Issue #20523 has been reported by MSP-Greg (Greg L). ---------------------------------------- Misc #20523: mswin and MSFT/vcpkg https://bugs.ruby-lang.org/issues/20523 * Author: MSP-Greg (Greg L) * Status: Open ---------------------------------------- Currently the `windows.yml`workflow caches MSFT/vcpkg packages and the `vcpkg.json` file locks the vcpkg repo to an older commit. This results in the following package versions being used: ``` Package Ruby CI Current vcpkg libffi 3.4.4#1 3.4.6 libyaml 0.2.5#4 0.2.5#4 openssl 3.1.1 3.3.0#1 readline 0#4 0#5 readline-win32 na 5.0#8 zlib 1.2.13 1.3.1 ``` Note the updated versions of libffi, openssl, and zlib. There seems to be a concern about using packages from vcpkg’s master branch (see [PR #10907](https://github.com/ruby/ruby/pull/10907)). Ruby-loco’s mswin build has been running for almost 5 years, and many of the extension gems that are part of the std-lib use vcpkg master branch packages in their CI. I don’t recall any significant issues with vcpkg. Depending on the OS, current dependency package versions are often not available. Ruby’s package dependencies are not part of the Windows OS, and MSYS2 and vcpkg normally upgrade packages when they’ve been verified to work with all packages that depend on them. Hence, Windows CI in Ruby master is an opportunity to check master against the most recent versions of its dependencies. I would like to propose that either: 1. vcpkg’s commit is updated more frequently to use current package 2. vcpkg master branch is used -- https://bugs.ruby-lang.org/