This blog post summarizes changes to the vcpkg package manager as part of the 2026.02.27 and 2026.03.18 registry releases and the 2026-02-17, 2026-02-21, and 2026-03-04 tool releases. These updates include a security fix for OpenSSL packaging on Windows, parallel file installation for improved performance, and other improvements and bug fixes.

• There are now 2,773 total ports available in the vcpkg curated registry. A port is a versioned recipe for building a package from source, such as a C or C++ library.
• 42 new ports were added to the curated registry.
• 415 ports were updated in February and 321 ports were updated in March. As always, we validate each change to a port by building all other ports that depend on or are depended by the library that is being updated for our main triplets.
• 158 community contributors made commits.
• The main vcpkg repo has over 7,400 forks and 26,800 stars on GitHub.

vcpkg changelog (2026.02.27, 2026.03.18 releases)

• Security fix for OpenSSL on Windows: The 2026.03.18 release contains a fix for a vulnerability in how vcpkg packaged OpenSSL on Windows (CVE-2026-34054). If you only want to update OpenSSL, you can override the selected version to 3.6.1#3 or later (PR: Microsoft/vcpkg#50518).
• vcpkg now installs files in parallel, improving installation performance by an average of 1.39x in our testing (PR: Microsoft/vcpkg-tool#1896).
• vcpkg now uses libcurl directly for downloads instead of invoking the curl command line. This improves download reliability and performance (PR: Microsoft/vcpkg-tool#1906).
• Dependency resolution has been optimized for improved performance, thanks @dg0yt! (PR: Microsoft/vcpkg-tool#1891).
• Fixed missing executable permissions on downloaded tools for Unix systems, thanks @zynfly! (PR: Microsoft/vcpkg-tool#1911).
• Fixed mismatched VCPKG_ROOT warnings when Visual Studio has its own vcpkg installation (PR: Microsoft/vcpkg-tool#1931).
• Deduplication of additional_file entries in ABI info now improves binary cache hit rates (PR: Microsoft/vcpkg-tool#1914).
• The default minimum Ninja version has been updated to a more reasonable value, thanks @cqundefine! (PR: Microsoft/vcpkg-tool#1897).
• Other minor improvements and bug fixes.

Documentation updates

• The vcpkg maintainer guide was updated with revised policies for the curated registry, including guidelines for port maturity, project activity, port naming conventions, and PR review expectations (PR: MicrosoftDocs/vcpkg-docs#568).

Total ports available for tested triplets

While vcpkg supports a much larger variety of target platforms and architectures (as community triplets), the list above is validated exhaustively to ensure updated ports don’t break other ports in the catalog.

Thank you to our contributors

vcpkg couldn’t be where it is today without contributions from our open-source community. Thank you for your continued support! The following people contributed to the vcpkg, vcpkg-tool, or vcpkg-docs repos in this release (listed by commit author or GitHub username):

Learn more

You can find the main release notes on GitHub. Recent updates to the vcpkg tool can be viewed on the vcpkg-tool Releases page. To contribute to vcpkg documentation, visit the vcpkg-docs repo. If you’re new to vcpkg or curious about how a package manager can make your life easier as a C/C++ developer, check out the vcpkg website – vcpkg.io.

If you would like to contribute to vcpkg and its library catalog, or want to give us feedback on anything, check out our GitHub repo. Please report bugs or request updates to ports in our issue tracker or join more general discussion in our discussion forum.