feat: SG-42145: Common dependency updates (aja, atomic_ops, gc, openjph, pcre2 and spdlog)

[mcoliver]

Summarize your change.

Created a script to check common dependencies against their most recent releases. Useful for seeing if there are updates to dependency packages. I used that script to identify a few that were behind on bug fixes, security updates, and features. None are breaking changes.

Describe the reason for the change.

There were quite a few dependencies that were running old versions. Newer versions fix bugs and security issues along with exposing new features that can be harnessed for future performance optimizations and feature extensions.

Fixes:
#1096
#1097
#1098
#1099
#1100
#1102
#1103
#1104
#1106
#1108
#1105
#1110
#1111

Describe what you have tested and on which operating system.

builds locally. Will monitor CICD on the PR. Tested various images and videos affected by the packages that were updated with success (jpeg, webp, png, libraw, etc..)

Add a list of changes, and note any that might need special attention during the review.

I linked out to each changelog and commit diff for the various dependencies. I made a best effort to ensure there are no breaking changes and stuck to minor version updates.

One thing to note: Libraw does deprecate some older cameras but also adds support for a bunch of new ones along with other new features. Feels like a worthwhile tradeoff but should be noted. https://github.com/LibRaw/LibRaw/blob/d20315b6e7b0162d3b0d7820dcbaf4de716b3e77/Changelog.txt#L50

If possible, provide screenshots.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: mcoliver / name: Michael Oliver (0cd056c, 36a1c2f, bb67e83, cfa719b, dadd8d0)

[mcoliver]

pre-commit.ci autofix

[mcoliver]

@cedrik-fuoco-adsk apologies for all the ci/cd build runs to iron out the kinks. Setting up all the dev envs to build locally is not possible for me at the moment. I just pushed the last one that should fix the debug windows build name for openjph. That should be the last one

[mcoliver]

@cedrik-fuoco-adsk would it be helpful for me to break this into separate PR's per dependency? I know it's a lot of upgrades all at once.

[cedrik-fuoco-adsk]

I think it's ok @mcoliver. They all do different things. Having a single build with everything should help with the testing. The two main one that really need testing are AJA and OIIO.

[Copilot]

Pull request overview

This PR updates several third-party dependency versions used by the CMake dependency build system and adds a helper script to compare the pinned versions in CYCOMMON.cmake against upstream Git tags.

Changes:

• Bump multiple common dependency versions/hashes in cmake/defaults/CYCOMMON.cmake (e.g., spdlog, pcre2, gc, openjpeg/openjph, libpng, libraw, webp, dav1d, etc.).
• Adjust several dependency build recipes (download artifacts switched to .tar.gz in a few places; OpenJPH naming updated for Debug postfix handling; Windows /utf-8 flags added for spdlog/OIIO).
• Add check_dependency_versions.py to scan CYCOMMON.cmake and report latest upstream tags.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
cmake/dependencies/spdlog.cmake	Switch spdlog download to tarball; add Windows UTF-8 compile flag handling.
cmake/dependencies/pcre2.cmake	Switch PCRE2 download artifact from zip to tarball.
cmake/dependencies/openjph.cmake	Update OpenJPH library naming for Debug postfix (notably on Windows).
cmake/dependencies/oiio.cmake	Add Windows UTF-8 compile flag handling for OIIO consumers/build.
cmake/dependencies/gc.cmake	Switch bdwgc download artifact from zip to tarball.
cmake/dependencies/atomic_ops.cmake	Update atomic_ops download URL to tagged release under bdwgc repo.
cmake/dependencies/aja.cmake	Adjust Windows Debug naming selection and force mbedtls runtime setting in Debug.
cmake/defaults/CYCOMMON.cmake	Central version/hash bumps for common dependencies.
check_dependency_versions.py	New script to compare pinned dependency versions vs latest upstream tags.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Passing -DCMAKE_CXX_FLAGS=/utf-8 on the CMake command line hard-sets the cache value for CMAKE_CXX_FLAGS inside the ExternalProject, which can override toolchain-provided flags (and any existing CMAKE_CXX_FLAGS content). Prefer adding /utf-8 via target compile options in that project (or appending to the existing flags, e.g. including the prior value) rather than replacing the whole variable.

Suggested change

	LIST(APPEND _configure_options "-DCMAKE_CXX_FLAGS=/utf-8")
	LIST(APPEND _configure_options "-DCMAKE_CXX_FLAGS=${CMAKE_CXX_FLAGS} /utf-8")

[Copilot]

On Windows this overrides _libname (which RV_COPY_LIB_BIN_FOLDERS() expects to be the DLL name for staging) with the import library name ending in .lib. That will make the stage target depend on ${RV_STAGE_BIN_DIR}/${_libname} where _libname is now a .lib that lives in ${_lib_dir}, causing staging/build failures. Keep _libname as the DLL name from RV_MAKE_STANDARD_LIB_NAME, and instead override _implibname/_implibpath (or use a separate variable) for the import library.

[Copilot]

Passing -DCMAKE_CXX_FLAGS=/utf-8 on the CMake command line hard-sets the cache value for CMAKE_CXX_FLAGS inside the ExternalProject, which can override toolchain-provided flags (and any existing CMAKE_CXX_FLAGS content). Prefer adding /utf-8 via target compile options in that project (or appending to the existing flags, e.g. including the prior value) rather than replacing the whole variable.

Suggested change

	LIST(APPEND _configure_options "-DCMAKE_CXX_FLAGS=/utf-8")
	LIST(APPEND _configure_options "-DCMAKE_CXX_FLAGS=${CMAKE_CXX_FLAGS} /utf-8")

[cedrik-fuoco-adsk]

Hi @mcoliver,

Do you mind splitting libpng in other PR?

We would like to merge libpng faster because the new version fixes a CVE.
If you don't have time, I can create another PR for libpng.