How-To: Find Out Which zlib and LZ4 Your Linux Boxes Really Use

With zlib 1.4’s pile of security fixes out, here’s how I check my Omarchy machine and servers.

1. The system packages

• Omarchy/Arch: pacman -Q | grep -E '^(zlib|zlib-ng|lz4)'
• Debian/Ubuntu: dpkg -l | grep -E 'zlib1g|liblz4'
• Fedora/RHEL: rpm -qa | grep -E 'zlib|lz4' (Fedora uses zlib-ng-compat)

Stable distros often backport fixes without bumping to 1.4, so check the package changelog or your distro’s security tracker, not just the version number.

2. Across every server at once

ansible all -m ansible.builtin.package_facts -a 'manager=auto' --tree /tmp/pkgfacts

Then grep the saved JSON for zlib and lz4.

3. The copies your package manager doesn’t know about

Apps love to bundle their own zlib:

sudo find / -xdev \( -name 'libz.so*' -o -name 'liblz4.so*' \) 2>/dev/null | grep -vE '^/usr/lib(64)?/'

Anything under /opt, AppImages, or vendor tools only gets fixed when that vendor updates. Flatpak runtimes carry their own too, so run flatpak update.

4. Update and restart

Update normally (sudo pacman -Syu on Omarchy), then restart long-running services that loaded the old library. sudo lsof 2>/dev/null | grep -E 'libz.*(deleted)' shows what’s still holding it.

Review before you install: read the release notes yourself, back up your config, and try new versions somewhere you can afford to break first.

God Bless, and Happy hacking!

References & Further Reading

• Zlib 1.4 Released (Phoronix)
• zlib