zlib 1.4 with security fixes: how to map and update dependencies

What happened and what to do

On November 5, 2026, Alan Coopersmith posted the release of zlib 1.4, a compression library widely used by operating systems and applications, on the oss-sec list. The post states that the version includes security fixes and points to the release notes published in the project's official GitHub repository, where the fixes are listed.

For a company, the practical point is knowing where zlib is present, including embedded in container images, static binaries and third-party dependencies. A consistent response combines a component inventory (SBOM) generated in the build pipeline, continuous dependency scanning that flags affected versions, and an update workflow with automated tests and a recorded approval. In internal data and AI services, the same inventory covers packaging libraries and APIs, which often pull in zlib indirectly.

How the consultancy can help

Diagnosis of exposure to zlib 1.4: a survey of where the library appears in your software estate, including containers and transitive dependencies, and a proposed pipeline with SBOM and continuous scanning to speed up future updates, deployed on your infrastructure.

Next step

Send a short description of your environment, such as systems, containers and build pipelines in use, and receive a proposal with scope, timeline and delivery format for the diagnosis and implementation.