Greetings,
For many years, PHP shipped with a bundled libgd as an alternative to the system version. The bundled libgd is a custom version of upstream, originally based on GD-2.0, and over time cherry-picked backports and customizations, such as custom memory allocators, have been made. Due to this divergence, it is difficult to assess exactly what the changes are in the bundled library compared to upstream, as diffing against any upstream branch or tag yields a massive diff with a lot of noise.
A proper resync with upstream has been due for a long time, and very needed, and I think it’s great that this is happening, but I have some concerns I would like to highlight, just to be on the safe side of things.
In the past few years, upstream libgd repository has seen very low activity, but recently development was restarted at a very fast pace, with a lot of new interesting features being added to master and several fixes to the stable branch.
Last week GH-22532 [1] was opened for php-src to “Sync bundled libgd to 2.4.0”.
Here is a quick recap on the upstream repository [2] at the time of writing:
libgd/GD-2.3:
- Last release 2.3.3, september 2011
- Activity until may 2026 (src/ only): 38 commits, 21 files changed, 179 insertions(+), 102 deletions(-)
- Activity since may 2026 (src/ only): 21 commits, 21 files changed, 1.234 insertions(+), 386 deletions(-)
libgd/master (GD-2.4):
- Never released
- Activity since may 2026 (src/ only): 68 commits, 136 files changed, 67.954 insertions(+), 47.472 deletions(-)
This is the statistics on the PR in php-src at the time of writing:
$ git diff --stat upstream/master…gh/22532 | tail -1
137 files changed, 142.451 insertions(+), 32.476 deletions(-)
Moreover, this is what i obtain by diffing the tip of the PR with the current libgd/master:
$ diff -ur libgd-src/src php-src/ext/gd/libgd | diffstat | tail -1
84 files changed, 93.108 insertions(+), 15.278 deletions(-)
I am NOT questioning the quality of the work, the new features in the library look very promising and they would be a great addition to PHP, but I have the following concerns I wanted to share:
- This code was introduced in the upstream repository less than a month ago, so it is relatively “young”
- libgd-2.4.0 was never released nor tagged, thus no major distros are shipping it
- PHP-8.6 already tagged alpha1, giving overall a short timespan to test the new bundled library
- Introducing features in ext/gd that exist only in libgd-2.4 would in fact force the bundled library as the only build option
Given the above, I’d like to hear people’s opinions on the matter. My concern is that hitting the PHP-8.6 timeline may end up forcing rushed decisions, and it would be preferable to wait for libgd-2.4.0 to have an actual upstream release, and to give time to a broader audience to test the new features before we commit to shipping them.
Kind regards
Giovanni Giacobbi
@thg2k
[1] https://github.com/php/php-src/pull/22532/
[2]
git log --oneline gd-2.3.3..53cb765b – src | wc -l
git diff --stat gd-2.3.3..53cb765b – src | tail -1
git log --oneline 53cb765b..GD-2.3 – src | wc -l
git diff --stat 53cb765b..GD-2.3 – src | tail -1
git log --oneline 185b1f56..master – src | wc -l
git diff --stat 185b1f56..master – src | tail -1
