[Joel Kiptoo (Kiptoo-Deus)]

Description

The GSL dependency is declared with FIND_PACKAGE_ARGS 4.0 NAMES Microsoft.GSL. Microsoft.GSL writes its config version file with SameMajorVersion, so an installed GSL 5.x (5.0.0 released August 2026) never matches. This change requests no version in FIND_PACKAGE_ARGS and checks the minimum after onnxruntime_fetchcontent_makeavailable(GSL).

Motivation and Context

When an installed GSL 5 is present:

• with downloads allowed, it is silently ignored and the bundled GSL 4.2.1 is fetched instead;
• with FetchContent disconnected (FETCHCONTENT_FULLY_DISCONNECTED, as in vcpkg), configuration fails at the static-library install(TARGETS GSL ...) with "install TARGETS given target "GSL" which does not exist".

The second case is what broke the onnxruntime port in microsoft/vcpkg#54418 (updating ms-gsl to 5.0.1). With the same FIND_PACKAGE_ARGS change applied to 1.23.2 there, onnxruntime builds against GSL 5.0.1 in vcpkg CI.

I checked the CMake logic in a small project that reproduces this FetchContent_Declare block, with these installed GSL versions:

installed GSL	before	after
5.0.1	not found, bundled GSL used	found, used
4.2.2	found, used	found, used
3.1.0	not found, bundled GSL used	configure error: "Microsoft.GSL 3.1.0 was found, but 4.0 or newer is required"
none	bundled GSL used	bundled GSL used

The installed package config for static builds had the same problem: cmake/CMakeLists.txt writes find_dependency(Microsoft.GSL 4.0), so a static ONNX Runtime built against GSL 5 could not be found by consumers. It now writes find_dependency(Microsoft.GSL) followed by the same 4.0 minimum check, which sets onnxruntime_FOUND to false with that message. I generated the config through the same file(WRITE) / configure_package_config_file path and loaded it with find_package(onnxruntime CONFIG): found with GSL 5.0.1 and 4.2.2, not found with GSL 3.1.0 (message shown).

The one behavior change is an installed GSL older than 4.0: it used to be skipped in favour of the bundled copy and now stops with that error.

Separately, GSL 5.0.0 includes microsoft/GSL#1213, so patches/gsl/1213.patch could be dropped when the bundled GSL is moved to 5.x. That isn't part of this change.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The exported static package configuration still rejects GSL 5.x consumers.

1 open finding

• Apply version-independent GSL lookup to exported package config · New

What changed in this PR

Allows installed Microsoft.GSL 5.x packages while enforcing GSL 4.0 as the minimum.

Changes:

• Removes the major-version-constrained package lookup.
• Adds an explicit minimum-version check.

File	Description
cmake/​external/​onnxruntime_external_deps.cmake	Updates GSL discovery and version validation.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The new dependency-resolution matrix lacks automated regression coverage.

1 open finding

• Add regression tests for Microsoft.GSL version selection · New

1 resolved since last review

• Apply version-independent GSL lookup to exported package config

🧠 Review effort: Balanced