMake Error at build-release/_deps/deps-googletest-src/CMakeLists.txt:4 (cmake_minimum_required):
  Compatibility with CMake < 3.5 has been removed from CMake.

  Update the VERSION argument <min> value.  Or, use the <min>...<max> syntax
  to tell CMake that the project requires at least <min> but has been updated
  to work with policies introduced by <max> or earlier.

  Or, add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to try configuring anyway.

Cloning into '/__w/cucim/cucim/build-release/_deps/deps-cli11-src/extern/googletest'...
Submodule path 'extern/googletest': checked out '859bfe8981d6724c4ea06e73d29accd8588f3230'
CMake Error at build-release/_deps/deps-cli11-src/CMakeLists.txt:1 (cmake_minimum_required):
  Compatibility with CMake < 3.5 has been removed from CMake.

  Update the VERSION argument <min> value.  Or, use the <min>...<max> syntax
  to tell CMake that the project requires at least <min> but has been updated
  to work with policies introduced by <max> or earlier.

  Or, add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to try configuring anyway.


-- Configuring incomplete, errors occurred!

CMake Error at build-release/_deps/deps-json-src/CMakeLists.txt:1 (cmake_minimum_required):
  Compatibility with CMake < 3.5 has been removed from CMake.

  Update the VERSION argument <min> value.  Or, use the <min>...<max> syntax
  to tell CMake that the project requires at least <min> but has been updated
  to work with policies introduced by <max> or earlier.

  Or, add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to try configuring anyway.

Note that libtiff should be kept at v4.1.0 to avoid build and test issues.

It’s possible that this is caused by the following PR and the CMake version upgrade:

• Require CMake 3.30.4 #834

[grlee77]

I had some question about whether all the patches are necessary. I see based on the chain of failed builds that it was not working without them, but wondered if there might be a more minimal fix. No problem with merging it as-is if you don't see another option, but was just wondering about how much extra work it might be to keep updating patches going forward.

[grlee77]

It seems since CMake 3.12 it has been possible to specify a range of versions for cmake_minimum_required and cmake_policy (docs page). Not sure if that is a better approach, but what I didn't understand is:

1.) Why does having a lower minimum for cmake_minimum_required cause the build problems? 3.30 is greater than 2.8.9 so it seems like it wouldn't cause a conflict.

2.) For set_policy, another option mentioned on that page is environment variable CMAKE_POLICY_VERSION_MINIMUM could override the policy.

I was wondering if we set that environment variable during the build if some of the patches could be removed?

[grlee77]

Oh, I see in that same docs page that it states:

Changed in version 3.27: Compatibility with versions of CMake older than 3.5 is deprecated. Calls to cmake_minimum_required(VERSION) or cmake_policy(VERSION) that do not specify at least 3.5 as their policy version (optionally via ...) will produce a deprecation warning in CMake 3.27 and above.

So it seems ideally upstream projects would add some maximum version like

cmake_minimum_required(2.8.9...3.30.0)

but unless that is implemented upstream we will still need some patch.

Maybe just check whether setting CMAKE_POLICY_VERSION_MINIMUM allows removing some of the patches?

[gigony]

Thanks @grlee77 for the investigation and suggestion!

Maybe just check whether setting CMAKE_POLICY_VERSION_MINIMUM allows removing some of the patches?

Indeed, setting it could eliminate the need for some of the patches.
According to the manual (https://cmake.org/cmake/help/latest/variable/CMAKE_POLICY_VERSION_MINIMUM.html),

This variable should not be set by a project in CMake code as a way to set its own policy version. Use cmake_minimum_required(VERSION) and/or cmake_policy(VERSION) for that. This variable is meant to externally set policies for which a project has not itself been updated:

This variable needs to be set by an external command, and something like the following could bypass the error:

--- a/run
+++ b/run
@@ -281,7 +281,8 @@ build_local_libcucim_() {
         -DCMAKE_EXPORT_COMPILE_COMMANDS:BOOL=TRUE \
         -DCMAKE_PREFIX_PATH=${prefix} \
         -DCMAKE_BUILD_TYPE=${build_type_str} \
-        -DCMAKE_INSTALL_PREFIX=${source_folder}/install
+        -DCMAKE_INSTALL_PREFIX=${source_folder}/install \
+        -DCMAKE_POLICY_VERSION_MINIMUM=3.30.0
     ${CMAKE_CMD} --build ${build_folder} --config ${build_type_str} --target cucim -- -j $(nproc)
     ${CMAKE_CMD} --build ${build_folder} --config ${build_type_str} --target install -- -j $(nproc)

Projects may set this variable before a call to add_subdirectory() that adds a third-party project in order to set its policy version without modifying third-party code.

I couldn't find a proper way to set the variable for FetchContent_MakeAvailable() method (in such as 'cpp/cmake/deps/libcuckoo.cmake').

I am afraid that setting CMAKE_POLICY_VERSION_MINIMUM in the build command could make the following change meaningless:

• Require CMake 3.30.4 #834

Unless the API is broken or the update requires significant code changes, I believe updating libraries is beneficial from a security standpoint and for future work. I think resolving the minimum requirement issue by upgrading the versions is a reasonable approach, and I'd prefer to keep the current PR as is.

[gigony]

Hi @bdice, could you please help review (and possibly merge) this PR?

[bdice]

I am okay with these changes. I asked @KyleFromNVIDIA to take a second look, since there are a lot of CMake updates, and there may be a better way to structure the patches. If he's happy, let's merge.

[KyleFromNVIDIA]

Shouldn't we be generating this with rapids_cpm_generate_patch_command()?

[bdice]

cuCIM doesn't really use rapids-cmake today. I think that is the right idea, but there's a lot of effort needed to get cuCIM onto rapids-cmake.

[gigony]

Thanks @KyleFromNVIDIA and @bdice!
Yes, currently cuCIM doesn't follow the standard RAPIDS build setup, but I’m planning to transition to a rapids-cmake and conda-package-based build setup in the near future.

• [FEA] Refactor the build system to adopt rapids-cmake #859
• Devendor CMake dependencies #686
  • De-vendor CMake dependencies and use shared libraries #753

[KyleFromNVIDIA]

Shouldn't we be generating this with rapids_cpm_generate_patch_command()?

[gigony]

Thanks @KyleFromNVIDIA

Created the follow-up issue:

• [FEA] Refactor the build system to adopt rapids-cmake #859

[KyleFromNVIDIA]

Shouldn't we be generating this with rapids_cpm_generate_patch_command()?

[gigony]

Thanks @KyleFromNVIDIA

Created the follow-up issue:

• [FEA] Refactor the build system to adopt rapids-cmake #859

[KyleFromNVIDIA]

By setting cmake_minimum_required() to 3.30.0, all of this is redundant. It sets the policy level to 3.30.0, which includes setting CMP0020 to NEW.

[gigony]

Thank

By setting cmake_minimum_required() to 3.30.0, all of this is redundant. It sets the policy level to 3.30.0, which includes setting CMP0020 to NEW.

Thanks @KyleFromNVIDIA for the information and feedback!

Let me also patch those redundant lines.

[gigony]

Just updated. Thank you!

[KyleFromNVIDIA]

cmake_policy() is also redundant, because cmake_minimum_required() already set it above.

[gigony]

Thanks @KyleFromNVIDIA !
Updated.

[grlee77]

Thanks @gigony for the feature and @bdice and @KyleFromNVIDIA for reviewing

[grlee77]

/merge