Plan to upgrade third party dependencies

[dbarker]

Consider upgrading third_party_release and git submodules to the latest tags in install/cmake/third_party_latest.

current git tags in third_party_release:

abseil=20220623.2
zlib=v1.3.1
curl=curl-8_12_0
protobuf=v3.21.6
grpc=v1.49.2
benchmark=v1.8.3
googletest=v1.14.0
ms-gsl=v3.1.0
nlohmann-json=v3.12.0
opentelemetry-proto=v1.7.0
opentracing-cpp=v1.6.0
prometheus-cpp=v1.3.0

proposed git tags:

abseil=20240722.1
zlib=v1.3.1
curl=curl-8_14_1
protobuf=v6.30.2
grpc=v1.72.1
benchmark=v1.9.4
googletest=v1.17.0
ms-gsl=v4.2.0
nlohmann-json=v3.12.0
opentelemetry-proto=v1.7.0
opentracing-cpp=v1.6.0
prometheus-cpp=v1.3.0

[dbarker]

Rough plan to upgrade the versions in third_party_release to those in install/cmake/third_party_latest once CMake minimum version is bumped to 3.16.

• PR 1:
  • googletest to 1.17
  • benchmark to 1.9.4
• PR 2:
  • curl to 8.14.1
• PR 3:
  • abseil to 20240722.1
  • protobuf to 6.30.2
  • grpc to 1.72.1
• PR 4:
  • ms-gsl to 4.2.0

[dbarker]

Upgrading to these latest versions seems to also be dependent on bumping the minimum c++ version to CXX17. This will be blocked by #3121

[dbarker]

In the SIG meeting today we discussed the need to continue supporting C++14 for some time. This means we need to create a third-party dependency management strategy that supports upgrading to new versions while supporting old versions that can be built with C++14.

Notes from the discussion:

• We agreed Bazel builds should pull the latest dependency versions and CI Bazel testing jobs should be updated only test with C++17 and up.
• We said CMake builds should be tested with C++14, C++17 and up. The third-party release versions should be chosen based on the C++ version tested (if C++14 then pick the latest versions that can be built).
• We discussed the challenge posed by the git submodules. We would have to choose what version to set each submodule to and if we upgrade the submodules to latest versions then we cannot use them and test with C++14.
  • One option is to remove the git submodules (similar to the protobuf project - Delete repo's submodules protocolbuffers/protobuf#18873) and rely on FetchContent with git tags we set based on the C++ version.

In the short term it seems reasonable to upgrade the dependencies to the latest versions that can build with C++14. We can continue the discussion on how to support the latest versions in this ticket.