From aa2a7cc3f3a32c424385fa0e0adb4b66602f048d Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Mon, 2 Mar 2026 13:09:47 +0800
Subject: [PATCH 01/24] Bump dependencies to latest versions for CVEs

---
 vcpkg      |  2 +-
 vcpkg.json | 33 +++++++++++++--------------------
 2 files changed, 14 insertions(+), 21 deletions(-)

diff --git a/vcpkg b/vcpkg
index 0d9d4684..62159a45 160000
--- a/vcpkg
+++ b/vcpkg
@@ -1 +1 @@
-Subproject commit 0d9d4684352ba8de70bdf251c6fc9a3c464fa12b
+Subproject commit 62159a45e18f3a9ac0548628dcaf74fcb60c6ff9
diff --git a/vcpkg.json b/vcpkg.json
index 5c40c19e..d69f4774 100644
--- a/vcpkg.json
+++ b/vcpkg.json
@@ -1,8 +1,7 @@
 {
   "name": "pulsar-cpp",
-  "version": "3.8.0",
+  "version": "4.1.0",
   "description": "Pulsar C++ SDK",
-  "builtin-baseline": "d6995a0cf3cafda5e9e52749fad075dd62bfd90c",
   "dependencies": [
     {
       "name": "asio",
@@ -13,15 +12,15 @@
     },
     {
       "name": "boost-accumulators",
-      "version>=": "1.88.0"
+      "version>=": "1.90.0#1"
     },
     {
       "name": "boost-format",
-      "version>=": "1.88.0"
+      "version>=": "1.90.0#1"
     },
     {
       "name": "boost-property-tree",
-      "version>=": "1.88.0"
+      "version>=": "1.90.0#1"
     },
     {
       "name": "curl",
@@ -29,7 +28,7 @@
       "features": [
         "openssl"
       ],
-      "version>=": "8.13.0#1"
+      "version>=": "8.18.0#1"
     },
     {
       "name": "dlfcn-win32",
@@ -37,15 +36,15 @@
     },
     {
       "name": "openssl",
-      "version>=": "3.5.0"
+      "version>=": "3.6.1"
     },
     {
       "name": "protobuf",
-      "version>=": "3.21.12"
+      "version>=": "6.33.4#1"
     },
     {
       "name": "snappy",
-      "version>=": "1.1.10"
+      "version>=": "1.2.2"
     },
     {
       "name": "zlib",
@@ -53,7 +52,7 @@
     },
     {
       "name": "zstd",
-      "version>=": "1.5.5"
+      "version>=": "1.5.7"
     }
   ],
   "features": {
@@ -62,7 +61,7 @@
       "dependencies": [
         {
           "name": "boost-asio",
-          "version>=": "1.88.0"
+          "version>=": "1.90.0#1"
         }
       ]
     },
@@ -71,7 +70,7 @@
       "dependencies": [
         {
           "name": "boost-program-options",
-          "version>=": "1.88.0"
+          "version>=": "1.90.0#1"
         }
       ]
     },
@@ -80,15 +79,9 @@
       "dependencies": [
         {
           "name": "gtest",
-          "version>=": "1.14.0"
+          "version>=": "1.17.0"
         }
       ]
     }
-  },
-  "overrides": [
-    {
-      "name": "protobuf",
-      "version": "3.21.12"
-    }
-  ]
+  }
 }

From b628011b4c990caa85cb3f2bb7089c4d4a743cc2 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Mon, 2 Mar 2026 13:24:43 +0800
Subject: [PATCH 02/24] add back builtin-baseline

---
 vcpkg.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/vcpkg.json b/vcpkg.json
index d69f4774..3452492d 100644
--- a/vcpkg.json
+++ b/vcpkg.json
@@ -2,6 +2,7 @@
   "name": "pulsar-cpp",
   "version": "4.1.0",
   "description": "Pulsar C++ SDK",
+  "builtin-baseline": "62159a45e18f3a9ac0548628dcaf74fcb60c6ff9",
   "dependencies": [
     {
       "name": "asio",

From 8ed48d3fc3212cd9b634a729d3d126ff6acbe0b4 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Mon, 2 Mar 2026 14:04:06 +0800
Subject: [PATCH 03/24] fix ubuntu build

---
 lib/MessageBuilder.cc | 6 +++---
 lib/MessageImpl.cc    | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/MessageBuilder.cc b/lib/MessageBuilder.cc
index ae56d104..a9e61d47 100644
--- a/lib/MessageBuilder.cc
+++ b/lib/MessageBuilder.cc
@@ -149,11 +149,11 @@ MessageBuilder& MessageBuilder::setReplicationClusters(const std::vector<std::st
 
 MessageBuilder& MessageBuilder::disableReplication(bool flag) {
     checkMetadata();
-    google::protobuf::RepeatedPtrField<std::string> r;
+    google::protobuf::RepeatedPtrField<std::string>* replicateTo = impl_->metadata.mutable_replicate_to();
+    replicateTo->Clear();
     if (flag) {
-        r.AddAllocated(new std::string("__local__"));
+        replicateTo->Add("__local__");
     }
-    r.Swap(impl_->metadata.mutable_replicate_to());
     return *this;
 }
 
diff --git a/lib/MessageImpl.cc b/lib/MessageImpl.cc
index 17239a82..cfc573a7 100644
--- a/lib/MessageImpl.cc
+++ b/lib/MessageImpl.cc
@@ -61,11 +61,11 @@ void MessageImpl::setReplicationClusters(const std::vector<std::string>& cluster
 }
 
 void MessageImpl::disableReplication(bool flag) {
-    google::protobuf::RepeatedPtrField<std::string> r;
+    google::protobuf::RepeatedPtrField<std::string>* replicateTo = metadata.mutable_replicate_to();
+    replicateTo->Clear();
     if (flag) {
-        r.AddAllocated(new std::string("__local__"));
+        replicateTo->Add("__local__");
     }
-    r.Swap(metadata.mutable_replicate_to());
 }
 
 void MessageImpl::setProperty(const std::string& name, const std::string& value) {

From 972649bd7b70e9b99e52f568fd1d99d5ce8bdd37 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Mon, 2 Mar 2026 15:32:51 +0800
Subject: [PATCH 04/24] update curl patch on macOS

---
 pkg/mac/vcpkg-curl-patch.diff | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkg/mac/vcpkg-curl-patch.diff b/pkg/mac/vcpkg-curl-patch.diff
index c932fee6..4f1e7cd3 100644
--- a/pkg/mac/vcpkg-curl-patch.diff
+++ b/pkg/mac/vcpkg-curl-patch.diff
@@ -1,11 +1,11 @@
 diff --git a/ports/curl/portfile.cmake b/ports/curl/portfile.cmake
-index 427bccb217..ddfd75d30f 100644
+index 4cd5508188..78409fcdd7 100644
 --- a/ports/curl/portfile.cmake
 +++ b/ports/curl/portfile.cmake
-@@ -62,6 +62,10 @@ if(VCPKG_TARGET_IS_WINDOWS)
+@@ -73,6 +73,10 @@ if(VCPKG_TARGET_IS_WINDOWS)
      list(APPEND OPTIONS -DENABLE_UNICODE=ON)
  endif()
- 
+
 +if(VCPKG_TARGET_IS_OSX)
 +    list(APPEND OPTIONS -DENABLE_IPV6=OFF)
 +endif()
@@ -14,13 +14,13 @@ index 427bccb217..ddfd75d30f 100644
 
  vcpkg_cmake_configure(
 diff --git a/ports/curl/vcpkg.json b/ports/curl/vcpkg.json
-index 31955859d0..50e619b846 100644
+index 8a5a9188c6..ec7bc43dc1 100644
 --- a/ports/curl/vcpkg.json
 +++ b/ports/curl/vcpkg.json
 @@ -1,7 +1,7 @@
  {
    "name": "curl",
-   "version": "8.13.0",
+   "version": "8.18.0",
 -  "port-version": 1,
 +  "port-version": 2,
    "description": "A library for transferring data with URLs",

From 7277b030f197c7bc5ae7983f4767f071c459e742 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Mon, 2 Mar 2026 16:22:28 +0800
Subject: [PATCH 05/24] fix ci

---
 .github/workflows/ci-pr-validation.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-pr-validation.yaml b/.github/workflows/ci-pr-validation.yaml
index 29026e6c..6801a55d 100644
--- a/.github/workflows/ci-pr-validation.yaml
+++ b/.github/workflows/ci-pr-validation.yaml
@@ -154,8 +154,8 @@ jobs:
 
       - name: Verify custom vcpkg installation
         run: |
-          mv vcpkg /tmp/
-          cmake -B build-2 -DINTEGRATE_VCPKG=ON -DCMAKE_TOOLCHAIN_FILE="/tmp/vcpkg/scripts/buildsystems/vcpkg.cmake"
+          mv vcpkg /tmp/vcpkg-custom
+          cmake -B build-2 -DINTEGRATE_VCPKG=ON -DCMAKE_TOOLCHAIN_FILE="/tmp/vcpkg-custom/scripts/buildsystems/vcpkg.cmake"
 
   cpp20-build:
     name: Build with the C++20 standard

From acc923e5b9133ab1c4fbc06b6b8e33e2f1fb0e3e Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Mon, 2 Mar 2026 18:58:54 +0800
Subject: [PATCH 06/24] remove curl patch for vcpkg and link to apple
 frameworks

---
 pkg/mac/build-static-library.sh | 19 ++-----------------
 pkg/mac/vcpkg-curl-patch.diff   | 28 ----------------------------
 2 files changed, 2 insertions(+), 45 deletions(-)
 delete mode 100644 pkg/mac/vcpkg-curl-patch.diff

diff --git a/pkg/mac/build-static-library.sh b/pkg/mac/build-static-library.sh
index 9190b860..12094672 100755
--- a/pkg/mac/build-static-library.sh
+++ b/pkg/mac/build-static-library.sh
@@ -34,22 +34,6 @@ else
     exit 1
 fi
 
-# Apply the patch to support building libcurl with IPv6 disabled
-COMMIT_ID=$(grep "builtin-baseline" vcpkg.json | sed 's/"//g' | sed 's/,//' | awk '{print $2}')
-cd vcpkg
-git reset --hard $COMMIT_ID
-git apply ../pkg/mac/vcpkg-curl-patch.diff
-git add ports/curl
-git commit -m "Disable IPv6 for macOS in curl"
-./bootstrap-vcpkg.sh
-./vcpkg x-add-version --all
-git add versions/
-git commit -m "Update version"
-COMMIT_ID=$(git log --pretty=oneline | head -n 1 | awk '{print $1}')
-cd ..
-sed -i.bak "s/.*builtin-baseline.*/  \"builtin-baseline\": \"$COMMIT_ID\",/" vcpkg.json
-sed -i.bak "s/\"version>=\": \"8\.13\.0#1\"/\"version>=\": \"8.13.0#2\"/" vcpkg.json
-
 INSTALL_DIR=$PWD/pkg/mac/.install
 set -x
 cmake -B build-osx \
@@ -72,5 +56,6 @@ cp ./build-osx/libpulsarwithdeps.a $INSTALL_DIR/lib/
 # Test the libraries
 clang++ win-examples/example.cc -o dynamic.out -std=c++17 -arch $ARCH -I $INSTALL_DIR/include -L $INSTALL_DIR/lib -Wl,-rpath $INSTALL_DIR/lib -lpulsar
 ./dynamic.out
-clang++ win-examples/example.cc -o static.out -std=c++17 -arch $ARCH -I $INSTALL_DIR/include $INSTALL_DIR/lib/libpulsarwithdeps.a
+clang++ win-examples/example.cc -o static.out -std=c++17 -arch $ARCH -I $INSTALL_DIR/include $INSTALL_DIR/lib/libpulsarwithdeps.a \
+    -framework CoreFoundation -framework SystemConfiguration
 ./static.out
diff --git a/pkg/mac/vcpkg-curl-patch.diff b/pkg/mac/vcpkg-curl-patch.diff
deleted file mode 100644
index 4f1e7cd3..00000000
--- a/pkg/mac/vcpkg-curl-patch.diff
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/ports/curl/portfile.cmake b/ports/curl/portfile.cmake
-index 4cd5508188..78409fcdd7 100644
---- a/ports/curl/portfile.cmake
-+++ b/ports/curl/portfile.cmake
-@@ -73,6 +73,10 @@ if(VCPKG_TARGET_IS_WINDOWS)
-     list(APPEND OPTIONS -DENABLE_UNICODE=ON)
- endif()
-
-+if(VCPKG_TARGET_IS_OSX)
-+    list(APPEND OPTIONS -DENABLE_IPV6=OFF)
-+endif()
-+
- vcpkg_find_acquire_program(PKGCONFIG)
-
- vcpkg_cmake_configure(
-diff --git a/ports/curl/vcpkg.json b/ports/curl/vcpkg.json
-index 8a5a9188c6..ec7bc43dc1 100644
---- a/ports/curl/vcpkg.json
-+++ b/ports/curl/vcpkg.json
-@@ -1,7 +1,7 @@
- {
-   "name": "curl",
-   "version": "8.18.0",
--  "port-version": 1,
-+  "port-version": 2,
-   "description": "A library for transferring data with URLs",
-   "homepage": "https://curl.se/",
-   "license": "curl AND ISC AND BSD-3-Clause",

From 3280acad76f279f6f49db1f32a46cc05b836e652 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Mon, 2 Mar 2026 20:23:42 +0800
Subject: [PATCH 07/24] fix possible NSInvalidArgumentException

---
 lib/CurlWrapper.h | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/lib/CurlWrapper.h b/lib/CurlWrapper.h
index 749a79c3..d6b5df3a 100644
--- a/lib/CurlWrapper.h
+++ b/lib/CurlWrapper.h
@@ -21,16 +21,11 @@
 #include <assert.h>
 #include <curl/curl.h>
 
+#include <mutex>
 #include <string>
 
 namespace pulsar {
 
-struct CurlInitializer {
-    CurlInitializer() { curl_global_init(CURL_GLOBAL_ALL); }
-    ~CurlInitializer() { curl_global_cleanup(); }
-};
-static CurlInitializer curlInitializer;
-
 class CurlWrapper {
    public:
     CurlWrapper() noexcept {}
@@ -47,6 +42,8 @@ class CurlWrapper {
 
     // It must be called before calling other methods
     bool init() {
+        static std::once_flag initFlag;
+        std::call_once(initFlag, [] { curl_global_init(CURL_GLOBAL_ALL); });
         handle_ = curl_easy_init();
         return handle_ != nullptr;
     }

From f77052eddcbef756537e9737da5d13a1d9628f94 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Mon, 2 Mar 2026 20:57:58 +0800
Subject: [PATCH 08/24] ci: cache vcpkg packages in CI

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/ci-pr-validation.yaml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/.github/workflows/ci-pr-validation.yaml b/.github/workflows/ci-pr-validation.yaml
index 6801a55d..d26da863 100644
--- a/.github/workflows/ci-pr-validation.yaml
+++ b/.github/workflows/ci-pr-validation.yaml
@@ -90,6 +90,13 @@ jobs:
           fetch-depth: 0
           submodules: recursive
 
+      - name: Restore vcpkg installed cache
+        uses: actions/cache@v4
+        with:
+          path: build/vcpkg_installed
+          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json', 'CMakeLists.txt', 'vcpkg-triplets/**') }}
+          restore-keys: vcpkg-${{ runner.os }}-
+
       - name: Build the project
         run: |
           cmake -B build -DINTEGRATE_VCPKG=ON -DBUILD_TESTS=ON -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
@@ -117,6 +124,15 @@ jobs:
           fetch-depth: 0
           submodules: recursive
 
+      - name: Restore vcpkg installed cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            build/vcpkg_installed
+            build-boost-asio/vcpkg_installed
+          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json', 'CMakeLists.txt', 'vcpkg-triplets/**') }}
+          restore-keys: vcpkg-${{ runner.os }}-
+
       - name: Build core libraries
         run: |
           cmake -B build -DINTEGRATE_VCPKG=ON -DBUILD_TESTS=OFF
@@ -355,6 +371,13 @@ jobs:
           fetch-depth: 0
           submodules: recursive
 
+      - name: Restore vcpkg installed cache
+        uses: actions/cache@v4
+        with:
+          path: build-osx/vcpkg_installed
+          key: vcpkg-${{ runner.os }}-arm64-${{ hashFiles('vcpkg.json', 'CMakeLists.txt', 'vcpkg-triplets/**') }}
+          restore-keys: vcpkg-${{ runner.os }}-arm64-
+
       - name: Build libraries
         run: ./pkg/mac/build-static-library.sh
 

From a086294b755010bc7524b8fc3c84ca3175786522 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Mon, 2 Mar 2026 22:31:05 +0800
Subject: [PATCH 09/24] fix windows build

---
 CMakeLists.txt | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 0a0bd910..b4f66c1c 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -127,6 +127,7 @@ if (INTEGRATE_VCPKG)
     find_package(ZLIB REQUIRED)
     find_package(OpenSSL REQUIRED)
     find_package(protobuf CONFIG REQUIRED)
+    find_package(absl CONFIG REQUIRED)
     find_package(zstd CONFIG REQUIRED)
     find_package(Snappy CONFIG REQUIRED)
     set(COMMON_LIBS CURL::libcurl
@@ -134,6 +135,17 @@ if (INTEGRATE_VCPKG)
         OpenSSL::SSL
         OpenSSL::Crypto
         protobuf::libprotobuf
+        absl::base
+        absl::log
+        absl::log_internal_message
+        absl::log_internal_check_op
+        absl::status
+        absl::statusor
+        absl::strings
+        absl::str_format
+        absl::time
+        absl::synchronization
+        absl::cord
         $<IF:$<TARGET_EXISTS:zstd::libzstd_shared>,zstd::libzstd_shared,zstd::libzstd_static>
         Snappy::snappy
         )

From e44113949c5e93f4d1d992874829c61d7f1d1215 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Mon, 2 Mar 2026 22:37:13 +0800
Subject: [PATCH 10/24] fix rpm build

---
 pkg/rpm/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/rpm/Dockerfile b/pkg/rpm/Dockerfile
index 09635b46..1078f040 100644
--- a/pkg/rpm/Dockerfile
+++ b/pkg/rpm/Dockerfile
@@ -38,4 +38,4 @@ RUN yum install -y cmake
 RUN dnf --enablerepo=devel install -y ninja-build
 
 # Dependencies when building OpenSSL
-RUN yum install -y perl-IPC-Cmd
+RUN yum install -y perl-IPC-Cmd kernel-headers

From bce7c7df597074dbb98dd06145d7d0241cbd281c Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Mon, 2 Mar 2026 22:40:44 +0800
Subject: [PATCH 11/24] [DEBUG] Test windows and rpm build only

---
 .github/workflows/ci-pr-validation.yaml | 193 +-----------------------
 .github/workflows/codeql-analysis.yml   |  73 ---------
 2 files changed, 1 insertion(+), 265 deletions(-)
 delete mode 100644 .github/workflows/codeql-analysis.yml

diff --git a/.github/workflows/ci-pr-validation.yaml b/.github/workflows/ci-pr-validation.yaml
index d26da863..8df4f167 100644
--- a/.github/workflows/ci-pr-validation.yaml
+++ b/.github/workflows/ci-pr-validation.yaml
@@ -29,177 +29,9 @@ concurrency:
 
 jobs:
 
-  formatting-check:
-    name: Formatting Check
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - name: Run clang-format style check for C/C++/Protobuf programs.
-      uses: jidicula/clang-format-action@v4.11.0
-      with:
-        clang-format-version: '11'
-        exclude-regex: '.*\.(proto|hpp)'
-
-  wireshark-dissector-build:
-    name: Build the Wireshark dissector
-    needs: formatting-check
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 60
-    strategy:
-      matrix:
-        # TODO: support build on macos-14
-        os: [ubuntu-latest]
-
-    steps:
-      - name: checkout
-        uses: actions/checkout@v3
-
-      - name: Install deps (Ubuntu)
-        if: ${{ startsWith(matrix.os, 'ubuntu') }}
-        run: |
-          sudo apt-get update -y
-          sudo apt-get install -y protobuf-compiler libprotobuf-dev wireshark-dev
-
-      - name: Install deps (macOS)
-        if: ${{ startsWith(matrix.os, 'macos') }}
-        run: |
-          # See https://github.com/Homebrew/homebrew-core/issues/157142
-          export HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK=1
-          cd /usr/local/bin
-          rm -f 2to3* idle3* pydoc* python3*
-          rm -f /usr/local/share/man/man1/python3.1 /usr/local/lib/pkgconfig/python3*
-          cd /usr/local/Frameworks/Python.framework
-          rm -rf Headers Python Resources Versions/Current
-          brew update
-          brew install pkg-config wireshark protobuf
-      - name: Build wireshark plugin
-        run: |
-          cmake -S wireshark -B build-wireshark
-          cmake --build build-wireshark
-
-  lint:
-    name: Lint
-    needs: formatting-check
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
-
-    steps:
-      - name: checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Restore vcpkg installed cache
-        uses: actions/cache@v4
-        with:
-          path: build/vcpkg_installed
-          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json', 'CMakeLists.txt', 'vcpkg-triplets/**') }}
-          restore-keys: vcpkg-${{ runner.os }}-
-
-      - name: Build the project
-        run: |
-          cmake -B build -DINTEGRATE_VCPKG=ON -DBUILD_TESTS=ON -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
-          cmake --build build -j8
-
-      - name: Tidy check
-        run: |
-          sudo apt-get install -y clang-tidy
-          ./build-support/run_clang_tidy.sh
-          if [[ $? -ne 0 ]]; then
-              echo "clang-tidy failed"
-              exit 1
-          fi
-
-  unit-tests:
-    name: Run unit tests
-    needs: formatting-check
-    runs-on: ubuntu-24.04
-    timeout-minutes: 120
-
-    steps:
-      - name: checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Restore vcpkg installed cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            build/vcpkg_installed
-            build-boost-asio/vcpkg_installed
-          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json', 'CMakeLists.txt', 'vcpkg-triplets/**') }}
-          restore-keys: vcpkg-${{ runner.os }}-
-
-      - name: Build core libraries
-        run: |
-          cmake -B build -DINTEGRATE_VCPKG=ON -DBUILD_TESTS=OFF
-          cmake --build build -j8
-
-      - name: Check formatting
-        run: |
-          ./vcpkg/vcpkg format-manifest vcpkg.json
-          if [[ $(git diff | wc -l) -gt 0 ]]; then
-              echo "Please run `./vcpkg/vcpkg format-manifest vcpkg.json` to reformat vcpkg.json"
-              exit 1
-          fi
-
-      - name: Build tests
-        run: |
-          cmake -B build -DINTEGRATE_VCPKG=ON -DBUILD_TESTS=ON -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
-          cmake --build build -j8
-
-      - name: Install gtest-parallel
-        run: |
-          sudo curl -o /gtest-parallel https://raw.githubusercontent.com/google/gtest-parallel/master/gtest_parallel.py 
-
-      - name: Run unit tests
-        run: RETRY_FAILED=3 CMAKE_BUILD_DIRECTORY=./build ./run-unit-tests.sh
-
-      - name: Build with Boost.Asio
-        run: |
-          cmake -B build-boost-asio -DINTEGRATE_VCPKG=ON -DBUILD_TESTS=ON
-          cmake --build build-boost-asio -j8
-
-      - name: Build perf tools
-        run: |
-          cmake -B build -DINTEGRATE_VCPKG=ON -DBUILD_TESTS=ON -DBUILD_PERF_TOOLS=ON
-          cmake --build build -j8
-
-      - name: Verify custom vcpkg installation
-        run: |
-          mv vcpkg /tmp/vcpkg-custom
-          cmake -B build-2 -DINTEGRATE_VCPKG=ON -DCMAKE_TOOLCHAIN_FILE="/tmp/vcpkg-custom/scripts/buildsystems/vcpkg.cmake"
-
-  cpp20-build:
-    name: Build with the C++20 standard
-    needs: lint
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
-
-    steps:
-      - name: checkout
-        uses: actions/checkout@v3
-      - name: Install deps
-        run: |
-          sudo apt-get update -y
-          sudo apt-get install -y libcurl4-openssl-dev libssl-dev \
-            protobuf-compiler libprotobuf-dev libboost-dev \
-            libboost-dev libboost-program-options-dev \
-            libzstd-dev libsnappy-dev libgmock-dev libgtest-dev
-      - name: CMake
-        run: cmake -B build -DBUILD_PERF_TOOLS=ON -DCMAKE_CXX_STANDARD=20
-      - name: Build
-        run: |
-          cmake --build build -j8 --target pulsarShared pulsarStatic
-          cmake --build build -j8
-
   cpp-build-windows:
     timeout-minutes: 120
     name: Build CPP Client on ${{ matrix.name }}
-    needs: unit-tests
     runs-on: ${{ matrix.os }}
     env:
       VCPKG_ROOT: '${{ github.workspace }}/vcpkg'
@@ -318,7 +150,6 @@ jobs:
   package:
     name: Build ${{matrix.pkg.name}} ${{matrix.cpu.platform}}
     runs-on: ubuntu-22.04
-    needs: [lint, unit-tests]
     timeout-minutes: 500
 
     strategy:
@@ -359,33 +190,11 @@ jobs:
 
       # TODO: verify the pre-built package works without linking issue
 
-  cpp-build-macos:
-    timeout-minutes: 120
-    name: Build CPP Client on macOS with static dependencies
-    runs-on: macos-14
-    needs: lint
-    steps:
-      - name: checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Restore vcpkg installed cache
-        uses: actions/cache@v4
-        with:
-          path: build-osx/vcpkg_installed
-          key: vcpkg-${{ runner.os }}-arm64-${{ hashFiles('vcpkg.json', 'CMakeLists.txt', 'vcpkg-triplets/**') }}
-          restore-keys: vcpkg-${{ runner.os }}-arm64-
-
-      - name: Build libraries
-        run: ./pkg/mac/build-static-library.sh
-
   # Job that will be required to complete and depends on all the other jobs
   check-completion:
     name: Check Completion
     runs-on: ubuntu-latest
-    needs: [formatting-check, wireshark-dissector-build, lint, unit-tests, cpp20-build, cpp-build-windows, package, cpp-build-macos]
+    needs: [cpp-build-windows, package]
 
     steps:
       - run: true
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
deleted file mode 100644
index c877c642..00000000
--- a/.github/workflows/codeql-analysis.yml
+++ /dev/null
@@ -1,73 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-  schedule:
-    - cron: '16 21 * * 2'
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-22.04
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'cpp' ]
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 0
-        submodules: recursive
-
-      # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
-      with:
-        languages: ${{ matrix.language }}
-
-    - name: Install deps
-      run: |
-        sudo apt-get update -y
-        sudo apt-get install -y libcurl4-openssl-dev libssl-dev \
-          protobuf-compiler libprotobuf-dev libboost-dev \
-          libboost-dev libboost-program-options-dev \
-          libzstd-dev libsnappy-dev
-
-    - name: Build
-      run: |
-        cmake . -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTS=OFF -DBUILD_STATIC_LIB=OFF -DBUILD_PERF_TOOLS=ON 
-        cmake --build . -j8
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
-      with:
-        category: "/language:${{matrix.language}}"

From b778df94737e12c6c87dc4594a90fe30d330ef13 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Tue, 3 Mar 2026 10:37:47 +0800
Subject: [PATCH 12/24] fix windows build

---
 LegacyFindPackages.cmake | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/LegacyFindPackages.cmake b/LegacyFindPackages.cmake
index 3fa78d65..d25f7cfc 100644
--- a/LegacyFindPackages.cmake
+++ b/LegacyFindPackages.cmake
@@ -51,6 +51,10 @@ if (APPLE AND NOT LINK_STATIC)
     # The latest Protobuf dependency on macOS requires the C++17 support and
     # it could only be found by the CONFIG mode
     set(LATEST_PROTOBUF TRUE)
+elseif (MSVC AND VCPKG_TRIPLET)
+    # protobuf >= 6.x on Windows with vcpkg requires CONFIG mode to resolve
+    # the protobuf::libprotobuf CMake target and its abseil dependencies
+    set(LATEST_PROTOBUF TRUE)
 else ()
     set(LATEST_PROTOBUF FALSE)
 endif ()
@@ -127,8 +131,10 @@ if (LINK_STATIC AND NOT VCPKG_TRIPLET)
         add_definitions(-DCURL_STATICLIB)
     endif()
 elseif (LINK_STATIC AND VCPKG_TRIPLET)
-    find_package(Protobuf REQUIRED)
-    message(STATUS "Found protobuf static library: " ${Protobuf_LIBRARIES})
+    if (NOT LATEST_PROTOBUF)
+        find_package(Protobuf REQUIRED)
+        message(STATUS "Found protobuf static library: " ${Protobuf_LIBRARIES})
+    endif ()
     if (MSVC AND (${CMAKE_BUILD_TYPE} STREQUAL Debug))
         find_library(ZLIB_LIBRARIES NAMES zlibd)
     else ()
@@ -279,6 +285,23 @@ if (MSVC)
         message(STATUS "CMAKE_CXX_FLAGS_RELEASE: " ${CMAKE_CXX_FLAGS_RELEASE})
         message(STATUS "CMAKE_CXX_FLAGS_RELWITHDEBINFO: " ${CMAKE_CXX_FLAGS_RELWITHDEBINFO})
     endif ()
+    if (VCPKG_TRIPLET)
+        # protobuf >= 6.x requires abseil; link it explicitly since MSVC static
+        # linking does not resolve transitive dependencies automatically
+        find_package(absl CONFIG REQUIRED)
+        set(COMMON_LIBS ${COMMON_LIBS}
+            absl::base
+            absl::log
+            absl::log_internal_message
+            absl::log_internal_check_op
+            absl::status
+            absl::statusor
+            absl::strings
+            absl::str_format
+            absl::time
+            absl::synchronization
+            absl::cord)
+    endif ()
 else()
     set(COMMON_LIBS ${COMMON_LIBS} m)
 endif()

From 643c8c07e19347c9cc38692b743c5a573879ed4b Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Tue, 3 Mar 2026 12:10:07 +0800
Subject: [PATCH 13/24] fix RPM build

---
 pkg/rpm/Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkg/rpm/Dockerfile b/pkg/rpm/Dockerfile
index 1078f040..d3475cfe 100644
--- a/pkg/rpm/Dockerfile
+++ b/pkg/rpm/Dockerfile
@@ -38,4 +38,5 @@ RUN yum install -y cmake
 RUN dnf --enablerepo=devel install -y ninja-build
 
 # Dependencies when building OpenSSL
-RUN yum install -y perl-IPC-Cmd kernel-headers
+# OpenSSL 3.6.1 requires the Time::Piece Perl module (packaged separately on EL8)
+RUN yum install -y perl-IPC-Cmd perl-Time-Piece

From c751088bf38886e75effa31e755165ae4fa113d1 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Tue, 3 Mar 2026 12:35:44 +0800
Subject: [PATCH 14/24] fix incorrect libpulsarwithdeps.a

---
 build-support/merge_archives.sh       |  1 +
 build-support/merge_archives_vcpkg.sh | 11 +++++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/build-support/merge_archives.sh b/build-support/merge_archives.sh
index 065130d7..85916aca 100755
--- a/build-support/merge_archives.sh
+++ b/build-support/merge_archives.sh
@@ -45,6 +45,7 @@ for ITEM in $ITEMS; do
     cd ..
 done
 
+rm -f $MERGED_LIBRARY
 ar -qc $MERGED_LIBRARY $LIBS
 
 
diff --git a/build-support/merge_archives_vcpkg.sh b/build-support/merge_archives_vcpkg.sh
index 73c445fb..bc700120 100755
--- a/build-support/merge_archives_vcpkg.sh
+++ b/build-support/merge_archives_vcpkg.sh
@@ -27,12 +27,19 @@ if [[ $# -lt 1 ]]; then
 fi
 
 CMAKE_BUILD_DIRECTORY=$1
+
+# libprotoc.a is the protobuf compiler (protoc) tool library, not the runtime.
+# It pulls in google::protobuf::compiler::java::* and absl debugging/VDSO symbols
+# that are not needed by client code and cannot be satisfied without additional deps.
+# libprotobuf-lite.a is a subset of libprotobuf.a and causes duplicate symbols.
+EXCLUDE_PATTERN="libprotoc.a\|libprotobuf-lite.a"
+
 if [[ $VCPKG_TRIPLET ]]; then
     ./merge_archives.sh $CMAKE_BUILD_DIRECTORY/libpulsarwithdeps.a \
         $CMAKE_BUILD_DIRECTORY/lib/libpulsar.a \
-        $(find "$CMAKE_BUILD_DIRECTORY/vcpkg_installed/$VCPKG_TRIPLET" -name "*.a" | grep -v debug)
+        $(find "$CMAKE_BUILD_DIRECTORY/vcpkg_installed/$VCPKG_TRIPLET" -name "*.a" | grep -v '/debug/' | grep -v "$EXCLUDE_PATTERN")
 else
     ./merge_archives.sh $CMAKE_BUILD_DIRECTORY/libpulsarwithdeps.a \
         $CMAKE_BUILD_DIRECTORY/lib/libpulsar.a \
-        $(find "$CMAKE_BUILD_DIRECTORY/vcpkg_installed" -name "*.a" | grep -v debug)
+        $(find "$CMAKE_BUILD_DIRECTORY/vcpkg_installed" -name "*.a" | grep -v '/debug/' | grep -v "$EXCLUDE_PATTERN")
 fi

From e7ce72a5b48aaf45b111b8fb5dd2f3f79996af00 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Tue, 3 Mar 2026 13:03:30 +0800
Subject: [PATCH 15/24] fix windows build due to protobuf find failure

---
 LegacyFindPackages.cmake | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/LegacyFindPackages.cmake b/LegacyFindPackages.cmake
index d25f7cfc..148be6a4 100644
--- a/LegacyFindPackages.cmake
+++ b/LegacyFindPackages.cmake
@@ -23,6 +23,14 @@ if (VCPKG_TRIPLET)
     set(CMAKE_PREFIX_PATH "${PROJECT_SOURCE_DIR}/vcpkg_installed/${VCPKG_TRIPLET}")
     message(STATUS "Use CMAKE_PREFIX_PATH: ${CMAKE_PREFIX_PATH}")
     set(PROTOC_PATH "${CMAKE_PREFIX_PATH}/tools/protobuf/protoc")
+    if (MSVC AND VCPKG_TRIPLET MATCHES ".*-static")
+        # vcpkg installs host executables (protoc, etc.) in the non-static triplet's
+        # tools directory. Derive it by stripping "-static" from the triplet name.
+        string(REPLACE "-static" "" VCPKG_HOST_TRIPLET "${VCPKG_TRIPLET}")
+        set(PROTOC_PATH "${PROJECT_SOURCE_DIR}/vcpkg_installed/${VCPKG_HOST_TRIPLET}/tools/protobuf/protoc")
+        # Set the cache variable so protobuf's CMake module compatibility shim finds it
+        set(Protobuf_PROTOC_EXECUTABLE "${PROTOC_PATH}.exe" CACHE FILEPATH "protoc executable" FORCE)
+    endif ()
     message(STATUS "Use protoc: ${PROTOC_PATH}")
     set(VCPKG_ROOT "${PROJECT_SOURCE_DIR}/vcpkg_installed/${VCPKG_TRIPLET}")
     set(VCPKG_DEBUG_ROOT "${VCPKG_ROOT}/debug")

From 607a530b215f1b61b28b22ea19c55111eb938efc Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Tue, 3 Mar 2026 13:07:37 +0800
Subject: [PATCH 16/24] fix windows vcpkg cache issue

---
 .github/workflows/ci-pr-validation.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci-pr-validation.yaml b/.github/workflows/ci-pr-validation.yaml
index 8df4f167..fee082ff 100644
--- a/.github/workflows/ci-pr-validation.yaml
+++ b/.github/workflows/ci-pr-validation.yaml
@@ -58,7 +58,7 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Restore vcpkg and its artifacts.
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         id: vcpkg-cache
         with:
           path: |
@@ -68,8 +68,8 @@ jobs:
             !${{ env.VCPKG_ROOT }}/buildtrees
             !${{ env.VCPKG_ROOT }}/packages
             !${{ env.VCPKG_ROOT }}/downloads
-          key: |
-            ${{ runner.os }}-${{ matrix.triplet}}-${{ hashFiles( 'vcpkg.json' ) }}
+          key: ${{ runner.os }}-${{ matrix.triplet }}-${{ hashFiles('vcpkg.json') }}
+          restore-keys: ${{ runner.os }}-${{ matrix.triplet }}-
 
       - name: Get vcpkg(windows)
         if: ${{ runner.os == 'Windows' && steps.vcpkg-cache.outputs.cache-hit != 'true' }}

From a0cc973f3c70901fb915da69146e1f1971bb6bc6 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Tue, 3 Mar 2026 15:02:25 +0800
Subject: [PATCH 17/24] fix windows build

---
 LegacyFindPackages.cmake | 13 +++++++++----
 lib/CMakeLists.txt       | 16 +++++++++++++++-
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/LegacyFindPackages.cmake b/LegacyFindPackages.cmake
index 148be6a4..263f6793 100644
--- a/LegacyFindPackages.cmake
+++ b/LegacyFindPackages.cmake
@@ -95,8 +95,13 @@ message("OPENSSL_INCLUDE_DIR: " ${OPENSSL_INCLUDE_DIR})
 message("OPENSSL_LIBRARIES: " ${OPENSSL_LIBRARIES})
 
 if (LATEST_PROTOBUF)
-    # See https://github.com/apache/arrow/issues/35987
-    add_definitions(-DPROTOBUF_USE_DLLS)
+    if (NOT LINK_STATIC)
+        # Only needed when protobuf itself is a DLL; static builds must NOT define this
+        # because it marks symbols as __declspec(dllimport), causing LNK2019 when
+        # linking against a static libprotobuf.lib.
+        # See https://github.com/apache/arrow/issues/35987
+        add_definitions(-DPROTOBUF_USE_DLLS)
+    endif ()
     # Use Config mode to avoid FindProtobuf.cmake does not find the Abseil library
     find_package(Protobuf REQUIRED CONFIG)
 else ()
@@ -278,8 +283,8 @@ if (MSVC)
         wldap32.lib
         Normaliz.lib)
     if (LINK_STATIC)
-        # add external dependencies of libcurl
-        set(COMMON_LIBS ${COMMON_LIBS} ws2_32.lib crypt32.lib)
+        # add external dependencies of libcurl (iphlpapi for if_nametoindex)
+        set(COMMON_LIBS ${COMMON_LIBS} ws2_32.lib crypt32.lib iphlpapi.lib)
         # the default compile options have /MD, which cannot be used to build DLLs that link static libraries
         string(REGEX REPLACE "/MD" "/MT" CMAKE_CXX_FLAGS_DEBUG ${CMAKE_CXX_FLAGS_DEBUG})
         string(REGEX REPLACE "/MD" "/MT" CMAKE_CXX_FLAGS_RELEASE ${CMAKE_CXX_FLAGS_RELEASE})
diff --git a/lib/CMakeLists.txt b/lib/CMakeLists.txt
index e34555d4..f377ee22 100644
--- a/lib/CMakeLists.txt
+++ b/lib/CMakeLists.txt
@@ -145,7 +145,21 @@ if (LINK_STATIC AND BUILD_STATIC_LIB)
         else ()
             remove_libtype("${COMMON_LIBS}" "debug" STATIC_LIBS)
         endif ()
-        set_property(TARGET pulsarStaticWithDeps PROPERTY STATIC_LIBRARY_OPTIONS ${STATIC_LIBS})
+        # lib.exe (STATIC_LIBRARY_OPTIONS) cannot resolve CMake imported target names.
+        # Replace each CMake target with $<TARGET_FILE:...>; keep only static archives
+        # (skip system import libs that have no absolute path and non-archive targets).
+        set(RESOLVED_STATIC_LIBS "")
+        foreach (LIB IN LISTS STATIC_LIBS)
+            if (TARGET ${LIB})
+                get_target_property(_LIB_TYPE ${LIB} TYPE)
+                if (_LIB_TYPE STREQUAL "STATIC_LIBRARY" OR _LIB_TYPE STREQUAL "UNKNOWN_LIBRARY")
+                    list(APPEND RESOLVED_STATIC_LIBS "$<TARGET_FILE:${LIB}>")
+                endif ()
+            elseif (IS_ABSOLUTE "${LIB}" AND LIB MATCHES "\\.(lib|a)$")
+                list(APPEND RESOLVED_STATIC_LIBS "${LIB}")
+            endif ()
+        endforeach ()
+        set_property(TARGET pulsarStaticWithDeps PROPERTY STATIC_LIBRARY_OPTIONS ${RESOLVED_STATIC_LIBS})
         set_property(TARGET pulsarStaticWithDeps PROPERTY OUTPUT_NAME ${LIB_NAME}WithDeps)
         set_property(TARGET pulsarStaticWithDeps PROPERTY VERSION ${LIBRARY_VERSION})
         install(TARGETS pulsarStaticWithDeps DESTINATION lib)

From 90ade48df974d1379247da4b25616a3a0069cae0 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Tue, 3 Mar 2026 16:11:49 +0800
Subject: [PATCH 18/24] fix windows build

---
 LegacyFindPackages.cmake | 20 +++++++++----
 lib/CMakeLists.txt       | 63 ++++++++++++++++++++++++++++------------
 2 files changed, 59 insertions(+), 24 deletions(-)

diff --git a/LegacyFindPackages.cmake b/LegacyFindPackages.cmake
index 263f6793..d799e7dc 100644
--- a/LegacyFindPackages.cmake
+++ b/LegacyFindPackages.cmake
@@ -23,13 +23,21 @@ if (VCPKG_TRIPLET)
     set(CMAKE_PREFIX_PATH "${PROJECT_SOURCE_DIR}/vcpkg_installed/${VCPKG_TRIPLET}")
     message(STATUS "Use CMAKE_PREFIX_PATH: ${CMAKE_PREFIX_PATH}")
     set(PROTOC_PATH "${CMAKE_PREFIX_PATH}/tools/protobuf/protoc")
-    if (MSVC AND VCPKG_TRIPLET MATCHES ".*-static")
-        # vcpkg installs host executables (protoc, etc.) in the non-static triplet's
-        # tools directory. Derive it by stripping "-static" from the triplet name.
-        string(REPLACE "-static" "" VCPKG_HOST_TRIPLET "${VCPKG_TRIPLET}")
-        set(PROTOC_PATH "${PROJECT_SOURCE_DIR}/vcpkg_installed/${VCPKG_HOST_TRIPLET}/tools/protobuf/protoc")
+    if (MSVC)
+        # vcpkg host tools (protoc, etc.) are always built for the host machine
+        # architecture (x64 on GitHub Actions), regardless of the target triplet.
+        # Use find_program to locate protoc.exe across known host tool paths.
+        find_program(PROTOC_PATH NAMES protoc.exe
+            PATHS
+                "${PROJECT_SOURCE_DIR}/vcpkg_installed/x64-windows/tools/protobuf"
+                "${PROJECT_SOURCE_DIR}/vcpkg_installed/arm64-windows/tools/protobuf"
+                "${PROJECT_SOURCE_DIR}/vcpkg_installed/${VCPKG_TRIPLET}/tools/protobuf"
+            NO_DEFAULT_PATH)
+        if (NOT PROTOC_PATH)
+            set(PROTOC_PATH "${CMAKE_PREFIX_PATH}/tools/protobuf/protoc.exe")
+        endif ()
         # Set the cache variable so protobuf's CMake module compatibility shim finds it
-        set(Protobuf_PROTOC_EXECUTABLE "${PROTOC_PATH}.exe" CACHE FILEPATH "protoc executable" FORCE)
+        set(Protobuf_PROTOC_EXECUTABLE "${PROTOC_PATH}" CACHE FILEPATH "protoc executable" FORCE)
     endif ()
     message(STATUS "Use protoc: ${PROTOC_PATH}")
     set(VCPKG_ROOT "${PROJECT_SOURCE_DIR}/vcpkg_installed/${VCPKG_TRIPLET}")
diff --git a/lib/CMakeLists.txt b/lib/CMakeLists.txt
index f377ee22..e91ccdb3 100644
--- a/lib/CMakeLists.txt
+++ b/lib/CMakeLists.txt
@@ -140,26 +140,53 @@ if (LINK_STATIC AND BUILD_STATIC_LIB)
 
         add_library(pulsarStaticWithDeps STATIC ${PULSAR_SOURCES})
         target_include_directories(pulsarStaticWithDeps PRIVATE ${dlfcn-win32_INCLUDE_DIRS})
-        if (CMAKE_BUILD_TYPE STREQUAL "Debug")
-            remove_libtype("${COMMON_LIBS}" "optimized" STATIC_LIBS)
-        else ()
-            remove_libtype("${COMMON_LIBS}" "debug" STATIC_LIBS)
-        endif ()
-        # lib.exe (STATIC_LIBRARY_OPTIONS) cannot resolve CMake imported target names.
-        # Replace each CMake target with $<TARGET_FILE:...>; keep only static archives
-        # (skip system import libs that have no absolute path and non-archive targets).
-        set(RESOLVED_STATIC_LIBS "")
-        foreach (LIB IN LISTS STATIC_LIBS)
-            if (TARGET ${LIB})
-                get_target_property(_LIB_TYPE ${LIB} TYPE)
-                if (_LIB_TYPE STREQUAL "STATIC_LIBRARY" OR _LIB_TYPE STREQUAL "UNKNOWN_LIBRARY")
-                    list(APPEND RESOLVED_STATIC_LIBS "$<TARGET_FILE:${LIB}>")
+        if (VCPKG_TRIPLET)
+            # Collect ALL vcpkg-installed static archives so every transitive dependency
+            # (protobuf, abseil, curl, zlib, etc.) is merged into the fat lib without
+            # requiring manual enumeration of individual targets.
+            set(_vcpkg_dir "${PROJECT_SOURCE_DIR}/vcpkg_installed/${VCPKG_TRIPLET}")
+            file(GLOB _release_libs "${_vcpkg_dir}/lib/*.lib")
+            file(GLOB _debug_libs   "${_vcpkg_dir}/debug/lib/*.lib")
+            # Exclude the protobuf compiler tool and lite runtime (not needed at runtime)
+            foreach (_excl "libprotoc" "libprotobuf-lite")
+                list(FILTER _release_libs EXCLUDE REGEX "/${_excl}\\.lib$")
+                list(FILTER _debug_libs   EXCLUDE REGEX "/${_excl}\\.lib$")
+            endforeach ()
+            # Build per-lib generator expressions to select debug vs release archive
+            # for multi-config generators (Visual Studio).
+            set(_vcpkg_static_libs "")
+            foreach (_rlib IN LISTS _release_libs)
+                get_filename_component(_libname "${_rlib}" NAME)
+                set(_dlib "${_vcpkg_dir}/debug/lib/${_libname}")
+                if (EXISTS "${_dlib}")
+                    list(APPEND _vcpkg_static_libs "$<IF:$<CONFIG:Debug>,${_dlib},${_rlib}>")
+                else ()
+                    list(APPEND _vcpkg_static_libs "${_rlib}")
                 endif ()
-            elseif (IS_ABSOLUTE "${LIB}" AND LIB MATCHES "\\.(lib|a)$")
-                list(APPEND RESOLVED_STATIC_LIBS "${LIB}")
+            endforeach ()
+            set_property(TARGET pulsarStaticWithDeps PROPERTY STATIC_LIBRARY_OPTIONS ${_vcpkg_static_libs})
+        else ()
+            # Non-vcpkg MSVC static build: resolve COMMON_LIBS entries for lib.exe.
+            # CMake imported target names cannot be passed to lib.exe directly; replace
+            # them with $<TARGET_FILE:...> generator expressions.
+            if (CMAKE_BUILD_TYPE STREQUAL "Debug")
+                remove_libtype("${COMMON_LIBS}" "optimized" STATIC_LIBS)
+            else ()
+                remove_libtype("${COMMON_LIBS}" "debug" STATIC_LIBS)
             endif ()
-        endforeach ()
-        set_property(TARGET pulsarStaticWithDeps PROPERTY STATIC_LIBRARY_OPTIONS ${RESOLVED_STATIC_LIBS})
+            set(RESOLVED_STATIC_LIBS "")
+            foreach (LIB IN LISTS STATIC_LIBS)
+                if (TARGET ${LIB})
+                    get_target_property(_LIB_TYPE ${LIB} TYPE)
+                    if (_LIB_TYPE STREQUAL "STATIC_LIBRARY" OR _LIB_TYPE STREQUAL "UNKNOWN_LIBRARY")
+                        list(APPEND RESOLVED_STATIC_LIBS "$<TARGET_FILE:${LIB}>")
+                    endif ()
+                elseif (IS_ABSOLUTE "${LIB}" AND LIB MATCHES "\\.(lib|a)$")
+                    list(APPEND RESOLVED_STATIC_LIBS "${LIB}")
+                endif ()
+            endforeach ()
+            set_property(TARGET pulsarStaticWithDeps PROPERTY STATIC_LIBRARY_OPTIONS ${RESOLVED_STATIC_LIBS})
+        endif ()
         set_property(TARGET pulsarStaticWithDeps PROPERTY OUTPUT_NAME ${LIB_NAME}WithDeps)
         set_property(TARGET pulsarStaticWithDeps PROPERTY VERSION ${LIBRARY_VERSION})
         install(TARGETS pulsarStaticWithDeps DESTINATION lib)

From 0b88587fe39d4657e4200044e5e1b04bc6ea0be9 Mon Sep 17 00:00:00 2001
From: Copilot <copilot@example.com>
Date: Tue, 3 Mar 2026 16:12:27 +0800
Subject: [PATCH 19/24] improve vcpkg cache on Windows

---
 .github/workflows/ci-pr-validation.yaml | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci-pr-validation.yaml b/.github/workflows/ci-pr-validation.yaml
index fee082ff..237f2a09 100644
--- a/.github/workflows/ci-pr-validation.yaml
+++ b/.github/workflows/ci-pr-validation.yaml
@@ -60,14 +60,12 @@ jobs:
       - name: Restore vcpkg and its artifacts.
         uses: actions/cache@v4
         id: vcpkg-cache
+        continue-on-error: true
         with:
           path: |
-            ${{ env.VCPKG_ROOT }}
-            vcpkg_installed
-            !${{ env.VCPKG_ROOT }}/.git
-            !${{ env.VCPKG_ROOT }}/buildtrees
-            !${{ env.VCPKG_ROOT }}/packages
-            !${{ env.VCPKG_ROOT }}/downloads
+            ${{ github.workspace }}/vcpkg_installed
+            ${{ env.VCPKG_ROOT }}/installed
+            ${{ env.VCPKG_ROOT }}/downloads
           key: ${{ runner.os }}-${{ matrix.triplet }}-${{ hashFiles('vcpkg.json') }}
           restore-keys: ${{ runner.os }}-${{ matrix.triplet }}-
 

From 35b8f404716650d1740f8d882f43ada033303fdb Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Tue, 3 Mar 2026 17:18:49 +0800
Subject: [PATCH 20/24] always save cache

---
 .github/workflows/ci-pr-validation.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci-pr-validation.yaml b/.github/workflows/ci-pr-validation.yaml
index 237f2a09..bf51eb22 100644
--- a/.github/workflows/ci-pr-validation.yaml
+++ b/.github/workflows/ci-pr-validation.yaml
@@ -68,6 +68,7 @@ jobs:
             ${{ env.VCPKG_ROOT }}/downloads
           key: ${{ runner.os }}-${{ matrix.triplet }}-${{ hashFiles('vcpkg.json') }}
           restore-keys: ${{ runner.os }}-${{ matrix.triplet }}-
+          save-always: true
 
       - name: Get vcpkg(windows)
         if: ${{ runner.os == 'Windows' && steps.vcpkg-cache.outputs.cache-hit != 'true' }}

From 5c61f0e79c9d1a51d88c71ba9165fb9162d1fea3 Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Tue, 3 Mar 2026 17:59:58 +0800
Subject: [PATCH 21/24] Add back missed system import libs

---
 lib/CMakeLists.txt | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/CMakeLists.txt b/lib/CMakeLists.txt
index e91ccdb3..b8775606 100644
--- a/lib/CMakeLists.txt
+++ b/lib/CMakeLists.txt
@@ -164,6 +164,12 @@ if (LINK_STATIC AND BUILD_STATIC_LIB)
                     list(APPEND _vcpkg_static_libs "${_rlib}")
                 endif ()
             endforeach ()
+            # Also merge Windows system DLL import libs so pulsarWithDeps.lib is fully
+            # self-contained. lib.exe carries the import records into the archive; the
+            # final linker then resolves DLL deps without the user listing them.
+            # lib.exe finds these by name via the LIB env var set up by MSBuild/MSVC.
+            list(APPEND _vcpkg_static_libs
+                ws2_32.lib crypt32.lib wldap32.lib Normaliz.lib iphlpapi.lib)
             set_property(TARGET pulsarStaticWithDeps PROPERTY STATIC_LIBRARY_OPTIONS ${_vcpkg_static_libs})
         else ()
             # Non-vcpkg MSVC static build: resolve COMMON_LIBS entries for lib.exe.

From 4d65135fa8f9ee800c06b2db0522154bbb9eb40f Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Tue, 3 Mar 2026 19:02:49 +0800
Subject: [PATCH 22/24] Revert "[DEBUG] Test windows and rpm build only"

This reverts commit bce7c7df597074dbb98dd06145d7d0241cbd281c.
---
 .github/workflows/ci-pr-validation.yaml | 193 +++++++++++++++++++++++-
 .github/workflows/codeql-analysis.yml   |  73 +++++++++
 2 files changed, 265 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/codeql-analysis.yml

diff --git a/.github/workflows/ci-pr-validation.yaml b/.github/workflows/ci-pr-validation.yaml
index bf51eb22..a1d48002 100644
--- a/.github/workflows/ci-pr-validation.yaml
+++ b/.github/workflows/ci-pr-validation.yaml
@@ -29,9 +29,177 @@ concurrency:
 
 jobs:
 
+  formatting-check:
+    name: Formatting Check
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Run clang-format style check for C/C++/Protobuf programs.
+      uses: jidicula/clang-format-action@v4.11.0
+      with:
+        clang-format-version: '11'
+        exclude-regex: '.*\.(proto|hpp)'
+
+  wireshark-dissector-build:
+    name: Build the Wireshark dissector
+    needs: formatting-check
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    strategy:
+      matrix:
+        # TODO: support build on macos-14
+        os: [ubuntu-latest]
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@v3
+
+      - name: Install deps (Ubuntu)
+        if: ${{ startsWith(matrix.os, 'ubuntu') }}
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y protobuf-compiler libprotobuf-dev wireshark-dev
+
+      - name: Install deps (macOS)
+        if: ${{ startsWith(matrix.os, 'macos') }}
+        run: |
+          # See https://github.com/Homebrew/homebrew-core/issues/157142
+          export HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK=1
+          cd /usr/local/bin
+          rm -f 2to3* idle3* pydoc* python3*
+          rm -f /usr/local/share/man/man1/python3.1 /usr/local/lib/pkgconfig/python3*
+          cd /usr/local/Frameworks/Python.framework
+          rm -rf Headers Python Resources Versions/Current
+          brew update
+          brew install pkg-config wireshark protobuf
+      - name: Build wireshark plugin
+        run: |
+          cmake -S wireshark -B build-wireshark
+          cmake --build build-wireshark
+
+  lint:
+    name: Lint
+    needs: formatting-check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Restore vcpkg installed cache
+        uses: actions/cache@v4
+        with:
+          path: build/vcpkg_installed
+          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json', 'CMakeLists.txt', 'vcpkg-triplets/**') }}
+          restore-keys: vcpkg-${{ runner.os }}-
+
+      - name: Build the project
+        run: |
+          cmake -B build -DINTEGRATE_VCPKG=ON -DBUILD_TESTS=ON -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
+          cmake --build build -j8
+
+      - name: Tidy check
+        run: |
+          sudo apt-get install -y clang-tidy
+          ./build-support/run_clang_tidy.sh
+          if [[ $? -ne 0 ]]; then
+              echo "clang-tidy failed"
+              exit 1
+          fi
+
+  unit-tests:
+    name: Run unit tests
+    needs: formatting-check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Restore vcpkg installed cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            build/vcpkg_installed
+            build-boost-asio/vcpkg_installed
+          key: vcpkg-${{ runner.os }}-${{ hashFiles('vcpkg.json', 'CMakeLists.txt', 'vcpkg-triplets/**') }}
+          restore-keys: vcpkg-${{ runner.os }}-
+
+      - name: Build core libraries
+        run: |
+          cmake -B build -DINTEGRATE_VCPKG=ON -DBUILD_TESTS=OFF
+          cmake --build build -j8
+
+      - name: Check formatting
+        run: |
+          ./vcpkg/vcpkg format-manifest vcpkg.json
+          if [[ $(git diff | wc -l) -gt 0 ]]; then
+              echo "Please run `./vcpkg/vcpkg format-manifest vcpkg.json` to reformat vcpkg.json"
+              exit 1
+          fi
+
+      - name: Build tests
+        run: |
+          cmake -B build -DINTEGRATE_VCPKG=ON -DBUILD_TESTS=ON -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
+          cmake --build build -j8
+
+      - name: Install gtest-parallel
+        run: |
+          sudo curl -o /gtest-parallel https://raw.githubusercontent.com/google/gtest-parallel/master/gtest_parallel.py 
+
+      - name: Run unit tests
+        run: RETRY_FAILED=3 CMAKE_BUILD_DIRECTORY=./build ./run-unit-tests.sh
+
+      - name: Build with Boost.Asio
+        run: |
+          cmake -B build-boost-asio -DINTEGRATE_VCPKG=ON -DBUILD_TESTS=ON
+          cmake --build build-boost-asio -j8
+
+      - name: Build perf tools
+        run: |
+          cmake -B build -DINTEGRATE_VCPKG=ON -DBUILD_TESTS=ON -DBUILD_PERF_TOOLS=ON
+          cmake --build build -j8
+
+      - name: Verify custom vcpkg installation
+        run: |
+          mv vcpkg /tmp/vcpkg-custom
+          cmake -B build-2 -DINTEGRATE_VCPKG=ON -DCMAKE_TOOLCHAIN_FILE="/tmp/vcpkg-custom/scripts/buildsystems/vcpkg.cmake"
+
+  cpp20-build:
+    name: Build with the C++20 standard
+    needs: lint
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+
+    steps:
+      - name: checkout
+        uses: actions/checkout@v3
+      - name: Install deps
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y libcurl4-openssl-dev libssl-dev \
+            protobuf-compiler libprotobuf-dev libboost-dev \
+            libboost-dev libboost-program-options-dev \
+            libzstd-dev libsnappy-dev libgmock-dev libgtest-dev
+      - name: CMake
+        run: cmake -B build -DBUILD_PERF_TOOLS=ON -DCMAKE_CXX_STANDARD=20
+      - name: Build
+        run: |
+          cmake --build build -j8 --target pulsarShared pulsarStatic
+          cmake --build build -j8
+
   cpp-build-windows:
     timeout-minutes: 120
     name: Build CPP Client on ${{ matrix.name }}
+    needs: unit-tests
     runs-on: ${{ matrix.os }}
     env:
       VCPKG_ROOT: '${{ github.workspace }}/vcpkg'
@@ -149,6 +317,7 @@ jobs:
   package:
     name: Build ${{matrix.pkg.name}} ${{matrix.cpu.platform}}
     runs-on: ubuntu-22.04
+    needs: [lint, unit-tests]
     timeout-minutes: 500
 
     strategy:
@@ -189,11 +358,33 @@ jobs:
 
       # TODO: verify the pre-built package works without linking issue
 
+  cpp-build-macos:
+    timeout-minutes: 120
+    name: Build CPP Client on macOS with static dependencies
+    runs-on: macos-14
+    needs: lint
+    steps:
+      - name: checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Restore vcpkg installed cache
+        uses: actions/cache@v4
+        with:
+          path: build-osx/vcpkg_installed
+          key: vcpkg-${{ runner.os }}-arm64-${{ hashFiles('vcpkg.json', 'CMakeLists.txt', 'vcpkg-triplets/**') }}
+          restore-keys: vcpkg-${{ runner.os }}-arm64-
+
+      - name: Build libraries
+        run: ./pkg/mac/build-static-library.sh
+
   # Job that will be required to complete and depends on all the other jobs
   check-completion:
     name: Check Completion
     runs-on: ubuntu-latest
-    needs: [cpp-build-windows, package]
+    needs: [formatting-check, wireshark-dissector-build, lint, unit-tests, cpp20-build, cpp-build-windows, package, cpp-build-macos]
 
     steps:
       - run: true
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
new file mode 100644
index 00000000..c877c642
--- /dev/null
+++ b/.github/workflows/codeql-analysis.yml
@@ -0,0 +1,73 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '16 21 * * 2'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-22.04
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'cpp' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
+        submodules: recursive
+
+      # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+
+    - name: Install deps
+      run: |
+        sudo apt-get update -y
+        sudo apt-get install -y libcurl4-openssl-dev libssl-dev \
+          protobuf-compiler libprotobuf-dev libboost-dev \
+          libboost-dev libboost-program-options-dev \
+          libzstd-dev libsnappy-dev
+
+    - name: Build
+      run: |
+        cmake . -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTS=OFF -DBUILD_STATIC_LIB=OFF -DBUILD_PERF_TOOLS=ON 
+        cmake --build . -j8
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

From 341c812d21af120477cb2d2508abc7fedfb646fd Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Tue, 3 Mar 2026 20:14:32 +0800
Subject: [PATCH 23/24] fix incorrect caching

---
 .github/workflows/ci-pr-validation.yaml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci-pr-validation.yaml b/.github/workflows/ci-pr-validation.yaml
index a1d48002..f6356a3d 100644
--- a/.github/workflows/ci-pr-validation.yaml
+++ b/.github/workflows/ci-pr-validation.yaml
@@ -222,8 +222,9 @@ jobs:
             arch: '-A Win32'
 
     steps:
-      - name: checkout
-        uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
 
       - name: Restore vcpkg and its artifacts.
         uses: actions/cache@v4
@@ -232,10 +233,11 @@ jobs:
         with:
           path: |
             ${{ github.workspace }}/vcpkg_installed
-            ${{ env.VCPKG_ROOT }}/installed
             ${{ env.VCPKG_ROOT }}/downloads
-          key: ${{ runner.os }}-${{ matrix.triplet }}-${{ hashFiles('vcpkg.json') }}
-          restore-keys: ${{ runner.os }}-${{ matrix.triplet }}-
+            ${{ env.VCPKG_ROOT }}/vcpkg.exe
+          key: ${{ runner.os }}-${{ matrix.triplet }}-vcpkg-${{ hashFiles('vcpkg.json') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ matrix.triplet }}-vcpkg-
           save-always: true
 
       - name: Get vcpkg(windows)

From 72d680a3c505d90fd0d6f83311b0992f3b3b471d Mon Sep 17 00:00:00 2001
From: Yunze Xu <xyzinfernity@163.com>
Date: Tue, 3 Mar 2026 21:35:39 +0800
Subject: [PATCH 24/24] fix vcpkg clone failure

---
 .github/workflows/ci-pr-validation.yaml | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci-pr-validation.yaml b/.github/workflows/ci-pr-validation.yaml
index f6356a3d..8d14e7de 100644
--- a/.github/workflows/ci-pr-validation.yaml
+++ b/.github/workflows/ci-pr-validation.yaml
@@ -242,12 +242,25 @@ jobs:
 
       - name: Get vcpkg(windows)
         if: ${{ runner.os == 'Windows' && steps.vcpkg-cache.outputs.cache-hit != 'true' }}
+        shell: pwsh
         run: |
           cd ${{ github.workspace }}
-          mkdir build -force
-          git clone https://github.com/Microsoft/vcpkg.git
-          cd vcpkg
-          .\bootstrap-vcpkg.bat
+          mkdir build -Force
+          # If vcpkg.exe already exists, skip bootstrapping to save time and avoid
+          # modifying the checked-out vcpkg directory.
+          if (Test-Path "${{ github.workspace }}\\vcpkg\\vcpkg.exe") {
+            Write-Host "vcpkg.exe present — skipping bootstrap"
+          } else {
+            if (Test-Path vcpkg) {
+              # If vcpkg was checked out as a submodule it may be shallow; fetch full history
+              git -C vcpkg fetch --unshallow || true
+            } else {
+              git clone https://github.com/Microsoft/vcpkg.git
+            }
+            Push-Location vcpkg
+            .\bootstrap-vcpkg.bat
+            Pop-Location
+          }
 
       - name: remove system vcpkg(windows)
         if: runner.os == 'Windows'