How do you find which C library version pkg-config gives you?

Ask the tool directly. The modversion option of pkg-config style tools prints the version of an installed library, and the exists and atleast version checks test it. Which copy you get depends on the search path, so check the path as well as the number before you trust the answer.

The commands

pkgconf --modversion zlib
pkgconf --exists --print-errors "zlib >= 1.2.12"
pkgconf --cflags --libs zlib

The pkgconf manual lists modversion among the output options, and cflags and libs as the most important ones for compiling and linking. With modversion, only the modules named on the command line are inspected and no dependency resolution is attempted, so it reports that package's own version, not its dependencies.

The search path trap

The manual says the .pc files are searched along a path built from the with path option, the PKG_CONFIG_PATH and PKG_CONFIG_LIBDIR environment variables, and compiled in default directories. It also describes an env only mode that uses the with path option and PKG_CONFIG_PATH only.

In practice that means two machines can answer differently. A developer laptop may find a Homebrew or locally built copy first, while the build server finds the distribution copy. A scan of one does not describe the other.

Why this matters for dependency security

Libraries found through pkg-config are system libraries as far as your project is concerned. They are not in a lockfile. Nothing in your repository says which version you shipped, unless you record it.

For security that creates two questions: which version went into the build, and who patches it. For an application you ship in a container, the answer is whatever the image contained. See who patches the C library with FetchContent or find_package.

A recording routine

1. In CI, print the modversion of each library you depend on and save it as a build artifact.
2. Print the search path variables in the same job.
3. Fail the build when a library is older than the minimum version you set with the atleast check, using a floor taken from a recent advisory.
4. Feed the recorded versions into your SBOM. A purl for C libraries is covered in which purl type for C and C++ libraries.
5. Rebuild images when the base distribution ships a security update.

A caution about shell expansion

The pkgconf manual notes that output of the cflags and libs options is word split and pathname expanded when used in a command substitution, so a value with unusual characters may reach the toolchain with escaping still present. Treat .pc files from untrusted sources as code you are running.

Safeguard's dependency scanning and SBOM generation can inventory the libraries in your images and repositories. Try the free scan at gold.safeguard.sh/scan.

Quick check

Sources

• pkgconf manual

Last reviewed: 19 October 2026.