Boost 1.92 Lands With a C++14 Deadline and Breaking MSM Changes

Boost 1.92.0 was posted for download on August 12, 2026, according to Boost’s official release calendar. The release changes Windows deployment and CMake package consumption, fixes several network-facing parsers, sets a C++14 deadline for Heap and Lockfree, and introduces incompatible behavior in MSM’s backmp11 backend.

A same-day C++ community summary also identifies the DLL destination, language-standard deadline and MSM event-queue change as headline migration concerns. For working teams, the highest risks are projects that assume the old Windows installation layout, request every CMake component through one shortcut, remain on C++14 or depend on backmp11’s previous event-processing behavior.

The official Boost 1.92.0 release notes provide the downloads, checksums and library-level details behind these changes. The package is available now; whether an upgrade is routine or disruptive depends mainly on the libraries and installation paths a project uses.

Windows DLLs move to the binary directory

The most immediate packaging change affects Windows installations produced by b2 install. Previous releases placed DLL files in the library directory—normally <PREFIX>/lib—except on Cygwin; Boost 1.92 installs them consistently in the binary directory, normally <PREFIX>/bin.

This changes an observable installation contract. Packaging scripts, deployment manifests and test environments that copy DLLs from lib, or expose only that location through PATH, may no longer find the runtime libraries after an otherwise successful build.

A new --dlldir option allows the destination to be overridden, including setting it back to <PREFIX>/lib while downstream packaging is updated. The compatibility switch limits immediate disruption, but it also means installation commands now influence a path that older automation may have treated as fixed.

The CMake configuration installed by b2 install now recognizes header-only libraries as find_package components. A request such as find_package(Boost REQUIRED COMPONENTS mp11) can therefore define Boost::mp11, matching the behavior of configurations produced when Boost itself is built with CMake.

That regularization removes one shortcut: COMPONENTS ALL is no longer supported. Projects using it must list the Boost components they consume rather than relying on a request that was not supported by Boost’s CMake build or by FindBoost.

Heap and Lockfree reach their C++14 cutoff

Boost 1.92 is the last release in which Boost.Heap and Boost.Lockfree support C++14. Later releases of those two libraries will require C++17. This is a library-specific cutoff, not a suite-wide declaration that every Boost component now requires C++17.

The practical consequence is version pressure rather than an immediate failure in 1.92. A project can build these libraries in C++14 with the current release, but a later Boost update will require affected targets to move to C++17, remain pinned to 1.92 or stop using those components.

Lockfree also adds mpsc_weak_queue for multiple producers and one consumer, plus bounded_ticket_queue, a bounded ring-buffer-based MPMC queue. Their progress guarantees have important limits: mpsc_weak_queue is not linearizable and can lose progress if a producer stalls between updating the tail and linking its node, while bounded_ticket_queue is wait-free only in its single-producer, single-consumer configuration.

MSM backmp11 changes event-processing behavior

The largest API-compatibility risk sits in Boost.MSM’s experimental C++17 backmp11 backend. Events passed to process_event while another event is being processed are no longer queued automatically, a change intended to avoid instantiating queue support and its memory cost for every event type.

Actions that need deferred processing must call enqueue_event explicitly. Existing code may still compile while losing an expected follow-on event, making state-machine regression tests more informative than compilation alone for this part of the upgrade.

Constructor behavior changes as well. The backend no longer forwards constructor arguments to the frontend, which must now be default-constructible; custom constructors belong in the backend. The deprecated process_queued_events and process_single_queued_event functions have also been removed in favor of process_event_pool.

The default active-state switch policy is now “after source exit” to follow UML semantics. Backmp11 also adopts its own process_result type and new enum values instead of aliases from the older backend, so action ordering, construction, transition state and result comparisons can all expose compatibility differences.

Security fixes tighten network-facing parsing

Boost.URL fixes a heap buffer overflow in normalize_path for authority-less URLs whose normalized path begins with two slashes. It also addresses an uninitialized read involving a malformed embedded IPv4 address in an IPv6 rule, unsigned-integer-overflow sanitizer findings and defects found during a third security-review round.

Boost.Beast tightens HTTP parsing and framing. Its parser rejects Content-Length combined with Transfer-Encoding regardless of field order, rejects chunked transfer encoding in HTTP/1.0 requests, validates quoted strings in chunk extensions and removes framing or connection-control fields carried in trailers.

Beast also rejects transfer encodings that do not end in chunked and WebSocket frame lengths whose high bit is set. Boost.MQTT5 adds missing length checks for packets received from a broker; malformed packets could previously trigger out-of-bounds reads or excessive memory allocation.

The release notes do not list CVE identifiers or severity scores for these entries. Even without those classifications, applications that accept untrusted URLs, HTTP messages, WebSocket frames or MQTT packets have a more direct exposure to the corrected parsing paths than projects that use only Boost’s non-networking libraries.

CUDA, modules and containers broaden the release

Boost 1.92 also makes integer to_chars and from_chars usable in CUDA kernels. Decimal adds initial CUDA support for decimal32_t, decimal64_t and decimal128_t, while Math fixes CUDA compilation cases in which host functions were incorrectly marked as device functions.

C++20 module work covers Conversion, DLL, LexicalCast, PFR, Stacktrace and TypeIndex. Unordered adds C++20 ranges interoperability across its containers, including range insertion and construction, and Graph gains Louvain community detection for modularity-based clustering.

Container introduces hub and unchecked insertion operations for vector, static_vector and small_vector. Hash2 gains built-in handling for std::optional, std::variant and std::monostate.

As of the release, the main compatibility boundaries are documented but their downstream impact remains project-specific. The next unresolved decisions sit with C++14 codebases planning future Heap or Lockfree updates and with backmp11 users whose tests must establish whether explicit queuing and the revised transition behavior preserve their intended state machines.

Also read:

• 11 Crypto Web Development Companies—and the Security Test That Changes the List
• How Enhanced Security Can Boost Your Digital Marketing Strategies
• Five Business VPN Benefits—And the Limit That Changes the Buying Decision