diffstat for openexr-3.4.6+ds openexr-3.4.14 .github/dependabot.yml | 12 .github/workflows/analysis_workflow.yml | 12 .github/workflows/bazel_build.yml | 12 .github/workflows/ci_freebsd.yml | 60 .github/workflows/ci_steps.yml | 48 .github/workflows/ci_workflow.yml | 24 .github/workflows/ci_workflow_old.yml | 3 .github/workflows/codeql.yml | 14 .github/workflows/ossfuzz_workflow.yml | 2 .github/workflows/python-wheels-publish-test.yml | 109 - .github/workflows/python-wheels-publish.yml | 105 - .github/workflows/python-wheels.yml | 86 - .github/workflows/release-notice.yml | 5 .github/workflows/release-sign.yml | 22 .github/workflows/scorecard.yml | 8 .github/workflows/snyk-scan-cron.yml | 2 .github/workflows/website.yml | 4 .github/workflows/website_preview_link.yml | 35 .gitignore | 1 .readthedocs.yml | 3 CHANGES.md | 1183 +++++++++++++-- CONTRIBUTING.md | 429 ++--- MODULE.bazel | 6 README.md | 8 SECURITY.md | 159 +- cmake/CMakeLists.txt | 12 cmake/LibraryDefine.cmake | 4 cmake/OpenEXRConfig.cmake.in | 2 cmake/OpenEXRConfig.h.in | 4 cmake/OpenEXRSetup.cmake | 5 debian/changelog | 38 debian/control | 1 debian/patches/hack-test-armhf.patch | 16 debian/patches/hurd-no-sa_restorer.patch | 14 debian/patches/series | 2 debian/rules | 16 pyproject.toml | 11 share/ci/install_manifest/install_manifest.linux.13.txt | 206 ++ share/ci/scripts/install_imath.sh | 10 share/ci/scripts/install_openjph.sh | 10 share/util/release.py | 825 ++++++++++ share/util/release/__init__.py | 4 share/util/release/_common.py | 164 ++ share/util/release/_security.py | 225 ++ share/util/release/candidate.py | 53 share/util/release/changes.py | 288 +++ share/util/release/cherry.py | 97 + share/util/release/draft.py | 39 share/util/release/log.py | 73 share/util/release/news.py | 131 + share/util/release/notes.py | 27 share/util/release/tag.py | 31 share/util/vendor_openjph.sh | 45 src/bin/exrmetrics/exrmetrics.cpp | 68 src/bin/exrmetrics/exrmetrics.h | 1 src/bin/exrmetrics/main.cpp | 73 src/bin/exrmultipart/exrmultipart.cpp | 29 src/bin/exrmultiview/makeMultiView.cpp | 8 src/lib/OpenEXR/ImfAcesFile.h | 2 src/lib/OpenEXR/ImfArray.h | 51 src/lib/OpenEXR/ImfCRgbaFile.h | 5 src/lib/OpenEXR/ImfCompression.cpp | 4 src/lib/OpenEXR/ImfContext.h | 2 src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp | 26 src/lib/OpenEXR/ImfDeepScanLineInputFile.h | 2 src/lib/OpenEXR/ImfDeepScanLineOutputFile.h | 2 src/lib/OpenEXR/ImfDeepTiledInputFile.cpp | 20 src/lib/OpenEXR/ImfDeepTiledInputFile.h | 2 src/lib/OpenEXR/ImfDeepTiledOutputFile.h | 2 src/lib/OpenEXR/ImfIDManifest.cpp | 58 src/lib/OpenEXR/ImfIO.h | 10 src/lib/OpenEXR/ImfInputFile.h | 2 src/lib/OpenEXR/ImfInputPart.cpp | 14 src/lib/OpenEXR/ImfInputPart.h | 1 src/lib/OpenEXR/ImfMisc.h | 4 src/lib/OpenEXR/ImfMultiPartInputFile.h | 4 src/lib/OpenEXR/ImfMultiPartOutputFile.h | 2 src/lib/OpenEXR/ImfMultiView.cpp | 2 src/lib/OpenEXR/ImfName.h | 1 src/lib/OpenEXR/ImfOutputFile.h | 2 src/lib/OpenEXR/ImfRgbaFile.cpp | 6 src/lib/OpenEXR/ImfRgbaFile.h | 2 src/lib/OpenEXR/ImfScanLineInputFile.cpp | 3 src/lib/OpenEXR/ImfScanLineInputFile.h | 3 src/lib/OpenEXR/ImfSimd.h | 14 src/lib/OpenEXR/ImfStandardAttributes.cpp | 16 src/lib/OpenEXR/ImfStdIO.h | 4 src/lib/OpenEXR/ImfTestFile.h | 4 src/lib/OpenEXR/ImfTiledInputFile.h | 2 src/lib/OpenEXR/ImfTiledMisc.cpp | 2 src/lib/OpenEXR/ImfTiledOutputFile.h | 2 src/lib/OpenEXR/ImfTiledRgbaFile.cpp | 6 src/lib/OpenEXR/ImfTiledRgbaFile.h | 2 src/lib/OpenEXR/ImfZip.cpp | 6 src/lib/OpenEXRCore/CMakeLists.txt | 14 src/lib/OpenEXRCore/bytes.c | 18 src/lib/OpenEXRCore/channel_list.c | 7 src/lib/OpenEXRCore/chunk.c | 25 src/lib/OpenEXRCore/compression.c | 6 src/lib/OpenEXRCore/decoding.c | 42 src/lib/OpenEXRCore/encoding.c | 20 src/lib/OpenEXRCore/internal_b44.c | 33 src/lib/OpenEXRCore/internal_cpuid.h | 4 src/lib/OpenEXRCore/internal_dwa_compressor.h | 87 - src/lib/OpenEXRCore/internal_dwa_decoder.h | 21 src/lib/OpenEXRCore/internal_dwa_encoder.h | 8 src/lib/OpenEXRCore/internal_dwa_simd.h | 52 src/lib/OpenEXRCore/internal_ht.cpp | 89 - src/lib/OpenEXRCore/internal_ht_common.cpp | 28 src/lib/OpenEXRCore/internal_ht_common.h | 54 src/lib/OpenEXRCore/internal_piz.c | 39 src/lib/OpenEXRCore/internal_pxr24.c | 10 src/lib/OpenEXRCore/internal_structs.c | 59 src/lib/OpenEXRCore/internal_thread.h | 29 src/lib/OpenEXRCore/internal_util.h | 29 src/lib/OpenEXRCore/internal_zip.c | 29 src/lib/OpenEXRCore/openexr_version.h | 2 src/lib/OpenEXRCore/parse_header.c | 4 src/lib/OpenEXRCore/part.c | 10 src/lib/OpenEXRCore/part_attr.c | 69 src/lib/OpenEXRCore/preview.c | 18 src/lib/OpenEXRCore/string.c | 28 src/lib/OpenEXRCore/unpack.c | 74 src/lib/OpenEXRUtil/ImfCheckFile.h | 2 src/lib/OpenEXRUtil/ImfDeepImageChannel.h | 4 src/lib/OpenEXRUtil/ImfDeepImageIO.h | 2 src/lib/OpenEXRUtil/ImfFlatImageChannel.h | 4 src/lib/OpenEXRUtil/ImfFlatImageIO.h | 2 src/lib/OpenEXRUtil/ImfImage.cpp | 143 + src/lib/OpenEXRUtil/ImfImageChannel.cpp | 22 src/lib/OpenEXRUtil/ImfImageIO.h | 2 src/lib/OpenEXRUtil/ImfImageLevel.cpp | 5 src/lib/OpenEXRUtil/ImfSampleCountChannel.cpp | 23 src/lib/OpenEXRUtil/ImfSampleCountChannel.h | 2 src/test/OpenEXRCoreTest/CMakeLists.txt | 2 src/test/OpenEXRCoreTest/base_units.cpp | 2 src/test/OpenEXRCoreTest/compression.cpp | 76 src/test/OpenEXRCoreTest/compression.h | 1 src/test/OpenEXRCoreTest/general_attr.cpp | 85 + src/test/OpenEXRCoreTest/main.cpp | 2 src/test/OpenEXRCoreTest/read.cpp | 118 + src/test/OpenEXRCoreTest/read.h | 2 src/test/OpenEXRCoreTest/write.cpp | 29 src/test/OpenEXRTest/CMakeLists.txt | 3 src/test/OpenEXRTest/TestUtilFStream.h | 20 src/test/OpenEXRTest/main.cpp | 2 src/test/OpenEXRTest/testCompressionApi.cpp | 4 src/test/OpenEXRTest/testExistingStreams.cpp | 49 src/test/OpenEXRTest/testMagic.cpp | 92 + src/test/OpenEXRTest/testMultiView.cpp | 7 src/test/OpenEXRTest/testOptimized.cpp | 607 ------- src/test/OpenEXRTest/testOptimized.h | 8 src/test/OpenEXRTest/testOptimizedInterleavePatterns.cpp | 29 src/test/OpenEXRTest/testStandardAttributes.cpp | 17 src/test/OpenEXRUtilTest/CMakeLists.txt | 3 src/test/OpenEXRUtilTest/main.cpp | 2 src/test/OpenEXRUtilTest/testDeepImage.cpp | 103 + src/test/OpenEXRUtilTest/testFlatImage.cpp | 25 src/test/OpenEXRUtilTest/testImageChannel.cpp | 82 + src/test/OpenEXRUtilTest/testImageChannel.h | 8 src/test/bin/test_exrmetrics.py | 5 src/wrappers/python/PyOpenEXR.cpp | 841 ++++++---- src/wrappers/python/PyOpenEXR.h | 8 src/wrappers/python/tests/test_deep.py | 111 + src/wrappers/python/tests/test_exceptions.py | 20 src/wrappers/python/tests/test_rgba.py | 33 src/wrappers/python/tests/test_unittest.py | 254 +++ src/wrappers/python/tests/unfinished_multipart.exr |binary website/ReadingAndWritingImageFiles.rst | 53 website/TechnicalIntroduction.rst | 37 website/bin/exrmetrics.rst | 5 website/index.rst | 21 website/install.rst | 80 + website/latest_news_title.rst | 8 website/news.rst | 282 +++ website/requirements-lock.txt | 323 ++++ website/requirements.txt | 11 website/src/exrreader/CMakeLists.txt | 1 website/src/exrreader_max/CMakeLists.txt | 12 website/src/exrreader_max/exrreader_max.cpp | 100 + 180 files changed, 7842 insertions(+), 2034 deletions(-) diff -Nru openexr-3.4.6+ds/CHANGES.md openexr-3.4.14/CHANGES.md --- openexr-3.4.6+ds/CHANGES.md 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/CHANGES.md 2026-08-05 04:29:55.000000000 +0300 @@ -3,6 +3,14 @@ # OpenEXR Release Notes +* [Version 3.4.14](#version-3414-august-6-2026) August 6, 2026 +* [Version 3.4.13](#version-3413-june-19-2026) June 19, 2026 +* [Version 3.4.12](#version-3412-may-24-2026) May 24, 2026 +* [Version 3.4.11](#version-3411-april-29-2026) April 29, 2026 +* [Version 3.4.10](#version-3410-april-17-2026) April 17, 2026 +* [Version 3.4.9](#version-349-april-3-2026) April 3, 2026 +* [Version 3.4.8](#version-348-march-26-2026) March 26, 2026 +* [Version 3.4.7](#version-347-march-15-2026) March 15, 2026 * [Version 3.4.6](#version-346-march-1-2026) March 1, 2026 * [Version 3.4.5](#version-345-february-21-2026) February 21, 2026 * [Version 3.4.4](#version-344-november-19-2025) November 19, 2025 @@ -10,6 +18,10 @@ * [Version 3.4.2](#version-342-october-15-2025) October 15, 2025 * [Version 3.4.1](#version-341-october-8-2025) October 8, 2025 * [Version 3.4.0](#version-340-september-5-2025) September 5, 2025 +* [Version 3.3.11](#version-3311-april-29-2026) April 29, 2026 +* [Version 3.3.10](#version-339-april-17-2026) April 17, 2026 +* [Version 3.3.9](#version-339-april-4-2026) April 4, 2026 +* [Version 3.3.8](#version-338-march-1-2026) March 1, 2026 * [Version 3.3.7](#version-337-february-19-2026) February 19, 2026 * [Version 3.3.6](#version-336-november-4-2025) November 5, 2025 * [Version 3.3.5](#version-335-july-26-2025) July 26, 2025 @@ -18,6 +30,11 @@ * [Version 3.3.2](#version-332-november-11-2024) November 11, 2024 * [Version 3.3.1](#version-331-october-8-2024) October 8, 2024 * [Version 3.3.0](#version-330-september-30-2024) September 30, 2024 +* [Version 3.2.9](#version-329-april-29-2026) April 29, 2026 +* [Version 3.2.8](#version-328-april-17-2026) April 17, 2026 +* [Version 3.2.7](#version-327-april-3-2026) April 3, 2026 +* [Version 3.2.6](#version-326-march-1-2026) March 1, 2026 +* [Version 3.2.5](#version-325-november-4-2025) November 4, 2025 * [Version 3.2.4](#version-324-march-26-2024) March 26, 2024 * [Version 3.2.3](#version-323-march-6-2024) March 6, 2024 * [Version 3.2.2](#version-322-february-11-2024) February 11, 2024 @@ -89,6 +106,723 @@ * [Version 1.0.1](#version-101) * [Version 1.0](#version-10) +## Version 3.4.14 (August 6, 2026) + +v3.4.14 is a security-focused patch release. It fixes 15 CVEs plus a +broad set of additional hardening changes uncovered by the same +fuzzing/audit effort. + +For each of these vulnerabilities, an attacker's vector is a +maliciously crafted `.exr` file that must be opened by a victim, +whether through the OpenEXR/OpenEXRUtil C++ libraries, the +command-line tools (`exrmetrics`, `exrmultiview`, `exrmultipart`), or +the PyOpenEXR Python bindings. The primary flaw for most of the CVEs +is **memory corruption** — heap buffer overflows and out-of-bounds +reads/writes — which at minimum crashes the reading process (denial of +service) and in several cases could plausibly be leveraged for +information disclosure or, in the worst cases, arbitrary code +execution. + +No user interaction beyond opening the file is required, so any +pipeline, service, or application that decodes untrusted or +third-party EXR files should treat this as a priority +upgrade. Severity generally ranges from **moderate** (crash-only, or +requiring an uncommon build configuration) to **high** (heap overflow +reachable with a small, easily-crafted file on common configurations). + +The individual vulnerabilities fall into four broad groups: + +* **PyOpenEXR RGB-channel-coalescing bugs** + ([CVE-2026-68514](https://www.cve.org/CVERecord?id=CVE-2026-68514), + [CVE-2026-68513](https://www.cve.org/CVERecord?id=CVE-2026-68513), + [CVE-2026-62986](https://www.cve.org/CVERecord?id=CVE-2026-62986), + [CVE-2026-61703](https://www.cve.org/CVERecord?id=CVE-2026-61703)). + When the Python bindings combine per-channel data (e.g. `left.R`, + `left.G`, `left.B`) into a single coalesced RGB array, conflicting or + mismatched channel names/types were not fully validated, which could + undersize the destination NumPy buffer. The result is a heap buffer + overflow on read, or, in the deep-image case, disclosure of + uninitialized ("stale") heap memory through the returned array. This + affects only code paths that read files with `separate_channels=False` + (the default for RGB coalescing). + +* **Integer-overflow-driven heap overflows on 32-bit (ILP32) builds** + ([CVE-2026-59985](https://www.cve.org/CVERecord?id=CVE-2026-59985), + [CVE-2026-59984](https://www.cve.org/CVERecord?id=CVE-2026-59984), + [CVE-2026-59983](https://www.cve.org/CVERecord?id=CVE-2026-59983), + [CVE-2026-59982](https://www.cve.org/CVERecord?id=CVE-2026-59982), + [CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981), + [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189), + [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186)). + On platforms where `size_t`/`int` are 32 bits, buffer sizes computed + from attacker-controlled header fields (dimensions, sample counts, + tile sizes) could overflow before an allocation or bounds check, + yielding an undersized buffer and a subsequent heap out-of-bounds + read or write during RLE, B44/B44A, or DWAA decompression, deep + sample-count-table decoding, or large-tile handling. These do not + affect typical 64-bit desktop/server builds, but are significant for + 32-bit Linux, embedded, and some mobile/CI targets. + +* **Heap out-of-bounds access in `OpenEXRUtil` and the command-line + tools with non-default data windows** + ([CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981), + [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189), + [CVE-2026-59187](https://www.cve.org/CVERecord?id=CVE-2026-59187), + [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186), + [CVE-2026-59184](https://www.cve.org/CVERecord?id=CVE-2026-59184)). + `FlatImageChannel`/`DeepImageChannel`/`SampleCountChannel` row + addressing, and the deep-pixel path in `exrmetrics`, assumed a + data window originating at (0, 0). Crafted files with a nonzero data + window origin, or subsampled channels, caused row-address + computations to land outside the allocated buffer, producing a heap + read or write out of bounds. + +* **Crashes from malformed metadata (denial of service)** + ([CVE-2026-61555](https://www.cve.org/CVERecord?id=CVE-2026-61555), + [CVE-2026-59183](https://www.cve.org/CVERecord?id=CVE-2026-59183)). + An empty `multiView` attribute could crash `viewFromChannelName()`, + and a signed integer overflow while decoding deep tile chunks could + lead to an out-of-bounds access. Both are reachable simply by opening + a crafted file and result in a crash rather than corrupting memory + in an attacker-controlled way. + +Beyond the formally-numbered CVEs, this release includes a large batch +of fixes found by the same audit/fuzzing effort: + +* reject truncated or short compressed streams before unpacking + (zlib, RLE, DWA, `NO_COMPRESSION`) instead of reading past the end + of the input; + +* reject oversized allocation requests instead of overflowing size + computations (`Array2D`, exrmetrics, exrmultipart channel stores, + DWAA/B44 scratch buffers); + +* add `NULL`-pointer checks in several `OpenEXRCore` C-API setters + (channel list duplication, preview image, `bytes` attributes); + +* fix a `Name::operator=` truncation/termination bug; + +* close a double-free warning in `ImfTiledMisc`. + +This release also fixes a long-standing correctness bug (not a +security issue) in byte-swapping float-vector attributes that caused +incorrect results and test failures on big-endian s390x builds. + +This release also bumps the vendored OpenJPH version to 0.31.0. + +CVEs addressed: + +* [CVE-2026-68514](https://www.cve.org/CVERecord?id=CVE-2026-68514) + PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow +* [CVE-2026-68513](https://www.cve.org/CVERecord?id=CVE-2026-68513) + PyOpenEXR prefixed literal RGB key collision heap buffer overflow +* [CVE-2026-62986](https://www.cve.org/CVERecord?id=CVE-2026-62986) + PyOpenEXR deep prefixed RGB stale lane disclosure +* [CVE-2026-61703](https://www.cve.org/CVERecord?id=CVE-2026-61703) + PyOpenEXR deep mixed RGB heap buffer overflow +* [CVE-2026-61555](https://www.cve.org/CVERecord?id=CVE-2026-61555) + empty multiView viewFromChannelName file crash +* [CVE-2026-59985](https://www.cve.org/CVERecord?id=CVE-2026-59985) + ILP32 OpenEXRCore RLE decode heap OOB read DoS +* [CVE-2026-59984](https://www.cve.org/CVERecord?id=CVE-2026-59984) + ILP32 B44 InputFile decode scratch buffer overflow +* [CVE-2026-59983](https://www.cve.org/CVERecord?id=CVE-2026-59983) + ILP32 DeepTiledInputFile sample count table decode OOB read +* [CVE-2026-59982](https://www.cve.org/CVERecord?id=CVE-2026-59982) + ILP32 DWAA InputFile packed AC buffer overflow +* [CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981) + OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read +* [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189) + OpenEXRUtil DeepImageChannel row nonzero dataWindow heap OOB read +* [CVE-2026-59187](https://www.cve.org/CVERecord?id=CVE-2026-59187) + OpenEXR exrmetrics deep pixelmode heap buffer overflow +* [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186) + OpenEXR ILP32 TiledRgbaInputFile large tile Array2D heap OOB write +* [CVE-2026-59184](https://www.cve.org/CVERecord?id=CVE-2026-59184) + OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write +* [CVE-2026-59183](https://www.cve.org/CVERecord?id=CVE-2026-59183) + Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding + +### Merged Pull Requests + +* [2569](https://github.com/AcademySoftwareFoundation/openexr/pull/2569) + Fix MSYS2 MINGW32 CI: build Imath/OpenJPH from source instead of pacboy +* [2567](https://github.com/AcademySoftwareFoundation/openexr/pull/2567) + Fix handling of subsampled channels in PyOpenEXR +* [2566](https://github.com/AcademySoftwareFoundation/openexr/pull/2566) + Reject DWA RLE and UNKNOWN streams shorter than required channel data. +* [2565](https://github.com/AcademySoftwareFoundation/openexr/pull/2565) + fix signed/unsigned wraparound in HTJ2K planar decode row loop +* [2550](https://github.com/AcademySoftwareFoundation/openexr/pull/2550) + zero-fill deep sample-count table for zero-length compressed input +* [2548](https://github.com/AcademySoftwareFoundation/openexr/pull/2548) + Reject ``NO_COMPRESSION`` scanline chunks with short packed size. +* [2547](https://github.com/AcademySoftwareFoundation/openexr/pull/2547) + Reject short zlib inflates before pixel unpack. +* [2543](https://github.com/AcademySoftwareFoundation/openexr/pull/2543) + Fix subsampled row addressing in ``generic_unpack`` for multi-line chunks +* [2541](https://github.com/AcademySoftwareFoundation/openexr/pull/2541) + Reject oversized channelstore allocations in exrmultipart convert +* [2540](https://github.com/AcademySoftwareFoundation/openexr/pull/2540) + Reject oversized Array2D allocations on ILP32 +* [2539](https://github.com/AcademySoftwareFoundation/openexr/pull/2539) + Reject oversized exrmetrics vector allocations on ILP32 +* [2535](https://github.com/AcademySoftwareFoundation/openexr/pull/2535) + Fix missing ``INT_MAX`` cap on deep scanline ``sample_count_table_size`` +* [2530](https://github.com/AcademySoftwareFoundation/openexr/pull/2530) + Fix exrmultiview heap OOB when union dataWindow misaligns with subsampling +* [2529](https://github.com/AcademySoftwareFoundation/openexr/pull/2529) + Refuse to coalesce RGB channels when there's a conflicting channel name +* [2528](https://github.com/AcademySoftwareFoundation/openexr/pull/2528) + Fix exrmetrics heap OOB on subsampled scanlines +* [2527](https://github.com/AcademySoftwareFoundation/openexr/pull/2527) + Upgrade manylinux cibuildwheel images to manylinux_2_28 +* [2522](https://github.com/AcademySoftwareFoundation/openexr/pull/2522) + Fix name comparison in deep prefixed RGB channel coalescing +* [2516](https://github.com/AcademySoftwareFoundation/openexr/pull/2516) + htj2k: Check for duplication ``file_index`` values when reading file header +* [2510](https://github.com/AcademySoftwareFoundation/openexr/pull/2510) + Core: byte-swap the float vector data, not the attribute struct (fixes big-endian crash) +* [2509](https://github.com/AcademySoftwareFoundation/openexr/pull/2509) + Return native-order deep sample counts from ``exr_read_deep_chunk`` +* [2504](https://github.com/AcademySoftwareFoundation/openexr/pull/2504) + fix --help message in exrmetrics +* [2503](https://github.com/AcademySoftwareFoundation/openexr/pull/2503) + prevent warning of potential double-free in ImfTiledMisc +* [2502](https://github.com/AcademySoftwareFoundation/openexr/pull/2502) + Reject mixed pixel types when coalescing RGB channels in PyOpenEXR. +* [2500](https://github.com/AcademySoftwareFoundation/openexr/pull/2500) + Fix ``Name::operator=`` to null-terminate long strings +* [2498](https://github.com/AcademySoftwareFoundation/openexr/pull/2498) + Avoid memory allocation in idmanifest parsing +* [2496](https://github.com/AcademySoftwareFoundation/openexr/pull/2496) + Fix empty multiView crash in ``viewFromChannelName()`` +* [2494](https://github.com/AcademySoftwareFoundation/openexr/pull/2494) + Reject oversized DWAA buffer allocations on ILP32 +* [2493](https://github.com/AcademySoftwareFoundation/openexr/pull/2493) + Fix ILP32 unpacked buffer size truncation in RLE decode +* [2492](https://github.com/AcademySoftwareFoundation/openexr/pull/2492) + Fix ILP32 deep sample-count table size overflow in decoding +* [2491](https://github.com/AcademySoftwareFoundation/openexr/pull/2491) + Fix ILP32 B44/B44A scratch buffer overflow in decode +* [2490](https://github.com/AcademySoftwareFoundation/openexr/pull/2490) + Reject negative pixelDataSize in ``rawPixelDataToBuffer()`` +* [2488](https://github.com/AcademySoftwareFoundation/openexr/pull/2488) + Fix OpenEXRUtil ``row()`` OOB read with non-zero data window origin +* [2487](https://github.com/AcademySoftwareFoundation/openexr/pull/2487) + Fix deep pixelmode heap buffer overflow in exrmetrics +* [2486](https://github.com/AcademySoftwareFoundation/openexr/pull/2486) + Fix integer overflow in ``Array2D::resizeErase()`` on ILP32/LLP64 builds +* [2484](https://github.com/AcademySoftwareFoundation/openexr/pull/2484) + Fix signed integer overflow in ``unpack_sample_table()`` +* [2473](https://github.com/AcademySoftwareFoundation/openexr/pull/2473) + Reject NULL channel list entries in ``exr_attr_chlist_duplicate()`` +* [2469](https://github.com/AcademySoftwareFoundation/openexr/pull/2469) + Reject NULL preview rgba data in ``exr_attr_set_preview()`` + +### Merged Workflow Pull Requests + +* [2568](https://github.com/AcademySoftwareFoundation/openexr/pull/2568) + Bump the codeql group with 3 updates +* [2564](https://github.com/AcademySoftwareFoundation/openexr/pull/2564) + Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 +* [2563](https://github.com/AcademySoftwareFoundation/openexr/pull/2563) + Bump sigstore/gh-action-sigstore-python from 3.4.0 to 3.5.0 +* [2558](https://github.com/AcademySoftwareFoundation/openexr/pull/2558) + Bump bazel_skylib from 1.9.0 to 1.9.2 +* [2557](https://github.com/AcademySoftwareFoundation/openexr/pull/2557) + Bump ossf/scorecard-action from 2.4.3 to 2.4.4 +* [2556](https://github.com/AcademySoftwareFoundation/openexr/pull/2556) + Bump the codeql group with 3 updates +* [2555](https://github.com/AcademySoftwareFoundation/openexr/pull/2555) + Bump actions/checkout from 7.0.0 to 7.0.1 +* [2554](https://github.com/AcademySoftwareFoundation/openexr/pull/2554) + Bump actions/setup-python from 6.3.0 to 7.0.0 +* [2553](https://github.com/AcademySoftwareFoundation/openexr/pull/2553) + Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 +* [2552](https://github.com/AcademySoftwareFoundation/openexr/pull/2552) + Bump vmactions/freebsd-vm from 1.5.0 to 1.5.2 +* [2551](https://github.com/AcademySoftwareFoundation/openexr/pull/2551) + Bump the codeql group with 3 updates +* [2538](https://github.com/AcademySoftwareFoundation/openexr/pull/2538) + Bump rules_cc from 0.2.20 to 0.2.22 +* [2514](https://github.com/AcademySoftwareFoundation/openexr/pull/2514) + Bump actions/cache from 6.0.0 to 6.1.0 +* [2513](https://github.com/AcademySoftwareFoundation/openexr/pull/2513) + Bump vmactions/freebsd-vm from 1.4.8 to 1.5.0 +* [2511](https://github.com/AcademySoftwareFoundation/openexr/pull/2511) + Bump rules_cc from 0.2.19 to 0.2.20 +* [2506](https://github.com/AcademySoftwareFoundation/openexr/pull/2506) + Bump actions/cache from 5.0.5 to 6.0.0 +* [2505](https://github.com/AcademySoftwareFoundation/openexr/pull/2505) + Bump actions/setup-python from 6.2.0 to 6.3.0 +* [2495](https://github.com/AcademySoftwareFoundation/openexr/pull/2495) + Bump vmactions/freebsd-vm from 1.4.6 to 1.4.8 +* [2483](https://github.com/AcademySoftwareFoundation/openexr/pull/2483) + Fix CI-old workflow failure due to Node 24 on old VFX platform containers +* [2481](https://github.com/AcademySoftwareFoundation/openexr/pull/2481) + Bump actions/checkout from 6.0.3 to 7.0.0 +* [2460](https://github.com/AcademySoftwareFoundation/openexr/pull/2460) + Bump rules_cc from 0.2.18 to 0.2.19 +* [2386](https://github.com/AcademySoftwareFoundation/openexr/pull/2386) + Bump rules_cc from 0.2.17 to 0.2.18 + +## Version 3.4.13 (June 19, 2026) + +Patch release that addresses several bugs and security +vulnerabilities. + +* :bug: Fix a regression introduced in v3.4.11 in decoding of DWAA compression +* :bug: Fix to handling deep images and very large images with the OpenEXRUtil library +* :bug: Fix initiliazation issue in B44A decoding +* :bug: Validate HTJ2K chunk header length before decode +* :hammer_and_wrench: Fix when building statically and using the vendored OpenJPH library + +For the python module: + +* :snake: :sparkles: Support NumPy scalar values Box2i and V2f tuple bindings + +This release addresses the following security vulnerabilities: + +* [CVE-2026-55373](https://www.cve.org/CVERecord?id=CVE-2026-55373) + OpenEXRUtil `SampleCountChannel` `endEdit()` can loop forever on `UINT_MAX` sample counts +* [CVE-2026-55371](https://www.cve.org/CVERecord?id=CVE-2026-55371) + OpenEXRCore `exr_attr_set_bytes()` accepts NULL `type_hint` with positive `hint_length` +* [CVE-2026-55059](https://www.cve.org/CVERecord?id=CVE-2026-55059) + OpenEXRUtil `SampleCountChannel` row setter heap out-of-bounds write +* [CVE-2026-54920](https://www.cve.org/CVERecord?id=CVE-2026-54920) + Integer Overflow and Use of Uninitialized Pointer leading to Invalid Delete in OpenEXRUtil Image Resize +* [CVE-2026-53532](https://www.cve.org/CVERecord?id=CVE-2026-53532) + Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS) + + +### Security + +This release addresses the following security vulnerabilities: + +* [CVE-2026-55373](https://www.cve.org/CVERecord?id=CVE-2026-55373) + OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts +* [CVE-2026-55371](https://www.cve.org/CVERecord?id=CVE-2026-55371) + OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length +* [CVE-2026-55059](https://www.cve.org/CVERecord?id=CVE-2026-55059) + OpenEXRUtil SampleCountChannel row setter heap out-of-bounds write +* [CVE-2026-54920](https://www.cve.org/CVERecord?id=CVE-2026-54920) + Integer Overflow and Use of Uninitialized Pointer leading to Invalid Delete in OpenEXRUtil Image Resize + +### Merged Pull Requests + +* [2476](https://github.com/AcademySoftwareFoundation/openexr/pull/2476) + Fix the DWAA size checks regression +* [2472](https://github.com/AcademySoftwareFoundation/openexr/pull/2472) + Unlock write context in exr_get_chunk_table_offset() return paths +* [2471](https://github.com/AcademySoftwareFoundation/openexr/pull/2471) + Add section on CVE Assignment to SECURITY.md +* [2470](https://github.com/AcademySoftwareFoundation/openexr/pull/2470) + Reject NULL bytes type_hint and data in exr_attr_bytes_create() +* [2468](https://github.com/AcademySoftwareFoundation/openexr/pull/2468) + Fix infinite loop in SampleCountChannel roundListSizeUp() +* [2466](https://github.com/AcademySoftwareFoundation/openexr/pull/2466) + Fix install manifest for linux build 13 +* [2464](https://github.com/AcademySoftwareFoundation/openexr/pull/2464) + Fix heap out-of-bounds write in SampleCountChannel row setter. +* [2463](https://github.com/AcademySoftwareFoundation/openexr/pull/2463) + Fix integer overflow and invalid delete in OpenEXRUtil Image::resize() +* [2451](https://github.com/AcademySoftwareFoundation/openexr/pull/2451) + Initialize B44 tables before B44A decode +* [2445](https://github.com/AcademySoftwareFoundation/openexr/pull/2445) + Fix: Allow NumPy scalar values in Box2i and V2f tuple bindings +* [2444](https://github.com/AcademySoftwareFoundation/openexr/pull/2444) + Fix vendored OpenJPH for static builds +* [2442](https://github.com/AcademySoftwareFoundation/openexr/pull/2442) + Bugfix: Fix interger overflows +* [2438](https://github.com/AcademySoftwareFoundation/openexr/pull/2438) + Break release.py into separate small scripts for each step +* [2436](https://github.com/AcademySoftwareFoundation/openexr/pull/2436) + Release notes and news for v3.4.12 +* [2434](https://github.com/AcademySoftwareFoundation/openexr/pull/2434) + Validate HTJ2K chunk header length before decode +* [2433](https://github.com/AcademySoftwareFoundation/openexr/pull/2433) + Tighten python publish workflow security/efficiency +* [2430](https://github.com/AcademySoftwareFoundation/openexr/pull/2430) + Pin idna>=3.15 in website/requirements.txt + +### Merged Workflow Pull Requests + +* [2479](https://github.com/AcademySoftwareFoundation/openexr/pull/2479) + Split macOS wheel arches across CI runners +* [2474](https://github.com/AcademySoftwareFoundation/openexr/pull/2474) + Bump msys2/setup-msys2 from 2.31.1 to 2.32.0 +* [2467](https://github.com/AcademySoftwareFoundation/openexr/pull/2467) + Bump sigstore/gh-action-sigstore-python from 3.3.0 to 3.4.0 +* [2462](https://github.com/AcademySoftwareFoundation/openexr/pull/2462) + Update idna requirement from >=3.17 to >=3.18 in /website +* [2450](https://github.com/AcademySoftwareFoundation/openexr/pull/2450) + Update idna requirement from >=3.15 to >=3.17 in /website +* [2449](https://github.com/AcademySoftwareFoundation/openexr/pull/2449) + Bump vmactions/freebsd-vm from 1.4.5 to 1.4.6 +* [2437](https://github.com/AcademySoftwareFoundation/openexr/pull/2437) + Bump github/codeql-action from 4.35.4 to 4.36.0 +* [2433](git@github.com:AcademySoftwareFoundation/openexr/pull/2433) + Tighten python publish workflow security/efficiency +* [2430](git@github.com:AcademySoftwareFoundation/openexr/pull/2430) + Pin idna>=3.15 in website/requirements.txt + +## Version 3.4.12 (May 24, 2026) + +Patch release that addresses several bugs and security +vulnerabilities. + +* :bug: Fix several minor memory leaks recovering from reading invalid + files. +* :bug: The compressor API incorrectly identfied `HTJ2K` and `HTJ2K256` as + lossy; they are lossles. +* :bug: Fix CMake AVX feature detection that caused DWA SIMD code to fail on + certain architectures. +* :warning: The `WidenFilename` utility function is marked as deprecated, to be + removed in a future release. +* :sparkles: `exrmetrics` now print the on-disk size of the data portion of each + part. Useful for determining compression impact on part data + +For the python module: + +* :snake: :bug: Reject files where the dataWindows does not match the + pixel array dimensions. +* :snake: :sparkles: Support NumPy float vector attributes +* :snake: :sparkles: Reading now skips over invalid parts, returns the valid parts only. +* :snake: :book: Doc strings have proper indentation + +This release addresses the following security vulnerabilities: + +* [CVE-2026-45696](https://www.cve.org/CVERecord?id=CVE-2026-45696) +OpenEXR `ht_undo_impl` heap-buffer-overflow READ via +codestream/channel width mismatch in HTJ2K decode +* [CVE-2026-44663](https://www.cve.org/CVERecord?id=CVE-2026-44663) +Integer overflow in HTJ2K decoder ( `ht_undo_impl` ) leading to +heap-buffer-overflow +* [OSS-fuzz 512895184](https://issues.oss-fuzz.com/issues/512895184) +Null-dereference WRITE in `Imf_4_0::TileProcess::run_decode` +* [OSS-fuzz 512314697](https://issues.oss-fuzz.com/issues/512314697) +Direct-leak in `internal_exr_add_part` +* [OSS-fuzz 508362159](https://issues.oss-fuzz.com/issues/508362159) +Heap-buffer-overflow in `DwaCompressor_uncompress` +* [OSS-fuzz 507413960](https://issues.oss-fuzz.com/issues/507413960) +Heap-buffer-overflow in `generic_unpack` + +<<<<<<< HEAD +======= + +>>>>>>> c9519c7c (Release notes and news for v3.4.12 (#2436)) +### Merged Pull Requests + +* [2424](https://github.com/AcademySoftwareFoundation/openexr/pull/2424) +exrmetrics print disk size of part +* [2423](https://github.com/AcademySoftwareFoundation/openexr/pull/2423) +Fix computation of chunk height +* [2422](https://github.com/AcademySoftwareFoundation/openexr/pull/2422) +Fix memory leaks +* [2421](https://github.com/AcademySoftwareFoundation/openexr/pull/2421) +Add test to validate python module reading of unfinished parts +* [2416](https://github.com/AcademySoftwareFoundation/openexr/pull/2416) +Add HTJ2K256 and HTJ2K32 to data compression scheme list +* [2414](https://github.com/AcademySoftwareFoundation/openexr/pull/2414) +Check for invalid Slice base and type in `TileProcess::copy_sample_count` +* [2413](https://github.com/AcademySoftwareFoundation/openexr/pull/2413) +Python: reject dataWindow size mismatch before write +* [2409](https://github.com/AcademySoftwareFoundation/openexr/pull/2409) +Python: fix docstring indentation +* [2407](https://github.com/AcademySoftwareFoundation/openexr/pull/2407) +Support NumPy float vectors in Python headers +* [2406](https://github.com/AcademySoftwareFoundation/openexr/pull/2406) +Update urllib3 to 2.7 in website/requirements.txt +* [2405](https://github.com/AcademySoftwareFoundation/openexr/pull/2405) +Signal HTJ2K* compressors as lossless +* [2403](https://github.com/AcademySoftwareFoundation/openexr/pull/2403) +htj2k compressor: validate codestream dimensions +* [2402](https://github.com/AcademySoftwareFoundation/openexr/pull/2402) +Release notes, news, and CVE info for v3.4.11, 3.3.11, 3.2.9 +* [2398](https://github.com/AcademySoftwareFoundation/openexr/pull/2398) +Arcmantis/warning deprecate WidenFilename +* [2397](https://github.com/AcademySoftwareFoundation/openexr/pull/2397) +Cast to `size_t` to avoid int overflow in `ht_undo_impl` +* [2392](https://github.com/AcademySoftwareFoundation/openexr/pull/2392) +Correct index rejection for string access. +* [2388](https://github.com/AcademySoftwareFoundation/openexr/pull/2388) +Relax NaN comparison in compression tests +* [2387](https://github.com/AcademySoftwareFoundation/openexr/pull/2387) +Add install instructions for python module +* [2385](https://github.com/AcademySoftwareFoundation/openexr/pull/2385) +cmake: require YMM asm for inline AVX probe +* [2373](https://github.com/AcademySoftwareFoundation/openexr/pull/2373) +Bump and pin website/requirements.txt +* [2359](https://github.com/AcademySoftwareFoundation/openexr/pull/2359) +Add reference to "contribute" and Clotributor in README.md and website +* [2148](https://github.com/AcademySoftwareFoundation/openexr/pull/2148) +Fix unfinished multi-part file loading in the python wrapper + +### Merged Workflow Pull Requests + +* [2399](https://github.com/AcademySoftwareFoundation/openexr/pull/2399) +Bump github/codeql-action from 4.35.2 to 4.35.4 +* [2396](https://github.com/AcademySoftwareFoundation/openexr/pull/2396) +Bump sphinx from 7.2.6 to 7.4.7 in /website +* [2394](https://github.com/AcademySoftwareFoundation/openexr/pull/2394) +Bump platforms from 1.0.0 to 1.1.0 + +## Version 3.4.11 (April 29, 2026) + +Patch release that addresses the following security vulnerabilities: + +* [CVE-2026-42217](https://www.cve.org/CVERecord?id=CVE-2026-42217) +Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`) +* [CVE-2026-42216](https://www.cve.org/CVERecord?id=CVE-2026-42216) +Out-of-bounds read in `IDManifest::init()` during prefix expansion +* [CVE-2026-41142](https://www.cve.org/CVERecord?id=CVE-2026-41142) +Integer overflow in `ImageChannel::resize` leads to heap OOB write via OpenEXRUtil public API + +Also: + +* OSS-fuzz [504280155](https://issues.oss-fuzz.com/issues/504280155) +Heap-buffer-overflow in `DwaCompressor_uncompress` +* OSS-fuzz [505062709](https://issues.oss-fuzz.com/issues/505062709) +Null-dereference READ in `Imf_3_3::prefixFromLayerName` + +Build fixes: + +- Fix Windows ARM64EC build issues and correct SIMD ARM NEON path for ARM64/EC + +Also, some minor documentation updates: + +- GitHub Security Advisories are the preferred way of reporting + vulnerabilities, not email. +- Some clarification around handling of UFT-8 of file paths + +### Merged Pull Requests + +* [2383](https://github.com/AcademySoftwareFoundation/openexr/pull/2383) +validate that the uncompressed sizes recorded in the dwa header are valid +* [2382](https://github.com/AcademySoftwareFoundation/openexr/pull/2382) +Fix Null-dereference READ in prefixFromLayerName +* [2378](https://github.com/AcademySoftwareFoundation/openexr/pull/2378) +Harden IDManifest parsing against illegal shift and string prefix OOB +* [2377](https://github.com/AcademySoftwareFoundation/openexr/pull/2377) +Fix OOB read when expanding IDManifest prefix-compressed strings +* [2375](https://github.com/AcademySoftwareFoundation/openexr/pull/2375) +Minor changes to website index page to make some sentences clearer. A… +* [2368](https://github.com/AcademySoftwareFoundation/openexr/pull/2368) +Add release notes and news for v3.4.10, v3.3.10, v3.2.8 +* [2367](https://github.com/AcademySoftwareFoundation/openexr/pull/2367) +Fix int overflow in ImageChannel::resize pixel count +* [2364](https://github.com/AcademySoftwareFoundation/openexr/pull/2364) +Recommend GH Security Advisories for vulnerability reporting +* [2361](https://github.com/AcademySoftwareFoundation/openexr/pull/2361) +Add documentation and test for UTF-8 file paths +* [2344](https://github.com/AcademySoftwareFoundation/openexr/pull/2344) +Fix Windows ARM64EC build issues and correct SIMD ARM NEON path for ARM64/EC + +### Merged Workflow Pull Requests + +* [2370](https://github.com/AcademySoftwareFoundation/openexr/pull/2370) +Bump msys2/setup-msys2 from 2.31.0 to 2.31.1 +* [2366](https://github.com/AcademySoftwareFoundation/openexr/pull/2366) +Add workflow dispatch trigger to release-sign.yml +* [2363](https://github.com/AcademySoftwareFoundation/openexr/pull/2363) +Bump vmactions/freebsd-vm from 1.4.4 to 1.4.5 +* [2362](https://github.com/AcademySoftwareFoundation/openexr/pull/2362) +Bump github/codeql-action from 4.35.1 to 4.35.2 + +## Version 3.4.10 (April 17, 2026) + +Patch release that addresses the following security vulnerabilities: + +* [CVE-2026-39886](https://www.cve.org/CVERecord?id=CVE-2026-39886) HTJ2K Signed Integer Overflow in `ht_undo_impl()` +* [CVE-2026-40244](https://www.cve.org/CVERecord?id=CVE-2026-40244) Integer overflow in DWA `setupChannelData` `planarUncRle` pointer arithmetic (missed variant of CVE-2026-34589) +* [CVE-2026-40250](https://www.cve.org/CVERecord?id=CVE-2026-40250) Integer overflow in DWA decoder `outBufferEnd` pointer arithmetic (missed variant of CVE-2026-34589) + +### Merged Pull Requests + +* [2346](https://github.com/AcademySoftwareFoundation/openexr/pull/2346) +Fix integer overflow in internal_dwa_compressor.h +* [2345](https://github.com/AcademySoftwareFoundation/openexr/pull/2345) +Fix HTJ2K bytes-per-line integer overflow in internal_ht.cpp +* [2340](https://github.com/AcademySoftwareFoundation/openexr/pull/2340) +Fix 3.4.9 cve list formatting +* [2339](https://github.com/AcademySoftwareFoundation/openexr/pull/2339) +fix link formatting typo +* [2337](https://github.com/AcademySoftwareFoundation/openexr/pull/2337) +notes and news for v3.4.9, v3.3.9, v3.2.7 +* [2334](https://github.com/AcademySoftwareFoundation/openexr/pull/2334) +Add CVE-2026-34589,34588,34545,34544,34543,34380,34379,34378 to SECURITY.md +* [2316](https://github.com/AcademySoftwareFoundation/openexr/pull/2316) +Fix Pinned-Dependencies Scorecard alert in website workflow + +### Merged Workflow Pull Requests + +* [2360](https://github.com/AcademySoftwareFoundation/openexr/pull/2360) +Bump actions/cache from 5.0.4 to 5.0.5 +* [2354](https://github.com/AcademySoftwareFoundation/openexr/pull/2354) +Bump actions/upload-artifact from 7.0.0 to 7.0.1 +* [2343](https://github.com/AcademySoftwareFoundation/openexr/pull/2343) +Bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0 +* [2341](https://github.com/AcademySoftwareFoundation/openexr/pull/2341) +Bump jmertic/slack-release-notifier from 32206e01ee0b0f66865d2be13bb3c62e474b5ce0 to 9d7d3a84563d2ebc8f7b2271be6c9568fedd7f3a +* [2338](https://github.com/AcademySoftwareFoundation/openexr/pull/2338) +Fix CodeQL SARIF upload ref for pull_request workflows +* [2336](https://github.com/AcademySoftwareFoundation/openexr/pull/2336) +Bump pypa/cibuildwheel from 3.4.0 to 3.4.1 +* [2333](https://github.com/AcademySoftwareFoundation/openexr/pull/2333) +Add CI test to validate "cmake --install .. --prefix + +## Version 3.4.9 (April 3, 2026) + +Patch release that addresses several security vulnerabilities. + +This release also fixes a build issue where the library symlinks would +get installed in the incorrect location when overriding the cached +install prefix path. + +This release addresses the following CVEs: +* [CVE-2026-34589](https://www.cve.org/CVERecord?id=CVE-2026-34589) DWA Lossy Decoder Heap Out-of-Bounds Write +* [CVE-2026-34588](https://www.cve.org/CVERecord?id=CVE-2026-34588) Signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write +* [CVE-2026-34380](https://www.cve.org/CVERecord?id=CVE-2026-34380) Signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression +* [CVE-2026-34379](https://www.cve.org/CVERecord?id=CVE-2026-34379) Misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression) +* [CVE-2026-34378](https://www.cve.org/CVERecord?id=CVE-2026-34378) Signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x + +### Merged Pull Requests + +* [2329](https://github.com/AcademySoftwareFoundation/openexr/pull/2329) +Fix signed integer overflow in `LossyDctDecoder_execute()` pointer arithmatic +* [2328](https://github.com/AcademySoftwareFoundation/openexr/pull/2328) +fix integer overflow in PIZ wavelet buffer arithmetic +* [2327](https://github.com/AcademySoftwareFoundation/openexr/pull/2327) +Add a message about image size limits and OOM errors to SECURITY.md and website +* [2326](https://github.com/AcademySoftwareFoundation/openexr/pull/2326) +Fix shared lib symlink installation path +* [2324](https://github.com/AcademySoftwareFoundation/openexr/pull/2324) +Fix misaligned memory access in `LossyDctDecoder_execute` HALF→FLOAT expansion +* [2323](https://github.com/AcademySoftwareFoundation/openexr/pull/2323) +fix signed integer overflow in `undo_pxr24_impl()` +* [2321](https://github.com/AcademySoftwareFoundation/openexr/pull/2321) +Fix integer overflow in `srcbuffer` pointer arithmetic in `unpack_*` +* [2317](https://github.com/AcademySoftwareFoundation/openexr/pull/2317) +Add "cherry" and "changes" options to release.py + +### Merged Workflow Pull Requests + +* [2332](https://github.com/AcademySoftwareFoundation/openexr/pull/2332) +Bump vmactions/freebsd-vm from 1.4.3 to 1.4.4 +* [2331](https://github.com/AcademySoftwareFoundation/openexr/pull/2331) +Bump github/codeql-action from 4.34.1 to 4.35.1 +* [2330](https://github.com/AcademySoftwareFoundation/openexr/pull/2330) +Bump jmertic/slack-release-notifier from f824585541879ef2a6388268eccb9be210aa6878 to 32206e01ee0b0f66865d2be13bb3c62e474b5ce0 +* [2325](https://github.com/AcademySoftwareFoundation/openexr/pull/2325) +Bump sigstore/gh-action-sigstore-python from 3.2.0 to 3.3.0 +* [2320](https://github.com/AcademySoftwareFoundation/openexr/pull/2320) +Bump jmertic/slack-release-notifier from 35fad060af5559c24decdec0f701e6ba93566704 to f824585541879ef2a6388268eccb9be210aa6878 +* [2319](https://github.com/AcademySoftwareFoundation/openexr/pull/2319) +Bump msys2/setup-msys2 from 2.30.0 to 2.31.0 +* [2318](https://github.com/AcademySoftwareFoundation/openexr/pull/2318) +Bump github/codeql-action from 4.33.0 to 4.34.1 + +## Version 3.4.8 (March 26, 2026) + +Patch release with several bug/build fixes: + +- Fix an integer-overflow bug reading malformed files compressed with + B44A/B44B +- Fix a buffer-overrun bug reading malformed files compressed with PXR24 +- Fix a bug compressing half data with ZIPS/ZIP data when the + compressed size equals packed size +- Single part files no longer get assigned a part name when writing + via the python module +- Fix a build failure on FreeBSD involving `threads.h` + +This also eliminates several compiler warnings, particularly about the +deprecated `isOptimizationEnabled()` API and deprecates standard +attributes. + +This version addresses the following security vulnerabilities: + +* [CVE-2026-34544](https://www.cve.org/CVERecord?id=CVE-2026-34544) integer overflow to OOB write in uncompress_b44_impl() +* [CVE-2026-34543](https://www.cve.org/CVERecord?id=CVE-2026-34543) Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl) + +### Merged Pull Requests + +* [2312](https://github.com/AcademySoftwareFoundation/openexr/pull/2312) +Fix B44/B44A integer overflow: use uint64_t for row offset +* [2310](https://github.com/AcademySoftwareFoundation/openexr/pull/2310) +PXR24: reject zlib output that does not match packed payload size +* [2307](https://github.com/AcademySoftwareFoundation/openexr/pull/2307) +Fix ZIPS/ZIP encoder corruption when compressed size equals packed size +* [2303](https://github.com/AcademySoftwareFoundation/openexr/pull/2303) +Fix MinGW -Walloc-size-larger-than= in general_attr string test +* [2301](https://github.com/AcademySoftwareFoundation/openexr/pull/2301) +don't insert name attributes into single part files +* [2300](https://github.com/AcademySoftwareFoundation/openexr/pull/2300) +Fix FreeBSD build failure involving threads.h, and add FreeBSD CI build +* [2124](https://github.com/AcademySoftwareFoundation/openexr/pull/2124) +Suppress deprecation warnings for isOptimizationEnabled and standard attributes + +### Merged Workflow Pull Requests + +* [2315](https://github.com/AcademySoftwareFoundation/openexr/pull/2315) +Force macos cibuildwheel to use Xcode clang +* [2311](https://github.com/AcademySoftwareFoundation/openexr/pull/2311) +Bump actions/cache from 5.0.3 to 5.0.4 +* [2304](https://github.com/AcademySoftwareFoundation/openexr/pull/2304) +Bump github/codeql-action from 4.32.6 to 4.33.0 +* [2297](https://github.com/AcademySoftwareFoundation/openexr/pull/2297) +Restore Analysis build +* [2295](https://github.com/AcademySoftwareFoundation/openexr/pull/2295) +Restrict workflow permissions for ci_steps, release-sign, and codeql +* [2294](https://github.com/AcademySoftwareFoundation/openexr/pull/2294) +Pin pypa/cibuildwheel actions to release sha + +## Version 3.4.7 (March 15, 2026) + +Patch release bug/build fixes: + +* Fix an integer overflow decoding very wide htj2k images +* Fix build failure with glibc 2.43 +* Fix Windows symbol visibility warnings + +Full changelog: [v3.4.6..v3.4.7](https://github.com/AcademySoftwareFoundation/openexr/compare/v3.4.6..v3.4.7) + +This version addresses the following security vulnerabilities: + +* [CVE-2026-34545](https://www.cve.org/CVERecord?id=CVE-2026-34545) + integer overflow lead to OOB in HTJ2K decoder + +### Merged Pull Requests + +* [2291](https://github.com/AcademySoftwareFoundation/openexr/pull/2291) +Fix integer overflow in htj2k decode with width > 32767 + +* [2283](https://github.com/AcademySoftwareFoundation/openexr/pull/2283) +update SECURITY with CVE info for PR #2256 + +* [2282](https://github.com/AcademySoftwareFoundation/openexr/pull/2282) +Remove `website_preview_link` workflow + +* [2281](https://github.com/AcademySoftwareFoundation/openexr/pull/2281) +Disable visibility attributes on Windows to fix msys2 -Wattributes warning + +* [2262](https://github.com/AcademySoftwareFoundation/openexr/pull/2262) +Fix build failure with glibc 2.43 due to C11 threads.h conflicts + +### Merged Workflow Pull Requests + +* [2292](https://github.com/AcademySoftwareFoundation/openexr/pull/2292) +Bump actions/download-artifact from 8.0.0 to 8.0.1 + +* [2289](https://github.com/AcademySoftwareFoundation/openexr/pull/2289) +Bump scikit-build-core from 0.12.1 to 0.12.2 + +* [2288](https://github.com/AcademySoftwareFoundation/openexr/pull/2288) +Bump jmertic/slack-release-notifier from 6fa159048d5313ff1177d248ad84beb627571670 to 35fad060af5559c24decdec0f701e6ba93566704 + +* [2287](https://github.com/AcademySoftwareFoundation/openexr/pull/2287) +Bump pypa/cibuildwheel from 3.3 to 3.4 + ## Version 3.4.6 (March 1, 2026) Patch release with several bug fixes, enhancements, and build improvements. @@ -97,14 +831,12 @@ enforced, which prevents an integer overflow when using the `CompositeDeepScanLine` API to combine multiple deep parts. -* :bug: `IlmThread` now builds properl with glibc 2.43. - * :wrench: In `IlmThreadPool`, replace deprecated `std::atomic_load / std::atomic_exchange` overloads for `std::shared_ptr` with the C++20 `std::atomic>` interface when available. * :bug: The ``ZIP`` and ``ZIPS`` Compressor objects had incorrect - compression types set, although the ill effects were miminal as the + compression types set, although the ill effects were minimal as the value is seldom used. * :bug: Enable SSE2 on 32-bit x86 builds to fix test failures @@ -146,101 +878,105 @@ Also, this release bumps the vendered version of `libdeflate` to 1.25. +This release addresses the following CVEs: +* [CVE-2026-27622](https://www.cve.org/CVERecord?id=CVE-2026-27622) +CompositeDeepScanLine integer-overflow leads to heap OOB write + ### Merged Pull Requests: -* [2274](https://github.com/AcademySoftwareFoundation/openexr/pulls/2274) +* [2274](https://github.com/AcademySoftwareFoundation/openexr/pull/2274) Update the vendored libdeflate to 1.25 -* [2273](https://github.com/AcademySoftwareFoundation/openexr/pulls/2273) +* [2273](https://github.com/AcademySoftwareFoundation/openexr/pull/2273) Release Python GIL during I/O operations in bindings -* [2272](https://github.com/AcademySoftwareFoundation/openexr/pulls/2272) +* [2272](https://github.com/AcademySoftwareFoundation/openexr/pull/2272) Fix build failure with -march=sandybridge (#2231) -* [2271](https://github.com/AcademySoftwareFoundation/openexr/pulls/2271) +* [2271](https://github.com/AcademySoftwareFoundation/openexr/pull/2271) Enable SSE2 on 32-bit x86 builds to fix test failures -* [2269](https://github.com/AcademySoftwareFoundation/openexr/pulls/2269) +* [2269](https://github.com/AcademySoftwareFoundation/openexr/pull/2269) Mention OpenEXR dependencies on README -* [2268](https://github.com/AcademySoftwareFoundation/openexr/pulls/2268) +* [2268](https://github.com/AcademySoftwareFoundation/openexr/pull/2268) Bazel: Use openjph 0.26.3 -* [2267](https://github.com/AcademySoftwareFoundation/openexr/pulls/2267) +* [2267](https://github.com/AcademySoftwareFoundation/openexr/pull/2267) Bump rules_cc from 0.2.16 to 0.2.17 -* [2265](https://github.com/AcademySoftwareFoundation/openexr/pulls/2265) +* [2265](https://github.com/AcademySoftwareFoundation/openexr/pull/2265) Bump jmertic/slack-release-notifier -* [2264](https://github.com/AcademySoftwareFoundation/openexr/pulls/2264) +* [2264](https://github.com/AcademySoftwareFoundation/openexr/pull/2264) Bump github/codeql-action from 4.32.3 to 4.32.4 -* [2263](https://github.com/AcademySoftwareFoundation/openexr/pulls/2263) +* [2263](https://github.com/AcademySoftwareFoundation/openexr/pull/2263) Add sanity check for correct arguments to exrstdattr -* [2261](https://github.com/AcademySoftwareFoundation/openexr/pulls/2261) +* [2261](https://github.com/AcademySoftwareFoundation/openexr/pull/2261) Fix sentence fragment typo in website python docs -* [2260](https://github.com/AcademySoftwareFoundation/openexr/pulls/2260) +* [2260](https://github.com/AcademySoftwareFoundation/openexr/pull/2260) Add reference to `OPENEXR_FORCE_EMBEDDED_CORE` on install page -* [2259](https://github.com/AcademySoftwareFoundation/openexr/pulls/2259) +* [2259](https://github.com/AcademySoftwareFoundation/openexr/pull/2259) Fix ZipCompressor to initialize compresson type correctly -* [2258](https://github.com/AcademySoftwareFoundation/openexr/pulls/2258) +* [2258](https://github.com/AcademySoftwareFoundation/openexr/pull/2258) Bazel: Remove WORKSPACE.bazel file -* [2256](https://github.com/AcademySoftwareFoundation/openexr/pulls/2256) +* [2256](https://github.com/AcademySoftwareFoundation/openexr/pull/2256) Report an error if a deep pixel as more than `UINT_MAX` samples -* [2253](https://github.com/AcademySoftwareFoundation/openexr/pulls/2253) +* [2253](https://github.com/AcademySoftwareFoundation/openexr/pull/2253) Add CVE-2025-64181 to SECURITY.md -* [2252](https://github.com/AcademySoftwareFoundation/openexr/pulls/2252) +* [2252](https://github.com/AcademySoftwareFoundation/openexr/pull/2252) Add news and release notes for v3.4.5 and v3.3.7 -* [2250](https://github.com/AcademySoftwareFoundation/openexr/pulls/2250) +* [2250](https://github.com/AcademySoftwareFoundation/openexr/pull/2250) Vendor OpenJPH v0.26.3 -* [2249](https://github.com/AcademySoftwareFoundation/openexr/pulls/2249) +* [2249](https://github.com/AcademySoftwareFoundation/openexr/pull/2249) Add python support for Opaque Attributes -* [2248](https://github.com/AcademySoftwareFoundation/openexr/pulls/2248) +* [2248](https://github.com/AcademySoftwareFoundation/openexr/pull/2248) Fix tag check, git rm, and sed calls in vendor_openjph.sh -* [2247](https://github.com/AcademySoftwareFoundation/openexr/pulls/2247) +* [2247](https://github.com/AcademySoftwareFoundation/openexr/pull/2247) Bump github/codeql-action from 4.31.9 to 4.32.3 -* [2243](https://github.com/AcademySoftwareFoundation/openexr/pulls/2243) +* [2243](https://github.com/AcademySoftwareFoundation/openexr/pull/2243) IlmThread: fix deprecated atomic `shared_ptr` ops for `shared_ptr` (GCC 15) -* [2240](https://github.com/AcademySoftwareFoundation/openexr/pulls/2240) +* [2240](https://github.com/AcademySoftwareFoundation/openexr/pull/2240) Bump actions/cache from 5.0.1 to 5.0.3 -* [2239](https://github.com/AcademySoftwareFoundation/openexr/pulls/2239) +* [2239](https://github.com/AcademySoftwareFoundation/openexr/pull/2239) Fix links and formatting in CONTRIBUTING.md -* [2236](https://github.com/AcademySoftwareFoundation/openexr/pulls/2236) +* [2236](https://github.com/AcademySoftwareFoundation/openexr/pull/2236) Bump actions/checkout from 6.0.1 to 6.0.2 -* [2235](https://github.com/AcademySoftwareFoundation/openexr/pulls/2235) +* [2235](https://github.com/AcademySoftwareFoundation/openexr/pull/2235) Bump actions/setup-python from 6.1.0 to 6.2.0 -* [2227](https://github.com/AcademySoftwareFoundation/openexr/pulls/2227) +* [2227](https://github.com/AcademySoftwareFoundation/openexr/pull/2227) Bump rules_cc from 0.2.14 to 0.2.16 -* [2226](https://github.com/AcademySoftwareFoundation/openexr/pulls/2226) +* [2226](https://github.com/AcademySoftwareFoundation/openexr/pull/2226) Bump bazel_skylib from 1.8.2 to 1.9.0 -* [2225](https://github.com/AcademySoftwareFoundation/openexr/pulls/2225) +* [2225](https://github.com/AcademySoftwareFoundation/openexr/pull/2225) Rename external/OpenJPH/src/core/common to openjph, instead of using a symlink -* [2224](https://github.com/AcademySoftwareFoundation/openexr/pulls/2224) +* [2224](https://github.com/AcademySoftwareFoundation/openexr/pull/2224) Bump github/codeql-action from 4.31.8 to 4.31.9 -* [2222](https://github.com/AcademySoftwareFoundation/openexr/pulls/2222) +* [2222](https://github.com/AcademySoftwareFoundation/openexr/pull/2222) Bump actions/upload-artifact from 5 to 6 -* [2221](https://github.com/AcademySoftwareFoundation/openexr/pulls/2221) +* [2221](https://github.com/AcademySoftwareFoundation/openexr/pull/2221) Bump actions/cache from 4.3.0 to 5.0.1 -* [2220](https://github.com/AcademySoftwareFoundation/openexr/pulls/2220) +* [2220](https://github.com/AcademySoftwareFoundation/openexr/pull/2220) Bump msys2/setup-msys2 from 2.29.0 to 2.30.0 -* [2219](https://github.com/AcademySoftwareFoundation/openexr/pulls/2219) +* [2219](https://github.com/AcademySoftwareFoundation/openexr/pull/2219) Bump actions/download-artifact from 6.0.0 to 7.0.0 -* [2218](https://github.com/AcademySoftwareFoundation/openexr/pulls/2218) +* [2218](https://github.com/AcademySoftwareFoundation/openexr/pull/2218) Bump github/codeql-action from 4.31.7 to 4.31.8 -* [2216](https://github.com/AcademySoftwareFoundation/openexr/pulls/2216) +* [2216](https://github.com/AcademySoftwareFoundation/openexr/pull/2216) Add option to compile c++ libraries with an embedded core library -* [2215](https://github.com/AcademySoftwareFoundation/openexr/pulls/2215) +* [2215](https://github.com/AcademySoftwareFoundation/openexr/pull/2215) Bump imath from 3.2.2 to 3.2.2.bcr.1 -* [2214](https://github.com/AcademySoftwareFoundation/openexr/pulls/2214) +* [2214](https://github.com/AcademySoftwareFoundation/openexr/pull/2214) Bump github/codeql-action from 4.31.5 to 4.31.7 -* [2213](https://github.com/AcademySoftwareFoundation/openexr/pulls/2213) +* [2213](https://github.com/AcademySoftwareFoundation/openexr/pull/2213) Bump sigstore/gh-action-sigstore-python from 3.1.0 to 3.2.0 -* [2212](https://github.com/AcademySoftwareFoundation/openexr/pulls/2212) +* [2212](https://github.com/AcademySoftwareFoundation/openexr/pull/2212) Bump actions/checkout from 6.0.0 to 6.0.1 -* [2210](https://github.com/AcademySoftwareFoundation/openexr/pulls/2210) +* [2210](https://github.com/AcademySoftwareFoundation/openexr/pull/2210) Bump actions/setup-python from 6.0.0 to 6.1.0 -* [2209](https://github.com/AcademySoftwareFoundation/openexr/pulls/2209) +* [2209](https://github.com/AcademySoftwareFoundation/openexr/pull/2209) Bump github/codeql-action from 4.31.4 to 4.31.5 -* [2208](https://github.com/AcademySoftwareFoundation/openexr/pulls/2208) +* [2208](https://github.com/AcademySoftwareFoundation/openexr/pull/2208) Remove enable-beta-ecosystem since Bazel is no officially supported -* [2204](https://github.com/AcademySoftwareFoundation/openexr/pulls/2204) +* [2204](https://github.com/AcademySoftwareFoundation/openexr/pull/2204) Bump actions/checkout from 3.6.0 to 6.0.0 -* [2202](https://github.com/AcademySoftwareFoundation/openexr/pulls/2202) +* [2202](https://github.com/AcademySoftwareFoundation/openexr/pull/2202) Bump github/codeql-action from 4.31.3 to 4.31.4 -* [2193](https://github.com/AcademySoftwareFoundation/openexr/pulls/2193) +* [2193](https://github.com/AcademySoftwareFoundation/openexr/pull/2193) Vendor in an internal version of OpenJPH -* [2167](https://github.com/AcademySoftwareFoundation/openexr/pulls/2167) +* [2167](https://github.com/AcademySoftwareFoundation/openexr/pull/2167) Bazel build: Bump openjph to 0.25.0 and libdeflate to 1.25 ## Version 3.4.5 (February 21, 2026) @@ -249,9 +985,13 @@ `istream_nonparallel_read` that could lead to a buffer overflow on invalid input data. +This release addresses the following CVEs: +* [CVE-2026-26981](https://www.cve.org/CVERecord?id=CVE-2026-26981) +Heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp + ### Merged Pull Requests: -* [2244](https://github.com/AcademySoftwareFoundation/pulls/2244) +* [2244](https://github.com/AcademySoftwareFoundation/openexr/pull/2244) Fix incorrect size check in `istream_nonparallel_read` ## Version 3.4.4 (November 19, 2025) @@ -272,53 +1012,53 @@ ### Merged Pull Requests: -* [2199](https://github.com/AcademySoftwareFoundation/pulls/2199) +* [2199](https://github.com/AcademySoftwareFoundation/openexr/pull/2199) OpenEXRCore: fix `ILMTHREAD_THREADING_ENABLED` checks -* [2198](https://github.com/AcademySoftwareFoundation/pulls/2198) +* [2198](https://github.com/AcademySoftwareFoundation/openexr/pull/2198) OpenEXRCore: avoid direct dependency on imath -* [2196](https://github.com/AcademySoftwareFoundation/pulls/2196) +* [2196](https://github.com/AcademySoftwareFoundation/openexr/pull/2196) Bump github/codeql-action from 4.31.2 to 4.31.3 -* [2194](https://github.com/AcademySoftwareFoundation/pulls/2194) +* [2194](https://github.com/AcademySoftwareFoundation/openexr/pull/2194) Add missing copywrite comments -* [2192](https://github.com/AcademySoftwareFoundation/pulls/2192) +* [2192](https://github.com/AcademySoftwareFoundation/openexr/pull/2192) Bump pypa/cibuildwheel from 3.2 to 3.3 -* [2190](https://github.com/AcademySoftwareFoundation/pulls/2190) +* [2190](https://github.com/AcademySoftwareFoundation/openexr/pull/2190) Bump github/codeql-action from 3.27.9 to 4.31.2 -* [2189](https://github.com/AcademySoftwareFoundation/pulls/2189) +* [2189](https://github.com/AcademySoftwareFoundation/openexr/pull/2189) Bump msys2/setup-msys2 from 2.27.0 to 2.29.0 -* [2188](https://github.com/AcademySoftwareFoundation/pulls/2188) +* [2188](https://github.com/AcademySoftwareFoundation/openexr/pull/2188) Bump actions/download-artifact from 4.1.8 to 6.0.0 -* [2187](https://github.com/AcademySoftwareFoundation/pulls/2187) +* [2187](https://github.com/AcademySoftwareFoundation/openexr/pull/2187) Bump ossf/scorecard-action from 2.4.0 to 2.4.3 -* [2186](https://github.com/AcademySoftwareFoundation/pulls/2186) +* [2186](https://github.com/AcademySoftwareFoundation/openexr/pull/2186) Bump pypa/cibuildwheel from 2.23 to 3.2 -* [2185](https://github.com/AcademySoftwareFoundation/pulls/2185) +* [2185](https://github.com/AcademySoftwareFoundation/openexr/pull/2185) Bump actions/cache from 4.2.0 to 4.3.0 -* [2184](https://github.com/AcademySoftwareFoundation/pulls/2184) +* [2184](https://github.com/AcademySoftwareFoundation/openexr/pull/2184) Bump actions/upload-artifact from 4 to 5 -* [2183](https://github.com/AcademySoftwareFoundation/pulls/2183) +* [2183](https://github.com/AcademySoftwareFoundation/openexr/pull/2183) Bump actions/checkout from 2.7.0 to 5.0.0 -* [2182](https://github.com/AcademySoftwareFoundation/pulls/2182) +* [2182](https://github.com/AcademySoftwareFoundation/openexr/pull/2182) Add recent CVEs to SECURITY.md -* [2181](https://github.com/AcademySoftwareFoundation/pulls/2181) +* [2181](https://github.com/AcademySoftwareFoundation/openexr/pull/2181) Bump sigstore/gh-action-sigstore-python from 3.0.0 to 3.1.0 -* [2180](https://github.com/AcademySoftwareFoundation/pulls/2180) +* [2180](https://github.com/AcademySoftwareFoundation/openexr/pull/2180) Bump actions/setup-python from 5.3.0 to 6.0.0 -* [2178](https://github.com/AcademySoftwareFoundation/pulls/2178) +* [2178](https://github.com/AcademySoftwareFoundation/openexr/pull/2178) Bump snyk/actions from 0.4.0 to 1.0.0 -* [2177](https://github.com/AcademySoftwareFoundation/pulls/2177) +* [2177](https://github.com/AcademySoftwareFoundation/openexr/pull/2177) Bump pypa/gh-action-pypi-publish from 1.12.3 to 1.13.0 -* [2176](https://github.com/AcademySoftwareFoundation/pulls/2176) +* [2176](https://github.com/AcademySoftwareFoundation/openexr/pull/2176) Imporve Bazel support -* [2175](https://github.com/AcademySoftwareFoundation/pulls/2175) +* [2175](https://github.com/AcademySoftwareFoundation/openexr/pull/2175) Converts asserts in internal_ht.cpp to if statement that throws an exception. -* [2174](https://github.com/AcademySoftwareFoundation/pulls/2174) +* [2174](https://github.com/AcademySoftwareFoundation/openexr/pull/2174) DWA: initialize linear/nonlinear tables at runtime -* [2173](https://github.com/AcademySoftwareFoundation/pulls/2173) +* [2173](https://github.com/AcademySoftwareFoundation/openexr/pull/2173) Update macos-13 to macos-15-intel -* [2171](https://github.com/AcademySoftwareFoundation/pulls/2171) +* [2171](https://github.com/AcademySoftwareFoundation/openexr/pull/2171) Properly set `OpenEXR_error` in legacy python API -* [2126](https://github.com/AcademySoftwareFoundation/pulls/2126) +* [2126](https://github.com/AcademySoftwareFoundation/openexr/pull/2126) B44: initialize exp/log tables at runtime @@ -329,15 +1069,29 @@ Specifically: -* Buffer overflow in PyOpenEXR_old's `channels()` and `channel()` in +- Buffer overflow in PyOpenEXR_old's `channels()` and `channel()` in legacy python, reported by Joshua Rogers (GitHub: MegaManSec). -* Use after free in PyObject_StealAttrString in legacy python, reported +- Use after free in PyObject_StealAttrString in legacy python, reported by Joshua Rogers (GitHub: MegaManSec). -* Use of Uninitialized Memory in openexr, reported by Aldo Ristori +- Use of Uninitialized Memory in openexr, reported by Aldo Ristori (GitHub: Kaldreic). -* Heap-based Buffer Overflow Remote Code Execution Vulnerability, +- Heap-based Buffer Overflow Remote Code Execution Vulnerability, reported by Trend Micro Zero Day Initiative. +This release addresses the following CVEs: +* [CVE-2025-64183](https://www.cve.org/CVERecord?id=CVE-2025-64183) +Use after free in PyObject_StealAttrString +* [CVE-2025-64182](https://www.cve.org/CVERecord?id=CVE-2025-64182) +Buffer overflow in PyOpenEXR_old's channels() and channel() +* [CVE-2025-64181](https://www.cve.org/CVERecord?id=CVE-2025-64181) +Security Issue: Use of Uninitialized Memory in openexr +* [CVE-2025-12840](https://www.cve.org/CVERecord?id=CVE-2025-12840) +Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability +* [CVE-2025-12839](https://www.cve.org/CVERecord?id=CVE-2025-12839) +Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability +* [CVE-2025-12495](https://www.cve.org/CVERecord?id=CVE-2025-12495) +Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability + Also: * OSS-fuzz [456158449](https://issues.oss-fuzz.com/issues/456158449) @@ -360,18 +1114,12 @@ which makes it possible to set `CMAKE_DEBUG_POSTFIX=""`. This version also bumps the auto-fetched version of OpenJPH to -0.24.5. OpenJPH 0.24.5 addresses these OSS-Fuzz issues: +0.24.4. OpenJPH 0.24.4 addresses these OSS-Fuzz issues: -* OSS-fuzz [456837230](https://issues.oss-fuzz.com/issues/456837230) -Crash in `ojph::local::param_cod::~param_cod` -* OSS-fuzz [456248580](https://issues.oss-fuzz.com/issues/456248580) -Null-dereference READ in `ojph::local::param_cod::~param_cod` * OSS-fuzz [455374208](https://issues.oss-fuzz.com/issues/455374208) Floating-point-exception in `ojph::local::tile::pre_alloc` * OSS-fuzz [444963190](https://issues.oss-fuzz.com/issues/444963190) Index-out-of-bounds in `ojph::local::param_qcd::read_qcc` -* OSS-fuzz [444889300](https://issues.oss-fuzz.com/issues/444889300) -Heap-buffer-overflow in `ojph::mem_infile::read` * OSS-fuzz [444878558](https://issues.oss-fuzz.com/issues/444878558) Segv on unknown address in `ojph::local::param_qcd::~param_qcd` * OSS-fuzz [444878557](https://issues.oss-fuzz.com/issues/444878557) @@ -405,10 +1153,6 @@ Patch release that fixes a Windows build issue introduced in v3.4.1. -This version also bumps the auto-fetched Imath version to v3.2.2, -which resolves a build problem with newer versions of cmake, involving -duplicate library aliases. - No change in functionality. ### Merged Pull Requests: @@ -657,6 +1401,160 @@ * [1852](https://github.com/AcademySoftwareFoundation/openexr/pull/1852) Add an option to use TBB as the global provider +## Version 3.3.11 (April 29, 2026) + +Patch release for 3.3 that addresses the following security +vulnerabilities: + +* [CVE-2026-42217](https://www.cve.org/CVERecord?id=CVE-2026-42217) +Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`) +* [CVE-2026-42216](https://www.cve.org/CVERecord?id=CVE-2026-42216) +Out-of-bounds read in `IDManifest::init()` during prefix expansion +* [CVE-2026-41142](https://www.cve.org/CVERecord?id=CVE-2026-41142) +Integer overflow in `ImageChannel::resize` leads to heap OOB write via OpenEXRUtil public API + +Also: + +* OSS-fuzz [504280155](https://issues.oss-fuzz.com/issues/504280155) +Heap-buffer-overflow in `DwaCompressor_uncompress` + +### Merged Pull Requests + +* [2383](https://github.com/AcademySoftwareFoundation/openexr/pull/2383) +validate that the uncompressed sizes recorded in the dwa header are valid +* [2378](https://github.com/AcademySoftwareFoundation/openexr/pull/2378) +Harden IDManifest parsing against illegal shift and string prefix OOB +* [2377](https://github.com/AcademySoftwareFoundation/openexr/pull/2377) +Fix OOB read when expanding IDManifest prefix-compressed strings +* [2367](https://github.com/AcademySoftwareFoundation/openexr/pull/2367) +Fix int overflow in ImageChannel::resize pixel count + +## Version 3.3.10 (April 17, 2026) + +Patch release that addresses the following security vulnerabilities: + +* [CVE-2026-40244](https://www.cve.org/CVERecord?id=CVE-2026-40244) Integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589) +* [CVE-2026-40250](https://www.cve.org/CVERecord?id=CVE-2026-40250) Integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589) + +### Merged Pull Requests + +* [2346](https://github.com/AcademySoftwareFoundation/openexr/pull/2346) +Fix integer overflow in internal_dwa_compressor.h + +## Version 3.3.9 (April 4, 2026) + +Patch release for v3.3 that addresses the following security vulnerabilities: + +* [CVE-2026-34589](https://www.cve.org/CVERecord?id=CVE-2026-34589) DWA Lossy Decoder Heap Out-of-Bounds Write +* [CVE-2026-34588](https://www.cve.org/CVERecord?id=CVE-2026-34588) Signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write +* [CVE-2026-34544](https://www.cve.org/CVERecord?id=CVE-2026-34544) integer overflow to OOB write in uncompress_b44_impl() +* [CVE-2026-34543](https://www.cve.org/CVERecord?id=CVE-2026-34543) Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl) +* [CVE-2026-34380](https://www.cve.org/CVERecord?id=CVE-2026-34380) Signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression +* [CVE-2026-34379](https://www.cve.org/CVERecord?id=CVE-2026-34379) Misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression) +* [CVE-2026-34378](https://www.cve.org/CVERecord?id=CVE-2026-34378) Signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x + +### Merged Pull Requests + +* [2329](https://github.com/AcademySoftwareFoundation/openexr/pull/2329) +Fix signed integer overflow in `LossyDctDecoder_execute()` pointer arithmatic +* [2328](https://github.com/AcademySoftwareFoundation/openexr/pull/2328) +fix integer overflow in PIZ wavelet buffer arithmetic +* [2324](https://github.com/AcademySoftwareFoundation/openexr/pull/2324) +Fix misaligned memory access in `LossyDctDecoder_execute` HALF→FLOAT expansion +* [2323](https://github.com/AcademySoftwareFoundation/openexr/pull/2323) +fix signed integer overflow in `undo_pxr24_impl()` +* [2321](https://github.com/AcademySoftwareFoundation/openexr/pull/2321) +Fix integer overflow in `srcbuffer` pointer arithmetic in `unpack_*` +* [2312](https://github.com/AcademySoftwareFoundation/openexr/pull/2312) +Fix B44/B44A integer overflow: use uint64_t for row offset +* [2310](https://github.com/AcademySoftwareFoundation/openexr/pull/2310) +PXR24: reject zlib output that does not match packed payload size + +## Version 3.3.8 (March 1, 2026) + +Patch release that prevents an integer overflow when using the +`CompositeDeepScanLine` API to combine multiple deep parts. + +This release addresses the following CVEs: +* [CVE-2026-27622](https://www.cve.org/CVERecord?id=CVE-2026-27622) +CompositeDeepScanLine integer-overflow leads to heap OOB write + +### Merged Pull Requests: + +* [2256](https://github.com/AcademySoftwareFoundation/openexr/pull/2256) +Report an error if a deep pixel as more than UINT_MAX samples + +## Version 3.3.7 (February 19, 2026) + +Patch release that fixes an incorrect size check in +`istream_nonparallel_read` that could lead to a buffer overflow on +invalid input data. + +This release addresses the following CVEs: +* [CVE-2026-26981](https://www.cve.org/CVERecord?id=CVE-2026-26981) +Heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp + + +### Merged Pull Requests: + +* [2244](https://github.com/AcademySoftwareFoundation/openexr/pull/2244) +Fix incorrect size check in `istream_nonparallel_read` + +## Version 3.3.6 (November 4, 2025) + +Patch release that addresses several bugs, primarily involving +properly rejecting corrupt input data. + +Specifically: + +* Buffer overflow in PyOpenEXR_old's `channels()` and `channel()` in + legacy python, reported by Joshua Rogers (GitHub: MegaManSec). +* Use after free in PyObject_StealAttrString in legacy python, reported + by Joshua Rogers (GitHub: MegaManSec). +* Use of Uninitialized Memory in openexr, reported by Aldo Ristori + (GitHub: Kaldreic). +* Heap-based Buffer Overflow Remote Code Execution Vulnerability, + reported by Trend Micro Zero Day Initiative. + +Other fixes: +* Only populate `CMAKE_DEBUG_POSTFIX` with `_d` if it is undefined, + which makes it possible to set `CMAKE_DEBUG_POSTFIX=""`. + +This release addresses the following CVEs: +* [CVE-2025-64183](https://www.cve.org/CVERecord?id=CVE-2025-64183) +Use after free in PyObject_StealAttrString +* [CVE-2025-64182](https://www.cve.org/CVERecord?id=CVE-2025-64182) +Buffer overflow in PyOpenEXR_old's channels() and channel() +* [CVE-2025-64181](https://www.cve.org/CVERecord?id=CVE-2025-64181) +Security Issue: Use of Uninitialized Memory in openexr +* [CVE-2025-12840](https://www.cve.org/CVERecord?id=CVE-2025-12840) +Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability +* [CVE-2025-12839](https://www.cve.org/CVERecord?id=CVE-2025-12839) +Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability +* [CVE-2025-12495](https://www.cve.org/CVERecord?id=CVE-2025-12495) +Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability + +### Merged Pull Requests: + +* [2168](https://github.com/AcademySoftwareFoundation/openexr/pull/2168) +Fix improper use of `Py_DECREF` in legacy python module +* [2166](https://github.com/AcademySoftwareFoundation/openexr/pull/2166) +Only define CMAKE_DEBUG_POSTFIX if it is not already defined +* [2164](https://github.com/AcademySoftwareFoundation/openexr/pull/2164) +check storage_mode when computing chunk sizes +* [2163](https://github.com/AcademySoftwareFoundation/openexr/pull/2163) +Check for image size overflow in legacy python module +* [2162](https://github.com/AcademySoftwareFoundation/openexr/pull/2162) +verify packed/unpacked size with uncompressed data +* [2161](https://github.com/AcademySoftwareFoundation/openexr/pull/2161) +ImfCheckFile: handle partial deep tiles +* [2160](https://github.com/AcademySoftwareFoundation/openexr/pull/2160) +Fix issues with negative coordinates and sampling != 0 +* [2159](https://github.com/AcademySoftwareFoundation/openexr/pull/2159) +Fix memset in exr_read_chunk when nread is negative +* [2156](https://github.com/AcademySoftwareFoundation/openexr/pull/2156) +Fix handling of corrupt RLE data + ## Version 3.3.5 (July 26, 2025) Patch release with a couple bug/performance fixes: @@ -1228,6 +2126,107 @@ Propagate dwa core 3 1 * [1418](https://github.com/AcademySoftwareFoundation/openexr/pull/1418) +## Version 3.2.9 (April 29, 2026) + +Patch release for 3.2 that addresses the following security +vulnerabilities: + +* [CVE-2026-42217](https://www.cve.org/CVERecord?id=CVE-2026-42217) +Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`) +* [CVE-2026-42216](https://www.cve.org/CVERecord?id=CVE-2026-42216) +Out-of-bounds read in `IDManifest::init()` during prefix expansion +* [CVE-2026-41142](https://www.cve.org/CVERecord?id=CVE-2026-41142) +Integer overflow in `ImageChannel::resize` leads to heap OOB write via OpenEXRUtil public API + +Also: + +* OSS-fuzz [504280155](https://issues.oss-fuzz.com/issues/504280155) +Heap-buffer-overflow in `DwaCompressor_uncompress` + +### Merged Pull Requests + +* [2383](https://github.com/AcademySoftwareFoundation/openexr/pull/2383) +validate that the uncompressed sizes recorded in the dwa header are valid +* [2378](https://github.com/AcademySoftwareFoundation/openexr/pull/2378) +Harden IDManifest parsing against illegal shift and string prefix OOB +* [2377](https://github.com/AcademySoftwareFoundation/openexr/pull/2377) +Fix OOB read when expanding IDManifest prefix-compressed strings +* [2367](https://github.com/AcademySoftwareFoundation/openexr/pull/2367) +Fix int overflow in ImageChannel::resize pixel count + +## Version 3.2.8 (April 17, 2026) + +Patch release that addresses the following security vulnerabilities: + +* [CVE-2026-40244](https://www.cve.org/CVERecord?id=CVE-2026-40244) Integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589) +* [CVE-2026-40250](https://www.cve.org/CVERecord?id=CVE-2026-40250) Integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589) + +### Merged Pull Requests + +* [2346](https://github.com/AcademySoftwareFoundation/openexr/pull/2346) +Fix integer overflow in internal_dwa_compressor.h + +## Version 3.2.7 (April 3, 2026) + +Patch release for v3.2 that addresses the following security vulnerabilities: + +* [CVE-2026-34589](https://www.cve.org/CVERecord?id=CVE-2026-34589) DWA Lossy Decoder Heap Out-of-Bounds Write +* [CVE-2026-34588](https://www.cve.org/CVERecord?id=CVE-2026-34588) Signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write +* [CVE-2026-34544](https://www.cve.org/CVERecord?id=CVE-2026-34544) integer overflow to OOB write in uncompress_b44_impl() +* [CVE-2026-34543](https://www.cve.org/CVERecord?id=CVE-2026-34543) Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl) +* [CVE-2026-34380](https://www.cve.org/CVERecord?id=CVE-2026-34380) Signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression +* [CVE-2026-34379](https://www.cve.org/CVERecord?id=CVE-2026-34379) Misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression) + +### Merged Pull Requests + +* [2329](https://github.com/AcademySoftwareFoundation/openexr/pull/2329) +Fix signed integer overflow in `LossyDctDecoder_execute()` pointer arithmatic +* [2328](https://github.com/AcademySoftwareFoundation/openexr/pull/2328) +fix integer overflow in PIZ wavelet buffer arithmetic +* [2324](https://github.com/AcademySoftwareFoundation/openexr/pull/2324) +Fix misaligned memory access in `LossyDctDecoder_execute` HALF→FLOAT expansion +* [2323](https://github.com/AcademySoftwareFoundation/openexr/pull/2323) +fix signed integer overflow in `undo_pxr24_impl()` +* [2312](https://github.com/AcademySoftwareFoundation/openexr/pull/2312) +Fix B44/B44A integer overflow: use uint64_t for row offset +* [2310](https://github.com/AcademySoftwareFoundation/openexr/pull/2310) +PXR24: reject zlib output that does not match packed payload size + +## Version 3.2.6 (March 1, 2026) + +Patch release that prevents an integer overflow when using the +`CompositeDeepScanLine` API to combine multiple deep parts. + +This release addresses the following CVEs: +* [CVE-2026-27622](https://www.cve.org/CVERecord?id=CVE-2026-27622) +CompositeDeepScanLine integer-overflow leads to heap OOB write + +### Merged Pull Requests: + +* [2256](https://github.com/AcademySoftwareFoundation/openexr/pull/2256) + +## Version 3.2.5 (November 4, 2025) + +Patch release that addresses bugs in the python module's legacy API. + +- Buffer overflow in PyOpenEXR_old's `channels()` and `channel()` in + legacy python, reported by Joshua Rogers (GitHub: MegaManSec). +- Use after free in PyObject_StealAttrString in legacy python, reported + by Joshua Rogers (GitHub: MegaManSec). + +This release addresses the following CVEs: +* [CVE-2025-64182](https://www.cve.org/CVERecord?id=CVE-2025-64182) +Buffer overflow in PyOpenEXR_old's channels() and channel() +* [CVE-2025-64183](https://www.cve.org/CVERecord?id=CVE-2025-64183) +Use after free in PyObject_StealAttrString + +### Merged Pull Requests: + +* [2168](https://github.com/AcademySoftwareFoundation/openexr/pull/2168) + Fix improper use of `Py_DECREF` in legacy python module +* [2163](https://github.com/AcademySoftwareFoundation/openexr/pull/2163) +Check for image size overflow in legacy python module + ## Version 3.2.4 (March 26, 2024) Patch release that fixes handling of dwa compression in OpenEXRCore library. @@ -6097,7 +7096,7 @@ * Added new function, isImfMagic (). (Florian Kainz) -## Version 1.0.6: +## Version 1.0.6 * Added README.win32 to disted files. @@ -6223,7 +7222,7 @@ * OpenEXR is now covered by a modified BSD license. See LICENSE for the new terms. -## Version 1.0.3: +## Version 1.0.3 ### Detailed Changes: diff -Nru openexr-3.4.6+ds/cmake/CMakeLists.txt openexr-3.4.14/cmake/CMakeLists.txt --- openexr-3.4.6+ds/cmake/CMakeLists.txt 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/cmake/CMakeLists.txt 2026-08-05 04:29:55.000000000 +0300 @@ -37,7 +37,17 @@ int edx = 0; __asm__( \"xgetbv ;\" - \"vzeroupper \" + // + // This feature probe is specifically used to decide whether we can + // compile the DWA fast path that contains GCC-style inline asm using + // AVX/YMM instructions. Some toolchains (notably older Apple 'as' + // invoked by GCC on legacy macOS) can assemble xgetbv/vzeroupper but + // still reject YMM/VEX instructions with errors like: + // no such instruction: `vmovaps (%rsi), %ymm0' + // So include a representative YMM instruction in the try-compile. + // + \"vmovaps %%ymm0, %%ymm0 ;\" + \"vzeroupper \" : \"=a\"(eax), \"=d\"(edx) : \"c\"(n) : ); #else # error No SSE support enabled to query AVX support diff -Nru openexr-3.4.6+ds/cmake/LibraryDefine.cmake openexr-3.4.14/cmake/LibraryDefine.cmake --- openexr-3.4.6+ds/cmake/LibraryDefine.cmake 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/cmake/LibraryDefine.cmake 2026-08-05 04:29:55.000000000 +0300 @@ -96,8 +96,8 @@ set(verlibname ${CMAKE_SHARED_LIBRARY_PREFIX}${libname}${OPENEXR_LIB_SUFFIX}${CMAKE_${uppercase_CMAKE_BUILD_TYPE}_POSTFIX}${CMAKE_SHARED_LIBRARY_SUFFIX}) set(baselibname ${CMAKE_SHARED_LIBRARY_PREFIX}${libname}${CMAKE_${uppercase_CMAKE_BUILD_TYPE}_POSTFIX}${CMAKE_SHARED_LIBRARY_SUFFIX}) file(CREATE_LINK ${verlibname} ${CMAKE_CURRENT_BINARY_DIR}/${baselibname} SYMBOLIC) - install(FILES ${CMAKE_CURRENT_BINARY_DIR}/${baselibname} DESTINATION ${CMAKE_INSTALL_FULL_LIBDIR}) - install(CODE "message(STATUS \"Creating symlink ${CMAKE_INSTALL_FULL_LIBDIR}/${baselibname} -> ${verlibname}\")") + install(FILES ${CMAKE_CURRENT_BINARY_DIR}/${baselibname} DESTINATION ${CMAKE_INSTALL_LIBDIR}) + install(CODE "message(STATUS \"Creating symlink ${CMAKE_INSTALL_LIBDIR}/${baselibname} -> ${verlibname}\")") set(verlibname) set(baselibname) endif() diff -Nru openexr-3.4.6+ds/cmake/OpenEXRConfig.cmake.in openexr-3.4.14/cmake/OpenEXRConfig.cmake.in --- openexr-3.4.6+ds/cmake/OpenEXRConfig.cmake.in 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/cmake/OpenEXRConfig.cmake.in 2026-08-05 04:29:55.000000000 +0300 @@ -18,7 +18,7 @@ find_dependency(libdeflate) endif() -if (@openjph_FOUND@) +if (NOT @OPENEXR_USE_INTERNAL_OPENJPH@) find_dependency(openjph) endif() diff -Nru openexr-3.4.6+ds/cmake/OpenEXRConfig.h.in openexr-3.4.14/cmake/OpenEXRConfig.h.in --- openexr-3.4.6+ds/cmake/OpenEXRConfig.h.in 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/cmake/OpenEXRConfig.h.in 2026-08-05 04:29:55.000000000 +0300 @@ -127,8 +127,10 @@ /// /// @{ +// Visibility attributes are ELF-specific; on Windows (MSVC or MinGW) they are +// not supported and trigger -Wattributes warnings, so use empty macros there. #if defined(OPENEXR_ENABLE_API_VISIBILITY) && \ - !(defined(OPENEXR_DLL) || defined(_MSC_VER)) + !(defined(OPENEXR_DLL) || defined(_MSC_VER) || defined(_WIN32)) # define OPENEXR_PUBLIC_SYMBOL_ATTRIBUTE \ __attribute__ ((__visibility__ ("default"))) # define OPENEXR_PRIVATE_SYMBOL_ATTRIBUTE \ diff -Nru openexr-3.4.6+ds/cmake/OpenEXRSetup.cmake openexr-3.4.14/cmake/OpenEXRSetup.cmake --- openexr-3.4.6+ds/cmake/OpenEXRSetup.cmake 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/cmake/OpenEXRSetup.cmake 2026-08-05 04:29:55.000000000 +0300 @@ -257,6 +257,9 @@ option(OPENEXR_FORCE_INTERNAL_OPENJPH "Force downloading OpenJPH from a git repo" OFF) +set(OPENEXR_USE_INTERNAL_OPENJPH 0 CACHE INTERNAL + "Whether OpenEXR bundles vendored OpenJPH into OpenEXRCore (0 or 1)") + if (NOT OPENEXR_FORCE_INTERNAL_OPENJPH) find_package(openjph CONFIG QUIET) if(openjph_FOUND) @@ -286,6 +289,8 @@ set(EXR_OPENJPH_PKGCONFIG_REQUIRES "openjph >= 0.21.0") else() # Using internal openjph + set(OPENEXR_USE_INTERNAL_OPENJPH 1 CACHE INTERNAL + "Whether OpenEXR bundles vendored OpenJPH into OpenEXRCore (0 or 1)" FORCE) # extract the openjph version variables from ojph_version.h set(openjph_SOURCE_DIR "${CMAKE_SOURCE_DIR}/external/openjph") diff -Nru openexr-3.4.6+ds/CONTRIBUTING.md openexr-3.4.14/CONTRIBUTING.md --- openexr-3.4.6+ds/CONTRIBUTING.md 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/CONTRIBUTING.md 2026-08-05 04:29:55.000000000 +0300 @@ -508,6 +508,7 @@ will validate the build. Click on the ``Details`` link to preview. Also, a link to this preview will be added automatically to the PR description. + ### Test Images To contribute a new test image, commit it to the @@ -527,309 +528,249 @@ ## Creating a Patch Release -Making a patch release typically involves merging changes from the -main branch into the release branch, since all development generally -takes place on the main branch. The usual workflow is to group these -changes together and merge them all just prior to a release, rather -than merging one-by-one as the changes go into main, although merging -along the way is acceptable as well. For OpenEXR and Imath, a patch -release typically involves under a dozen commits, so it's not a huge -amount of work to organize them all at once. +These instructions are for project administrators who have "push" +access on the GitHub repo. + +Making a patch release involves merging changes from the main branch +into the release branch, since all development takes place on the main +branch. The process involves these steps: + +1. Cherry-pick commits from main to the RB- release branch +2. Bump the version number +3. Add release notes to CHANGES.md +4. Create a "release candidate" tag and announce it publicly +5. Draft the GitHub release +6. Create a signed release tag +7. Publish the release +8. Add an entry to the website news page + +Helper scripts in ``share/util/release/`` automate many of the steps +in the process. A patch release *must* be ABI-compatible with preceding minor releases and should be validated with an ABI-checker tool such as [``abipkgdiff``](https://manpages.ubuntu.com/manpages/lunar/en/man1/abipkgdiff.1.html). -These instructions are for project administrators who have "push" -access on the GitHub repo. +### Labeling PRs for Release -The preferred workflow is: +Commits for the patch release are identified via labels on PRs. Create +a label for the release, beginning with a `v`, as in +``v3.4.11``. Assign this label to all PRs to be included in the +release. -1. Make a PR that merges appropriate changes from the main branch to - the release branch: +If a PR should be merged into more than one release branch, i.e. a fix +goes into v3.4 and v3.3, simply add multiple labels, one per release. - a. In a forked clone, create a branch to hold the patch commits, - e.g. ``v3.1.9-fixes``. +It's good practice to label _every_ PR to identify what +release it goes into, even if it's the next minor/major release. That +helps make sure PRs don't get overlooked. - b. Cherry-pick the appropriate commits from ``main``, resolving any - merge conflicts. - - c. Increment ``OPENEXR_VERSION_PATCH`` in - [src/lib/OpenEXRCore/openexr_version.h](src/lib/OpenEXRCore/openexr_version.h) - - d. Update the ``IMATH_TAG`` setting in - [cmake/OpenEXRSetup.cmake](cmake/OpenEXRSetup.cmake) to - correspond to the proper Imath release. - - e. Add release notes to [CHANGES.md](CHANGES.md): - - - Generate a list of links to merged pull requests. - - Use ``git log`` to identify the merged commits, and for each - commit, and add a link in the notes to the corresponding PR - that merged it to ``main``. Citing PR's in the release notes - is preferable to citing raw commits because the PR's often - have helpful information and discussion missing from the - commit descriptions, and the commit history is readily - accessible via ``git log`` anyway. - - The typical OpenEXR project workflow uses "squash and merge" - to merge PR's into ``main``, so the changes involved in each - PR end up on ``main`` as a single commit. This is preferable - because a raw PR often includes numerous commits that address - comments and feedback or fix typos or mistakes, intermediate - steps not helpful to the preserved history of the main - development thread. Note that GitHub's "squash and merge" - helpfully appends the PR number to the commit subject line. - - Note that when this PR is merged to the release branch, it - should go in via "rebase and merge" that the release branch - retains the granular changes, described below. - - - Generate a list of OSS-Fuzz issues addressed. - - These are security concerns, so they deserve special - attention. Provide a link in the notes to the issue at - https://bugs.chromium.org/p/oss-fuzz, including the issue id - number and description. - - - If there are any public CVE's, mention them explicitly with a - link to the CVE registry item. - - - Provide an executive summary of the patch changes, in a few - sentences as well as bullet points if appropriate. - - - Choose a proposed release date at least several days in - advance. - - f. If there are any public CVE's, reference them in - [SECURITY.md](SECURITY.md). - - g. Submit the PR for others to review. The PR should go *to the - release branch, not ``main``*, obviously. - - h. After others have had a chance to sanity-check the changes, - merge the PR *with "rebase and merge"*. Unlike with the usual - PR's merged to main, it is essential to retain the individual - commits on the release branch. That way, the release branch - commit history retains the details of the changes. - - i. If further fixes come in that need to go into the release, push - them to the PR branch. It's not absolutely essential that all - changes to the release branch go in via a PR. The PR is simply a - convenient forum for publicly discussing and reviewing the - composition of the release. - -2. Tag the release with a ``-rc`` "release candidate" tag, - e.g. ``v3.1.9-rc``. - -3. Validate ABI compatibility. Build at the release candidate tag and - run - [abipkgdiff](https://manpages.ubuntu.com/manpages/lunar/en/man1/abipkgdiff.1.html) - against a build of the previous patch release to confirm that no - ABI changes have leaked in. Additions to the ABI are acceptable for - a patch release, but there should be no symbol changes and no - symbols removed. If there are, back up and fix them before proceeding. - -4. Send mail to ``openexr-dev@lists.aswf.io`` announcing the staging - of the release with link to the release candidate tag. Include the - release notes from [CHANGES.md](CHANGES.md) for review. +The `share/util/release/log.py` script prints all PRs in the order +they were merged, annotated by their release labels. -5. Draft the release on the GitHub - [Releases](https://github.com/AcademySoftwareFoundation/openexr/releases) - page. Include the summary from the notes in - [CHANGES.md](CHANGES.md), but don't include the list of PR's. +### Security Issues - Create the release from the latest ``--rc`` tag, and give it a name - that begins with ``v``, i.e. ``v3.1.9``. +When a PR addresses a security vulnerability, mention it in the +description or comments: - Save the release as a "draft". + Addresses CVE-2026-39886 -6. Wait at least 48 hours, to give the community time to discover and - report any obvious problems. Avoid the temptation to rush changes - into a release and publish it immediately, as that is uncomfortably - error prone. +The release scripts will detect this and add an appropriate entry to the +release notes. - If additional fixes need to go in before release: +When a PR addresses an OSS-Fuzz issue, mention it by url in the +description or comments: - a. Merge commits to the release branch. Push them directly, no need - for a pull request. + Addresses https://issues.oss-fuzz.com/issues/456158449 - b. Update the release notes in a separate commit. +The release scripts will detect this and add an appropriate entry to the +release notes. - c. Re-tag with a incremented "release candidate" number, - e.g. ``v3.1.9-rc2``. +### GPG - d. Send an email update to ``openexr-dev@lists.aswf.io`` notifying - the community of the addition and the new tag. +The signed git tags associated with the release require a [GPG +key](https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key) +that is +[registered](https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key) +with your GitHub account and git config. -7. Create a signed release tag +## Release Workflow - a. Make sure you have a [GPG - key](https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key) - and it is - [registered](https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key) - with your GitHub account and git config. +Once all PRs have appropriate release labels, follow these steps, all +while on the appropriate `RB-` branch: - b. Create a signed tag with the release name via `git tag -s v3.1.9`. +1. Cherry-pick commits from the main branch to the release branch. - c. Push the tag via `git push --tags` + This prints the SHAs for the commits associated with the + labeled PRs. The output will look something like: + + % python share/util/release/cherry.py v3.4.8 + git cherry-pick 2e32c6b 3df0122 6155271 + changes.py v3.4.8 2311 2294 2315 + + Copy/paste the `git cherry-pick` command to the shell. -8. Publish the release + If there are conflicts, resolve them and continue. - a. Click the "Publish release" button on the GitHub release draft + If the conflicts are too messy to resolve, consider + cherry-picking the commits one at a time. The `cherry.py` + script accepts a `--single` option that prints the commits one + `git cherry-pick` command per line: - b. Send an email to ``openexr-dev@lists.aswf.io`` officially - announcing the release. - -9. Update the ``release`` branch, which should always point to the - most recent patch of the most recent minor release, i.e. the most - preferred release. + % python share/util/release/cherry.py --single v3.4.8 + git cherry-pick 2e32c6b # Bump actions/cache from 5.0.3 to 5.0.4 (#2311) + git cherry-pick 3df0122 # Pin pypa/cibuildwheel actions to release sha (#2294) + git cherry-pick 6155271 # Force macos cibuildwheel to use Xcode clang (#2315) + changes.py v3.4.8 2311 2294 2315 - From a clone of the main repo: +2. Bump the OpenEXR version. - % git checkout release - % git merge RB-3.1 - % git push - -10. Submit a PR that adds the release notes to [CHANGES.md](CHANGES.md) - on the main branch. Cherry-pick the release notes commit from - the release branch. - - - If any changes have gone into [SECURITY.md](SECURITY), cherry-pick - the associated commit as well. - - - Also include in this PR edits to [``website/news.rst``](website/news.rst) - that add an announcement of the release. - -11. After review/merge of the updates to ``website/news.rst``, build the - website at https://readthedocs.org/projects/openexr. - -12. If the release has resolved any OSS-Fuzz issues, update the - associated pages at https://bugs.chromium.org/p/oss-fuzz with a - reference to the release. - -13. If the release has resolved any public CVE's, request an update - from the registry service providing the release and a link to the - release notes. + Edit the number in `src/lib/OpenEXRCore/openexr_version.h`. Commit + and push the change. -## Creating a Major/Minor Release +3. Create an entry in the release notes file `CHANGES.md`. -A major/minor release is created from the main branch, assuming there -are no changes on ``main`` that should *not* go into the release. We -don't generally allow experimental changes onto ``main``. Anything -accepted onto ``main`` should be intended for the next release. + The `changes.py` script takes a list of PRs + and adds entries in the `CHANGES.md` file: + + % python share/util/release/changes.py v3.4.8 2311 2294 2315 -The overall workflow is similar to a patch release, as described -above, but it's simpler because there is no cherry-picking and merging -of commits. The major/minor release is simply a snapshot of ``main``. + This adds the `Merged Pull Requests` and the + `Merged Workflow Requests` sections. It also adds a `Security` section + that lists the CVEs and OSS-Fuzz issues addressed. + + Edit the section by hand to add a summary. -To create a new release from the ``main`` branch: +4. Create a `-rc` "release candidate" tag. -1. Confirm that the ``OPENEXR_VERSION_MAJOR``, - ``OPENEXR_VERSION_MINOR``, and ``OPENEXR_VERSION_PATCH`` value in - [src/lib/OpenEXRCore/openexr_version.h](src/lib/OpenEXRCore/openexr_version.h) - are correct. The OpenEXR project policy is that the values on the - main branch, which is the bleeding edge of development, correspond - to the next minor release, with the patch set to 0. + Obviously, build locally and confirm nothing broke in the + cherry-picking commits and resolving conflicts. + + Push the release branch and confirm the CI succeeds before creating + the release candidate tag. -2. Update the release notes in [CHANGES.md](CHANGES.md): + Create the tag with a `-rc` suffix, e.g. `v3.4.12-rc`. + + The `tag.py` script create a signed tag using the release notes as + the tag message: - - Write a high-level summary of the features and improvements. + % python share/util/release/tag.py v3.4.12-rc - - Include the log of all PR's that have *not* been merged into the - previous minor release. + Adding the release notes as the tag message is good practice. - - Mention any OSS-Fuzz issues. Provide a link in the notes to the issue at - https://bugs.chromium.org/p/oss-fuzz, including the issue id - number and description. + Push the tags. This triggers the `python-wheels-publish-test` + CI workflow. Confirm it succeeds. - - If there are any public CVE's, mention them explicitly with a - link to the CVE registry item. + Run the `candidate.py` script to format a + message about the release candidate, formatted in HTML. Pipe the + output to a `.html` file: + + % python share/util/release/candidate.py v3.4.12-rc > v3.4.12.html - - Submit this change as a separate PR. + Load the file in a browers to render the formatting, then + copy/paste the contents into an email to `openexr-dev@lists.aswf.io` + and the `#openexr` Slack channel. -3. Add a mention of the release to [``website/news.rst``](website/news.rst) + If any problems arise after tagging the candidate, fix them in + subsequent commits and create an + additional tag with a number appended: + + % python share/util/release/tag.py v3.4.12-rc2 - - Submit this change as a separate PR. +5. Draft the GitHub release -4. Increment the ``OPENEXR_LIB_SOVERSION`` setting in [CMakeLists.txt](CMakeLists.txt). + % python share/util/release/draft.py v3.4.12 + + Verify the notes look correct on the + [Releases](https://github.com/AcademySoftwareFoundation/openexr/releases) + page and edit as appropriate. Save as a "draft". DO NOT PUBLISH THE + RELEASE YET. - - The SO version increases whenever, and only when, the ABI changes - in non-backwards-compatible ways. Consistent with the semantic - versioning policy, this usually happens at major and minor - releases, but never on a patch release. +6. Create a signed release tag - - Submit this change as a separate PR for review. + Assuming you have your PGP key set up, create the release tag at + the same commit as the release candidate: + + % python share/util/release/tag.py v3.4.12 + +7. Publish the release + + Set the GitHub release to correspond to the release tag (the `Tag: + Select tag` option), then click the "Publish release" button on the + GitHub release draft. + + Monitor the GitHub actions on the + `https://github.com/AcademySoftwareFoundation/openexr` repo to + ensure everything builds properly. + + Update the `release` branch, which should always point to the + most recent patch of the most recent minor release, i.e. the most + preferred release. -5. Once the above PR's are merged, create the release branch with the - ``RB`` prefix, e.g. ``RB-3.2``. + From a clone of the main repo: -6. Update the ``IMATH_TAG`` setting in - [cmake/OpenEXRSetup.cmake](cmake/OpenEXRSetup.cmake) to correspond - to the proper Imath release. + % git checkout release + % git merge RB-3.1 + % git push -7. Tag the release with a ``-rc`` "release candidate" tag, - e.g. ``v3.2.0-rc``. + Publishing the release triggers a post on the `#openexr` Slack + channel, but you must manually send an email to + `openexr-dev@lists.aswf.io` officially announcing the release. -8. Send mail to ``openexr-dev@lists.aswf.io`` announcing the staging - of the release with link to the release candidate tag. Include the - release notes from [CHANGES.md](CHANGES.md) for review. +8. Add an entry to the website news page. -9. If additional fixes need to go in before release: + % python share/util/release/news.py v3.4.12 - a. Merge commits to the release branch. Push them directly, no need - for a pull request. + This pulls the release notes from `CHANGES.md` and inserts a news + item in `website/news.rst` and `website/latest_news_title.rst`. - b. Update the release notes in a separate commit. + Commit this change, and then cherry-pick the commit from the + release branch containing the notes and submit the pair as a + PR. This pulls the release notes for the patch into the main branch. - c. Re-tag with a incremented "release candidate" number, - e.g. ``v3.2.0-rc2``. +## Creating a Major/Minor Release - d. Send a email update to ``openexr-dev@lists.aswf.io`` notifying - the community of the addition. +A major/minor release is created from the main branch, assuming there +are no changes on ``main`` that should *not* go into the release. We +don't generally allow experimental changes onto ``main``. Anything +accepted onto ``main`` should be intended for the next minor/major +(not _patch_)release. -10. Draft the release on the GitHub - [Releases](https://github.com/AcademySoftwareFoundation/openexr/releases) - page. Include the summary from the notes in - [CHANGES.md](CHANGES.md), but don't include the list of PR's. +The overall workflow is similar to a patch release, as described +above, but it's simpler because there is no cherry-picking of +commits. The major/minor release is simply a snapshot of ``main``. - - Create the release from the latest ``--rc`` tag, and give it a name - that begins with ``v`` and ends in ``0``, e.g. ``v3.2.0``. +To create a new release from the ``main`` branch, start by creating +the new "release branch", e.g. `RB-3.5` from the tip of `main`. Then +follow the same instructions above as for a patch release. - - Save the release as a "draft". +Assuming all PRs that have _not_ been merged into a patch release are +labeled with the new minor release, e.g. `v3.5`, the helper scripts in +`share/util/release` will automate the various steps in generating the +release notes, drafting the release, and helping with the various +announcements. -11. Wait at least 48 hours after the email announcement. +In addition to the above: + +1. Increment the ``OPENEXR_LIB_SOVERSION`` setting in [CMakeLists.txt](CMakeLists.txt). -12. Publish the release + The SO version increases whenever, and only when, the ABI changes + in non-backwards-compatible ways. Consistent with the semantic + versioning policy, this usually happens at major and minor + releases, but never on a patch release. - a. Click the "Publish release" button on the GitHub release draft + Commit this change to the `RB-` branch. - b. Send an email to ``openexr-dev@lists.aswf.io`` officially - announcing the release. -13. Update the ``release`` branch, which should always point to the - most recent release. +2. Confirm that the ``OPENEXR_VERSION_MAJOR``, + ``OPENEXR_VERSION_MINOR``, and ``OPENEXR_VERSION_PATCH`` value in + [src/lib/OpenEXRCore/openexr_version.h](src/lib/OpenEXRCore/openexr_version.h) + are correct on the main branch. The OpenEXR project policy is that + the values on the main branch, which is the bleeding edge of + development, correspond to the next minor release, with the patch + set to 0. - From a clone of the main repo: +3. Update the ``IMATH_TAG`` setting in + [cmake/OpenEXRSetup.cmake](cmake/OpenEXRSetup.cmake) to correspond + to the proper Imath release. - % git checkout release - % git merge RB-3.1 - % git push - -14. Increment ``OPENEXR_VERSION_MINOR`` in - [src/lib/OpenEXRCore/openexr_version.h](src/lib/OpenEXRCore/openexr_version.h) on the main branch - - - Submit a PR for this. This leaves the release version on the - main branch pointing to the next minor release, as described in - Step #1. - -15. Build the website at https://readthedocs.org/projects/openexr. - -16. If the release has resolved any OSS-Fuzz issues, update the - associated pages at https://bugs.chromium.org/p/oss-fuzz with a - reference to the release. - -17. If the release has resolved any public CVE's, request an update - from the registry service providing the release and a link to the - release notes. diff -Nru openexr-3.4.6+ds/debian/changelog openexr-3.4.14/debian/changelog --- openexr-3.4.6+ds/debian/changelog 2026-03-18 19:39:57.000000000 +0200 +++ openexr-3.4.14/debian/changelog 2026-08-20 19:49:50.000000000 +0300 @@ -1,3 +1,41 @@ +openexr (3.4.14-0.1) unstable; urgency=medium + + * Non-maintainer upload. + * New upstream release. (Closes: #1136879) + - Fixes FTBFS with glibc 2.43. (Closes: #1144878) + - CVE-2026-34378: Signed integer overflow in generic_unpack() + - CVE-2026-34379: Misaligned write in LossyDctDecoder_execute + - CVE-2026-34380: Signed integer overflow in undo_pxr24_impl() + - CVE-2026-34588: Signed 32-bit Overflow in PIZ Decoder + - CVE-2026-34589: DWA Lossy Decoder Heap Out-of-Bounds Write + (Closes: #1133188) + - CVE-2026-34543: Heap information disclosure in PXR24 decompression + (Closes: #1132580) + - CVE-2026-34544: Integer overflow in uncompress_b44_impl() + (Closes: #1132579) + - CVE-2026-34545: Integer overflow in HTJ2K decoder + (Closes: #1132578) + - CVE-2026-39886: Signed Integer Overflow in ht_undo_impl() + - CVE-2026-40244: Integer overflow in DWA setupChannelData + - CVE-2026-40250: Integer overflow in DWA decoder + (Closes: #1134642) + - CVE-2026-41142: Integer overflow in ImageChannel::resize() + (Closes: #1135946) + - CVE-2026-42216: Out-of-bounds read in IDManifest::init() + - CVE-2026-42217: Shift exponent overflow in readVariableLengthInteger() + (Closes: #1136001) + - CVE-2026-44663: Integer overflow in HTJ2K decoder + - CVE-2026-45696: Heap buffer overflow in ht_undo_impl() + * Generate Provides that includes the Imath version and use in the shlibs. + (Closes: #1144763) + * Disable test that fails on armhf instead of ignoring all test failures + on armhf. + * Ignore test failures on all big endian architectures. + * Attempt to fix FTBFS on hurd-amd64. + * Ignore test failures on Hurd. + + -- Adrian Bunk Thu, 20 Aug 2026 19:49:50 +0300 + openexr (3.4.6+ds-4) unstable; urgency=medium * Team upload diff -Nru openexr-3.4.6+ds/debian/control openexr-3.4.14/debian/control --- openexr-3.4.6+ds/debian/control 2026-03-18 19:37:53.000000000 +0200 +++ openexr-3.4.14/debian/control 2026-08-20 19:49:50.000000000 +0300 @@ -24,6 +24,7 @@ Depends: ${misc:Depends}, ${shlibs:Depends} Breaks: libopenexr-3-1-30 (<< 3.4.6+ds-3) Replaces: libopenexr-3-1-30 (<< 3.4.6+ds-3) +Provides: ${libopenexr:Provides} Description: runtime files for the OpenEXR image library OpenEXR is a high dynamic-range (HDR) image file format developed by Industrial Light & Magic for use in computer imaging applications. diff -Nru openexr-3.4.6+ds/debian/patches/hack-test-armhf.patch openexr-3.4.14/debian/patches/hack-test-armhf.patch --- openexr-3.4.6+ds/debian/patches/hack-test-armhf.patch 1970-01-01 02:00:00.000000000 +0200 +++ openexr-3.4.14/debian/patches/hack-test-armhf.patch 2026-08-20 19:49:50.000000000 +0300 @@ -0,0 +1,16 @@ +Description: Disable test that fails on armhf +Author: Adrian Bunk +Bug: https://github.com/AcademySoftwareFoundation/openexr/issues/2134#issuecomment-4223184412 +Forwarded: not-needed + +--- openexr-3.4.14.orig/src/test/OpenEXRTest/main.cpp ++++ openexr-3.4.14/src/test/OpenEXRTest/main.cpp +@@ -181,7 +181,7 @@ main (int argc, char* argv[]) + TEST (testWav, "core"); + TEST (testRgba, "basic"); + TEST (testCRgba, "basic"); +- TEST (testLargeDataWindowOffsets, "basic"); ++ //TEST (testLargeDataWindowOffsets, "basic"); + TEST (testSharedFrameBuffer, "basic"); + TEST (testRgbaThreading, "basic"); + TEST (testChannels, "basic"); diff -Nru openexr-3.4.6+ds/debian/patches/hurd-no-sa_restorer.patch openexr-3.4.14/debian/patches/hurd-no-sa_restorer.patch --- openexr-3.4.6+ds/debian/patches/hurd-no-sa_restorer.patch 1970-01-01 02:00:00.000000000 +0200 +++ openexr-3.4.14/debian/patches/hurd-no-sa_restorer.patch 2026-08-20 19:49:50.000000000 +0300 @@ -0,0 +1,14 @@ +Description: sigaction(2) says that sa_restorer should not be used + This also caused a FTBFS on Hurd. +Author: Adrian Bunk + +--- openexr-3.4.14.orig/src/lib/Iex/IexMathFpu.cpp ++++ openexr-3.4.14/src/lib/Iex/IexMathFpu.cpp +@@ -420,7 +420,6 @@ setFpExceptionHandler (FpExceptionHandle + sigemptyset (&action.sa_mask); + action.sa_flags = SA_SIGINFO | SA_NOMASK; + action.sa_sigaction = (void (*) (int, siginfo_t*, void*)) catchSigFpe; +- action.sa_restorer = 0; + + sigaction (SIGFPE, &action, 0); + } diff -Nru openexr-3.4.6+ds/debian/patches/series openexr-3.4.14/debian/patches/series --- openexr-3.4.6+ds/debian/patches/series 1970-01-01 02:00:00.000000000 +0200 +++ openexr-3.4.14/debian/patches/series 2026-08-20 19:49:50.000000000 +0300 @@ -0,0 +1,2 @@ +hack-test-armhf.patch +hurd-no-sa_restorer.patch diff -Nru openexr-3.4.6+ds/debian/rules openexr-3.4.14/debian/rules --- openexr-3.4.6+ds/debian/rules 2026-03-18 19:37:53.000000000 +0200 +++ openexr-3.4.14/debian/rules 2026-08-20 19:49:50.000000000 +0300 @@ -5,10 +5,24 @@ INSTDIR = debian/tmp +LIB_PKG = $(shell dh_listpackages | grep libopenexr | grep -v libopenexr-d) +ABI_PKG = $(LIB_PKG)-imath$(shell pkgconf --variable=libsuffix Imath | sed 's/_/-/g') + %: dh $@ -Bbuild -Scmake -ifneq (,$(filter armhf s390x,$(DEB_HOST_ARCH))) +override_dh_makeshlibs: + echo "libopenexr:Provides=$(ABI_PKG)" >> debian/$(LIB_PKG).substvars + dh_makeshlibs -p$(LIB_PKG) -V "$(ABI_PKG)" + dh_makeshlibs --remaining-packages + +ifeq ($(DEB_HOST_ARCH_ENDIAN),big) +# Ignore test results +override_dh_auto_test: + -dh_auto_test +endif + +ifeq ($(DEB_HOST_ARCH_OS),hurd) # Ignore test results override_dh_auto_test: -dh_auto_test diff -Nru openexr-3.4.6+ds/.github/dependabot.yml openexr-3.4.14/.github/dependabot.yml --- openexr-3.4.6+ds/.github/dependabot.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/dependabot.yml 2026-08-05 04:29:55.000000000 +0300 @@ -11,12 +11,18 @@ interval: "daily" exclude-paths: - ".github/workflows/ci_workflow_old.yml" - + - package-ecosystem: "pip" - directory: "/" + directory: "/website" schedule: day: "monday" interval: "weekly" + # Hashed lockfile is regenerated locally with pip-compile; do not let + # Dependabot rewrite it (transitive bumps belong in requirements.txt or + # a deliberate lock regen, not automated lock-only PRs). + exclude-paths: + - "website/requirements-lock.txt" + - "website/requirements.txt.lock" - package-ecosystem: "gitsubmodule" directory: "/" @@ -24,7 +30,7 @@ day: "monday" interval: "weekly" - - package-ecosystem: "bazel" + - package-ecosystem: "bazel" directory: "/" schedule: interval: "weekly" \ No newline at end of file diff -Nru openexr-3.4.6+ds/.github/workflows/analysis_workflow.yml openexr-3.4.14/.github/workflows/analysis_workflow.yml --- openexr-3.4.6+ds/.github/workflows/analysis_workflow.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/analysis_workflow.yml 2026-08-05 04:29:55.000000000 +0300 @@ -29,17 +29,13 @@ container: # DockerHub: https://hub.docker.com/u/aswf # Source: https://github.com/AcademySoftwareFoundation/aswf-docker - image: aswf/ci-openexr:2024 + image: aswf/ci-openexr:2026 env: CXX: g++ CC: gcc steps: - # TODO: Remove this workaround following resolution of: - # https://github.com/AcademySoftwareFoundation/aswf-docker/issues/43 - - name: Setup container - run: sudo rm -rf /usr/local/lib64/cmake/glew - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 50 - name: Create build directories @@ -109,7 +105,7 @@ - name: Setup container run: sudo rm -rf /usr/local/lib64/cmake/glew - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 50 - name: Create build directories @@ -188,7 +184,7 @@ - name: Setup container run: sudo rm -rf /usr/local/lib64/cmake/glew - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 50 - name: Create build directories diff -Nru openexr-3.4.6+ds/.github/workflows/bazel_build.yml openexr-3.4.14/.github/workflows/bazel_build.yml --- openexr-3.4.6+ds/.github/workflows/bazel_build.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/bazel_build.yml 2026-08-05 04:29:55.000000000 +0300 @@ -39,10 +39,10 @@ runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Mount Bazel cache - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: "/home/runner/.cache/bazel" key: bazel-ubuntu-24 @@ -57,10 +57,10 @@ runs-on: windows-2025 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Mount Bazel cache - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: "/home/runner/.cache/bazel" key: bazel-windows-2025 @@ -75,10 +75,10 @@ runs-on: macos-15 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Mount Bazel cache - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: "/home/runner/.cache/bazel" key: bazel-macos-15 diff -Nru openexr-3.4.6+ds/.github/workflows/ci_freebsd.yml openexr-3.4.14/.github/workflows/ci_freebsd.yml --- openexr-3.4.6+ds/.github/workflows/ci_freebsd.yml 1970-01-01 02:00:00.000000000 +0200 +++ openexr-3.4.14/.github/workflows/ci_freebsd.yml 2026-08-05 04:29:55.000000000 +0300 @@ -0,0 +1,60 @@ +# SPDX-License-Identifier: BSD-3-Clause +# Copyright (c) Contributors to the OpenEXR Project. +# +# Build and test on FreeBSD using a community VM action. +# GitHub does not provide native FreeBSD runners; this uses vmactions/freebsd-vm. +# Validates the pthread fallback in internal_thread.h (issue #2299). + +name: CI (FreeBSD) + +on: + push: + paths: + - '**' + - '!**.md' + - '!website/**' + - '!bazel/**' + - '!src/wrappers/**' + - '!.github/workflows/**' + - '.github/workflows/ci_freebsd.yml' + pull_request: + paths: + - '**' + - '!**.md' + - '!website/**' + - '!bazel/**' + - '!src/wrappers/**' + - '!.github/workflows/**' + - '.github/workflows/ci_freebsd.yml' + +permissions: + contents: read + +jobs: + freebsd: + name: FreeBSD + runs-on: ubuntu-latest + steps: + - name: Build and test on FreeBSD + uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d # v1.5.2 + with: + release: '15.0' + envs: GITHUB_REPOSITORY GITHUB_REF GITHUB_SHA + usesh: true + prepare: | + pkg install -y cmake ninja git + run: | + set -e + git clone --depth 1 "https://github.com/${GITHUB_REPOSITORY}.git" src + cd src + # shallow clone, only the commit that triggered the run, i.e. GITHUB_SHA + git fetch --depth 1 origin "${GITHUB_SHA}" + git checkout "${GITHUB_SHA}" + cmake -B _build -S . -G Ninja \ + -DCMAKE_BUILD_TYPE=Release \ + -DOPENEXR_FORCE_INTERNAL_IMATH=ON \ + -DOPENEXR_FORCE_INTERNAL_DEFLATE=ON \ + -DOPENEXR_FORCE_INTERNAL_OPENJPH=ON \ + -DBUILD_TESTING=ON + cmake --build _build + ctest --test-dir _build --output-on-failure diff -Nru openexr-3.4.6+ds/.github/workflows/ci_steps.yml openexr-3.4.14/.github/workflows/ci_steps.yml --- openexr-3.4.6+ds/.github/workflows/ci_steps.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/ci_steps.yml 2026-08-05 04:29:55.000000000 +0300 @@ -64,10 +64,16 @@ validate_install: type: string +permissions: + contents: read + jobs: steps: runs-on: ${{ inputs.os }} + permissions: + contents: write # required for actions/upload-artifact + container: image: ${{ inputs.container }} @@ -80,7 +86,7 @@ steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set Up Directories & Environment run: | @@ -120,17 +126,33 @@ shell: bash + - name: Report C Runtime Version + run: | + if [[ "$RUNNER_OS" == "Linux" ]]; then + ldd --version 2>&1 | head -1 || true + elif [[ "$RUNNER_OS" == "macOS" ]]; then + echo "macOS SDK: $(xcrun --show-sdk-version 2>/dev/null || echo 'unknown')" + fi + shell: bash + + - name: Install Build Dependencies (Fedora) + if: startsWith(inputs.container, 'fedora:') + run: | + dnf install -y gcc gcc-c++ cmake make git wget libdeflate-devel + shell: bash + - name: Determine MSYS2 Packages if: inputs.msystem != '' run: | PACKAGES="cc:p cmake:p" - if [ "${{ inputs.OPENEXR_FORCE_INTERNAL_IMATH }}" == "OFF" ]; then + # mingw32 has no package for imath and openjph + if [[ "${{ inputs.OPENEXR_FORCE_INTERNAL_IMATH }}" == "OFF" && "${{ inputs.msystem }}" != "MINGW32" ]]; then PACKAGES="$PACKAGES imath:p" fi if [ "${{ inputs.OPENEXR_FORCE_INTERNAL_DEFLATE }}" == "OFF" ]; then PACKAGES="$PACKAGES libdeflate:p" fi - if [ "${{ inputs.OPENEXR_FORCE_INTERNAL_OPENJPH }}" == "OFF" && "${{ inputs.msystem }}" != "MINGW32" ]; then + if [[ "${{ inputs.OPENEXR_FORCE_INTERNAL_OPENJPH }}" == "OFF" && "${{ inputs.msystem }}" != "MINGW32" ]]; then PACKAGES="$PACKAGES openjph:p" fi echo "PACBOY_PACKAGES=$PACKAGES" >> $GITHUB_ENV @@ -138,7 +160,7 @@ - name: Install MSYS2 ${{ inputs.msystem }} if: inputs.msystem != '' - uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0 + uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0 with: msystem: ${{ inputs.msystem }} update: true @@ -177,6 +199,14 @@ echo "OPENEXR_PATH=$OPENEXR_PATH:$PROGRAM_FILES/Imath/bin:$PROGRAM_FILES/Imath/lib" >> $GITHUB_ENV shell: bash + - name: Install Imath (msys2) + # mingw32 has no package for imath, so install manually + if: inputs.OPENEXR_FORCE_INTERNAL_IMATH == 'OFF' && inputs.msystem == 'MINGW32' + run: | + set -x + share/ci/scripts/install_imath.sh main + shell: msys2 {0} + - name: Install libdeflate # Pre-install libdeflate so the builds validate that find_package sees the external installation if: inputs.OPENEXR_FORCE_INTERNAL_DEFLATE == 'OFF' && inputs.msystem == '' @@ -195,6 +225,14 @@ echo "OPENEXR_PATH=$OPENEXR_PATH:$PROGRAM_FILES/openjph/bin:$PROGRAM_FILES/openjph/lib" >> $GITHUB_ENV shell: bash + - name: Install OpenJPH (msys2) + # mingw32 has no package for openjph, so install manually + if: inputs.OPENEXR_FORCE_INTERNAL_OPENJPH == 'OFF' && inputs.msystem == 'MINGW32' + run: | + set -x + share/ci/scripts/install_openjph.sh 0.22.0 + shell: msys2 {0} + - name: Install help2man # TODO: this could go in the ASWF Linux docker # container. Also, it doesn't currently work for Windows, so @@ -297,7 +335,7 @@ - name: Upload install_manifest.txt # Upload the manifest to make it possible to download for inspection and debugging - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ env.INSTALL_MANIFEST_FILENAME }} path: ${{ env.INSTALL_MANIFEST_PATH }} diff -Nru openexr-3.4.6+ds/.github/workflows/ci_workflow_old.yml openexr-3.4.14/.github/workflows/ci_workflow_old.yml --- openexr-3.4.6+ds/.github/workflows/ci_workflow_old.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/ci_workflow_old.yml 2026-08-05 04:29:55.000000000 +0300 @@ -64,6 +64,9 @@ - /node20217:/node20217:rw,rshared - /node20217:/__e/node20:ro,rshared + env: + ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true + strategy: matrix: include: diff -Nru openexr-3.4.6+ds/.github/workflows/ci_workflow.yml openexr-3.4.14/.github/workflows/ci_workflow.yml --- openexr-3.4.6+ds/.github/workflows/ci_workflow.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/ci_workflow.yml 2026-08-05 04:29:55.000000000 +0300 @@ -56,6 +56,8 @@ jobs: linux: name: 'Linux.${{ matrix.build}}: ${{ matrix.label }}' + permissions: + contents: write # required by ci_steps (upload-artifact) uses: ./.github/workflows/ci_steps.yml with: # Set values for the "inputs:" as defined in ci_steps.yml @@ -65,7 +67,7 @@ build: ${{ matrix.build }} # DockerHub: https://hub.docker.com/u/aswf # Source: https://github.com/AcademySoftwareFoundation/aswf-docker - container: aswf/ci-openexr:${{ matrix.vfx-cy || '2024' }} + container: ${{ matrix.container || format('aswf/ci-openexr:{0}', matrix.vfx-cy || '2024') }} cmake: ${{ matrix.cmake || '3.14.7' }} cxx-standard: ${{ matrix.cxx-standard || '17' }} cxx-compiler: ${{ matrix.cxx-compiler || 'g++' }} @@ -147,8 +149,26 @@ RUN_TESTING: OFF validate_install: OFF + - build: 12 + label: Fedora Rawhide + container: fedora:rawhide + cmake: '3.31.6' + OPENEXR_FORCE_INTERNAL_IMATH: 'ON' + OPENEXR_FORCE_INTERNAL_DEFLATE: 'OFF' + OPENEXR_FORCE_INTERNAL_OPENJPH: 'ON' + OPENEXR_INSTALL_DOCS: 'OFF' + validate_install: 'OFF' + + - build: 13 + label: STATIC w/vendored OpenJPH + OPENEXR_FORCE_INTERNAL_OPENJPH: 'ON' + BUILD_SHARED_LIBS: 'OFF' + RUN_TESTING: OFF + macOS: name: 'macOS.${{ matrix.build}}: ${{ matrix.label }}' + permissions: + contents: write # required by ci_steps (upload-artifact) uses: ./.github/workflows/ci_steps.yml with: # Set values for the "inputs:" as defined in ci_steps.yml @@ -233,6 +253,8 @@ windows: name: 'Windows.${{ matrix.build}}: ${{ matrix.label }}' + permissions: + contents: write # required by ci_steps (upload-artifact) uses: ./.github/workflows/ci_steps.yml with: # Set values for the "inputs:" as defined in ci_steps.yml diff -Nru openexr-3.4.6+ds/.github/workflows/codeql.yml openexr-3.4.14/.github/workflows/codeql.yml --- openexr-3.4.6+ds/.github/workflows/codeql.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/codeql.yml 2026-08-05 04:29:55.000000000 +0300 @@ -22,6 +22,9 @@ schedule: - cron: '37 10 * * 0' +permissions: + contents: read + jobs: analyze: name: Analyze (${{ matrix.language }}) @@ -58,14 +61,14 @@ # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL # cary: Pin the version to the SHA for 2.18.0, since there appears to # be a problem with 2.18.1 leading to a "No space left on # device" failure - uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 + uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: # cary: the "linked" setting is necessary to force the run to pick up # the version specified in the action. @@ -96,6 +99,11 @@ - name: Perform CodeQL Analysis # Pin the version to the SHA for 2.18.0 - uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 + uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: category: "/language:${{matrix.language}}" + # For pull_request, upload against refs/pull//head + head SHA so the Code + # Scanning API does not require refs/heads/ (e.g. Dependabot branches + # can trigger "ref ... not found"). Ignored for fork PRs by the action. + ref: ${{ github.event_name == 'pull_request' && format('refs/pull/{0}/head', github.event.pull_request.number) || github.ref }} + sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} diff -Nru openexr-3.4.6+ds/.github/workflows/ossfuzz_workflow.yml openexr-3.4.14/.github/workflows/ossfuzz_workflow.yml --- openexr-3.4.6+ds/.github/workflows/ossfuzz_workflow.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/ossfuzz_workflow.yml 2026-08-05 04:29:55.000000000 +0300 @@ -48,7 +48,7 @@ dry-run: false language: c++ - name: Upload Crash - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: failure() && steps.build.outcome == 'success' with: name: artifacts diff -Nru openexr-3.4.6+ds/.github/workflows/python-wheels-publish-test.yml openexr-3.4.14/.github/workflows/python-wheels-publish-test.yml --- openexr-3.4.6+ds/.github/workflows/python-wheels-publish-test.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/python-wheels-publish-test.yml 2026-08-05 04:29:55.000000000 +0300 @@ -13,12 +13,47 @@ - v3.[0-9]+.[0-9]+-rc* workflow_dispatch: +concurrency: + group: testpypi-publish-${{ github.ref }} + cancel-in-progress: false + permissions: contents: read jobs: + guard: + name: Verify RB-* release ref + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + ref: ${{ github.ref }} + + - name: Verify RB-* release ref + env: + EVENT_NAME: ${{ github.event_name }} + REF_NAME: ${{ github.ref_name }} + run: | + set -euo pipefail + + if [[ "$EVENT_NAME" == "workflow_dispatch" && "$REF_NAME" != RB-* ]]; then + echo "::error::workflow_dispatch must use an RB-* branch (not $REF_NAME)." + exit 1 + fi + + git fetch origin '+refs/heads/RB-*:refs/remotes/origin/RB-*' || git fetch origin + + if ! git branch -r --contains HEAD | grep -E -q 'origin/RB-'; then + echo "::error::Ref must be on an RB-* release branch (not main)." + git branch -r --contains HEAD || true + exit 1 + fi + build: name: Python Wheels - ${{ matrix.os }}-${{ matrix.arch }} + needs: guard runs-on: ${{ matrix.os }} strategy: matrix: @@ -29,24 +64,24 @@ arch: arm64 - os: macos-15-intel arch: x64 + cibw_archs_macos: x86_64 universal2 - os: macos-latest arch: arm64 + cibw_archs_macos: arm64 - os: windows-latest arch: x64 - environment: - name: testpypi - url: https://test.pypi.org/p/openexr - permissions: - id-token: write - + contents: read + actions: write + steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Install Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - name: Install Python + if: ${{ matrix.os == 'ubuntu-latest' }} + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.x' @@ -55,25 +90,25 @@ if: ${{ matrix.os == 'ubuntu-latest' }} env: OPENEXR_RELEASE_CANDIDATE_TAG: ${{ github.ref_name }} - run: pipx run build --sdist . --outdir wheelhouse + run: pipx run build==1.2.2.post1 --sdist . --outdir wheelhouse - name: Build wheel - uses: pypa/cibuildwheel@v3.3 + uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4.1 with: output-dir: wheelhouse env: MACOSX_DEPLOYMENT_TARGET: 10.15 - CIBW_ARCHS_MACOS: x86_64 arm64 universal2 + # Split macOS arches across runners so artifact merge does not collide on filenames. + CIBW_ARCHS_MACOS: ${{ matrix.cibw_archs_macos }} # Build Python 3.8 through 3.13. # Skip 32-bit wheels builds on Windows # Also skip the PyPy builds, since they fail the unit tests CIBW_BUILD: "cp38-* cp39-* cp310-* cp311-* cp312-* cp313-*" CIBW_SKIP: "*-win32 *_i686" - CIBW_TEST_SKIP: "*-macosx_universal2:arm64" CIBW_ENVIRONMENT: OPENEXR_RELEASE_CANDIDATE_TAG="${{ github.ref_name }}" - name: Upload artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: wheels-${{ matrix.os }}-${{ matrix.arch }} path: | @@ -91,41 +126,19 @@ url: https://test.pypi.org/p/openexr permissions: + contents: read + actions: read id-token: write steps: + - name: Download wheel artifacts + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + pattern: wheels-* + merge-multiple: true + path: dist - - name: Download ubuntu-latest-x64 artifacts - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: wheels-ubuntu-latest-x64 - path: dist - - - name: Download ubuntu-24.04-arm-arm64 artifacts - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: wheels-ubuntu-24.04-arm-arm64 - path: dist - - - name: Download macos-15-intel-x64 artifacts - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: wheels-macos-15-intel-x64 - path: dist - - - name: Download macos-latest-arm64 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: wheels-macos-latest-arm64 - path: dist - - - name: Download windows-latest-x64 artifacts - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: wheels-windows-latest-x64 - path: dist - - - name: Publish distribution 📦 to TestPyPI - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 - with: - repository-url: https://test.pypi.org/legacy/ + - name: Publish distribution 📦 to TestPyPI + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 + with: + repository-url: https://test.pypi.org/legacy/ diff -Nru openexr-3.4.6+ds/.github/workflows/python-wheels-publish.yml openexr-3.4.14/.github/workflows/python-wheels-publish.yml --- openexr-3.4.6+ds/.github/workflows/python-wheels-publish.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/python-wheels-publish.yml 2026-08-05 04:29:55.000000000 +0300 @@ -8,13 +8,48 @@ release: types: [published] workflow_dispatch: - + +concurrency: + group: pypi-publish-${{ github.event.release.tag_name || github.ref }} + cancel-in-progress: false + permissions: contents: read jobs: + guard: + name: Verify RB-* release ref + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + ref: ${{ github.event_name == 'release' && github.event.release.tag_name || github.ref }} + + - name: Verify RB-* release ref + env: + EVENT_NAME: ${{ github.event_name }} + REF_NAME: ${{ github.ref_name }} + run: | + set -euo pipefail + + if [[ "$EVENT_NAME" == "workflow_dispatch" && "$REF_NAME" != RB-* ]]; then + echo "::error::workflow_dispatch must use an RB-* branch (not $REF_NAME)." + exit 1 + fi + + git fetch origin '+refs/heads/RB-*:refs/remotes/origin/RB-*' || git fetch origin + + if ! git branch -r --contains HEAD | grep -E -q 'origin/RB-'; then + echo "::error::Ref must be on an RB-* release branch (not main)." + git branch -r --contains HEAD || true + exit 1 + fi + build: name: Python Wheels - ${{ matrix.os }}-${{ matrix.arch }} + needs: guard runs-on: ${{ matrix.os }} strategy: matrix: @@ -25,48 +60,48 @@ arch: arm64 - os: macos-15-intel arch: x64 + cibw_archs_macos: x86_64 universal2 - os: macos-latest arch: arm64 + cibw_archs_macos: arm64 - os: windows-latest arch: x64 - environment: - name: pypi - url: https://pypi.org/p/openexr - permissions: - id-token: write + contents: read + actions: write steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Install Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - name: Install Python + if: ${{ matrix.os == 'ubuntu-latest' }} + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.x' - name: Create sdist # Only create it once. if: ${{ matrix.os == 'ubuntu-latest' }} - run: pipx run build --sdist . --outdir wheelhouse + run: pipx run build==1.2.2.post1 --sdist . --outdir wheelhouse - name: Build wheel - uses: pypa/cibuildwheel@v3.3 + uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4.1 with: output-dir: wheelhouse env: MACOSX_DEPLOYMENT_TARGET: 10.15 - CIBW_ARCHS_MACOS: x86_64 arm64 universal2 + # Split macOS arches across runners so artifact merge does not collide on filenames. + CIBW_ARCHS_MACOS: ${{ matrix.cibw_archs_macos }} # Build Python 3.8 through 3.13 # Skip 32-bit wheels builds on Windows # Also skip the PyPy builds, since they fail the unit tests CIBW_BUILD: "cp38-* cp39-* cp310-* cp311-* cp312-* cp313-*" CIBW_SKIP: "*-win32 *_i686" - CIBW_TEST_SKIP: "*arm64" - name: Upload artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: wheels-${{ matrix.os }}-${{ matrix.arch }} path: | @@ -84,39 +119,17 @@ url: https://pypi.org/p/openexr permissions: + contents: read + actions: read id-token: write steps: + - name: Download wheel artifacts + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + pattern: wheels-* + merge-multiple: true + path: dist - - name: Download ubuntu-latest-x64 artifacts - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: wheels-ubuntu-latest-x64 - path: dist - - - name: Download ubuntu-24.04-arm-arm64 artifacts - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: wheels-ubuntu-24.04-arm-arm64 - path: dist - - - name: Download macos-15-intel-x64 artifacts - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: wheels-macos-15-intel-x64 - path: dist - - - name: Download macos-latest-arm64 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: wheels-macos-latest-arm64 - path: dist - - - name: Download windows-latest-x64 artifacts - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 - with: - name: wheels-windows-latest-x64 - path: dist - - - name: Publish distribution 📦 to PyPI - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 + - name: Publish distribution 📦 to PyPI + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 diff -Nru openexr-3.4.6+ds/.github/workflows/python-wheels.yml openexr-3.4.14/.github/workflows/python-wheels.yml --- openexr-3.4.6+ds/.github/workflows/python-wheels.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/python-wheels.yml 2026-08-05 04:29:55.000000000 +0300 @@ -48,41 +48,107 @@ arch: arm64 - os: macos-15-intel arch: x64 + cibw_archs_macos: x86_64 universal2 - os: macos-latest arch: arm64 + cibw_archs_macos: arm64 - os: windows-latest arch: x64 - steps: + permissions: + contents: read + actions: write + steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Install Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - name: Install Python + if: ${{ matrix.os == 'ubuntu-latest' }} + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.x' - name: Create sdist # Only create it once. if: ${{ matrix.os == 'ubuntu-latest' }} - run: pipx run build --sdist . --outdir wheelhouse + run: pipx run build==1.2.2.post1 --sdist . --outdir wheelhouse - name: Build wheel - uses: pypa/cibuildwheel@v3.3 + uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4.1 + with: + output-dir: wheelhouse env: - CIBW_ARCHS_MACOS: x86_64 arm64 universal2 + # Split macOS arches across runners so artifact merge does not collide on filenames. + CIBW_ARCHS_MACOS: ${{ matrix.cibw_archs_macos }} # Build Python 3.8 through 3.13 # Skip 32-bit wheels builds on Windows # Also skip the PyPy builds, since they fail the unit tests CIBW_BUILD: "cp38-* cp39-* cp310-* cp311-* cp312-* cp313-*" CIBW_SKIP: "*-win32 *_i686" - CIBW_TEST_SKIP: "*-macosx*arm64" - name: Upload artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: wheels-${{ matrix.os }}-${{ matrix.arch }} path: | ./wheelhouse/*.whl - ./wheelhouse/*.tar.gz \ No newline at end of file + ./wheelhouse/*.tar.gz + + verify_publish_artifacts: + name: Verify merged wheel artifacts + needs: build_wheels + runs-on: ubuntu-latest + + permissions: + contents: read + actions: read + + steps: + - name: Download wheel artifacts separately + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + pattern: wheels-* + path: artifacts + + - name: Detect duplicate distribution filenames + run: | + set -euo pipefail + + mapfile -t dupes < <( + find artifacts -type f \( -name '*.whl' -o -name '*.tar.gz' \) -exec basename {} \; \ + | sort \ + | uniq -d + ) + + if ((${#dupes[@]} > 0)); then + echo "::error::Duplicate distribution filenames across build artifacts:" + printf ' %s\n' "${dupes[@]}" + exit 1 + fi + + - name: Download wheel artifacts (as publish does) + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + pattern: wheels-* + merge-multiple: true + path: dist + + - name: Verify wheel ZIP integrity + run: | + set -euo pipefail + shopt -s nullglob + + wheels=(dist/*.whl) + if ((${#wheels[@]} == 0)); then + echo "::error::No wheels found in dist/" + exit 1 + fi + + for wheel in "${wheels[@]}"; do + echo "Checking $wheel" + python3 -m zipfile -t "$wheel" + done + + - name: Validate distribution metadata + run: pipx run twine==6.1.0 check dist/* diff -Nru openexr-3.4.6+ds/.github/workflows/release-notice.yml openexr-3.4.14/.github/workflows/release-notice.yml --- openexr-3.4.6+ds/.github/workflows/release-notice.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/release-notice.yml 2026-08-05 04:29:55.000000000 +0300 @@ -25,7 +25,7 @@ slack_bot_token: ${{ secrets.SLACK_BOT_TOKEN }} slack_channel: "#release-announcements" project_logo: "https://artwork.aswf.io/projects/openexr/icon/color/openexr-icon-color.png" - uses: jmertic/slack-release-notifier@5221a45213eddc6206886797beb079e091c93406 # main + uses: jmertic/slack-release-notifier@9d7d3a84563d2ebc8f7b2271be6c9568fedd7f3a # main - name: 'Notify Slack #openexr' id: slack2 @@ -34,5 +34,6 @@ slack_bot_token: ${{ secrets.SLACK_BOT_TOKEN }} slack_channel: "#openexr" project_logo: "https://artwork.aswf.io/projects/openexr/icon/color/openexr-icon-color.png" - uses: jmertic/slack-release-notifier@5221a45213eddc6206886797beb079e091c93406 # main + uses: jmertic/slack-release-notifier@9d7d3a84563d2ebc8f7b2271be6c9568fedd7f3a # main + \ No newline at end of file diff -Nru openexr-3.4.6+ds/.github/workflows/release-sign.yml openexr-3.4.14/.github/workflows/release-sign.yml --- openexr-3.4.6+ds/.github/workflows/release-sign.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/release-sign.yml 2026-08-05 04:29:55.000000000 +0300 @@ -14,12 +14,20 @@ # % pip install sigstore # % sigstore verify github --cert-identity https://github.com/AcademySoftwareFoundation/openexr/.github/workflows/release-sign.yml@refs/tags/ openexr-.tar.gz # +# To sign an existing release after publish (e.g. workflow fix): Actions → +# Sign Release → Run workflow → enter the release tag (e.g. v3.2.8). name: Sign Release on: release: types: [published] + workflow_dispatch: + inputs: + tag: + description: "Release tag to sign (e.g. v3.2.8)" + required: true + type: string permissions: contents: read @@ -30,12 +38,10 @@ runs-on: ubuntu-latest env: - TAG: ${{ github.ref_name }} + TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }} permissions: - contents: write - id-token: write - repository-projects: write - + contents: write # required for gh release upload (attach assets) + id-token: write # required for sigstore OIDC signing steps: - name: Set Prefix @@ -49,13 +55,15 @@ shell: bash - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }} - name: Create archive run: git archive --format=tar.gz -o ${OPENEXR_TARBALL} --prefix ${OPENEXR_PREFIX} ${TAG} - name: Sign archive with Sigstore - uses: sigstore/gh-action-sigstore-python@a5caf349bc536fbef3668a10ed7f5cd309a4b53d # v3.2.0 + uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0 with: inputs: ${{ env.OPENEXR_TARBALL }} upload-signing-artifacts: false diff -Nru openexr-3.4.6+ds/.github/workflows/scorecard.yml openexr-3.4.14/.github/workflows/scorecard.yml --- openexr-3.4.6+ds/.github/workflows/scorecard.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/scorecard.yml 2026-08-05 04:29:55.000000000 +0300 @@ -28,12 +28,12 @@ steps: - name: "Checkout code" - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif @@ -46,7 +46,7 @@ # Upload the results as artifacts (optional) - name: "Upload artifact" - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: SARIF file path: results.sarif @@ -54,6 +54,6 @@ # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4 + uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 with: sarif_file: results.sarif diff -Nru openexr-3.4.6+ds/.github/workflows/snyk-scan-cron.yml openexr-3.4.14/.github/workflows/snyk-scan-cron.yml --- openexr-3.4.6+ds/.github/workflows/snyk-scan-cron.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/snyk-scan-cron.yml 2026-08-05 04:29:55.000000000 +0300 @@ -17,7 +17,7 @@ runs-on: ubuntu-latest if: github.repository == 'AcademySoftwareFoundation/openexr' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0 id: snyk diff -Nru openexr-3.4.6+ds/.github/workflows/website_preview_link.yml openexr-3.4.14/.github/workflows/website_preview_link.yml --- openexr-3.4.6+ds/.github/workflows/website_preview_link.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/website_preview_link.yml 1970-01-01 02:00:00.000000000 +0200 @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: BSD-3-Clause -# Copyright (c) Contributors to the OpenEXR Project. -# -# GitHub Actions workflow file -# https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions - -# -# This action adds a link to the PR description pointing to the -# readthedocs build of the website, for PRs that modify the website. -# -# Note that the link is also available in the PR checks, but it gets -# buried among the output of the checks and isn't obvious. -# - -name: Website preview link -on: - pull_request_target: - types: - - opened - paths: - - 'website/**' - -permissions: - pull-requests: write - -jobs: - pull-request-links: - runs-on: ubuntu-latest - steps: - - uses: readthedocs/actions/preview@cc0920454cf03ca8a3fbd3cbaa2ce2e509e70636 # v1.2 - with: - project-slug: "openexr" - message-template: "Website preview: {docs-pr-index-url}" - - diff -Nru openexr-3.4.6+ds/.github/workflows/website.yml openexr-3.4.14/.github/workflows/website.yml --- openexr-3.4.6+ds/.github/workflows/website.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.github/workflows/website.yml 2026-08-05 04:29:55.000000000 +0300 @@ -54,7 +54,7 @@ steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Create build directory run: mkdir _build - name: Install doxygen @@ -64,7 +64,7 @@ run: | python3 -m venv _venv source _venv/*/activate - pip3 install -r ../website/requirements.txt + pip3 install --require-hashes -r ../website/requirements-lock.txt cmake .. -DBUILD_WEBSITE=ON -DCMAKE_VERBOSE_MAKEFILE=ON -DSPHINX_OPTS="" working-directory: _build shell: bash diff -Nru openexr-3.4.6+ds/.gitignore openexr-3.4.14/.gitignore --- openexr-3.4.6+ds/.gitignore 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.gitignore 2026-08-05 04:29:55.000000000 +0300 @@ -64,3 +64,4 @@ # Ignore Bazel generated files bazel-* MODULE.bazel.lock +*.vsidx diff -Nru openexr-3.4.6+ds/MODULE.bazel openexr-3.4.14/MODULE.bazel --- openexr-3.4.6+ds/MODULE.bazel 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/MODULE.bazel 2026-08-05 04:29:55.000000000 +0300 @@ -6,9 +6,9 @@ compatibility_level = 1, ) -bazel_dep(name = "bazel_skylib", version = "1.9.0") +bazel_dep(name = "bazel_skylib", version = "1.9.2") bazel_dep(name = "imath", version = "3.2.2.bcr.1") bazel_dep(name = "libdeflate", version = "1.25") bazel_dep(name = "openjph", version = "0.26.3.bcr.1") -bazel_dep(name = "platforms", version = "1.0.0") -bazel_dep(name = "rules_cc", version = "0.2.17") +bazel_dep(name = "platforms", version = "1.1.0") +bazel_dep(name = "rules_cc", version = "0.2.22") diff -Nru openexr-3.4.6+ds/pyproject.toml openexr-3.4.14/pyproject.toml --- openexr-3.4.6+ds/pyproject.toml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/pyproject.toml 2026-08-05 04:29:55.000000000 +0300 @@ -2,7 +2,7 @@ # Copyright (c) Contributors to the OpenEXR Project. [build-system] -requires = ["scikit-build-core==0.11.6", "pybind11"] +requires = ["scikit-build-core==0.12.2", "pybind11==2.13.6", "build==1.2.2.post1"] build-backend = "scikit_build_core.build" [project] @@ -82,10 +82,13 @@ test-skip = ["*universal2:arm64"] build-verbosity = 1 -manylinux-x86_64-image = "manylinux2014" -manylinux-i686-image = "manylinux2014" -manylinux-aarch64-image = "manylinux2014" +manylinux-x86_64-image = "manylinux_2_28" +manylinux-i686-image = "manylinux_2_28" +manylinux-aarch64-image = "manylinux_2_28" # Needed for full C++17 support [tool.cibuildwheel.macos.environment] MACOSX_DEPLOYMENT_TARGET = "10.15" +# pass compilers directly to avoid Homebrew LLVM libunwind +CMAKE_ARGS = "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++" + diff -Nru openexr-3.4.6+ds/README.md openexr-3.4.14/README.md --- openexr-3.4.6+ds/README.md 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/README.md 2026-08-05 04:29:55.000000000 +0300 @@ -144,7 +144,10 @@ * **Report a security vulnerability:** - - Email to security@openexr.com + - File a GitHub [security + advisory](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/new). + Email security@openexr.com for private/secure discussion with the project + maintainers. * **Contribute a Fix, Feature, or Improvement:** @@ -155,6 +158,9 @@ - Submit a Pull Request: https://github.com/AcademySoftwareFoundation/openexr/pulls + - If you'd like to contribute and could use some ideas of what to + do, browse "good first issues" [here](https://github.com/AcademySoftwareFoundation/openexr/contribute) or on [Clotributor](https://clotributor.dev/search?ts_query_web=openexr&page=1). + # Resources - Website: http://www.openexr.com diff -Nru openexr-3.4.6+ds/.readthedocs.yml openexr-3.4.14/.readthedocs.yml --- openexr-3.4.6+ds/.readthedocs.yml 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/.readthedocs.yml 2026-08-05 04:29:55.000000000 +0300 @@ -11,7 +11,8 @@ build: os: "ubuntu-22.04" tools: - python: "3.9" + # urllib3>=2.7 (website/requirements.txt) requires Python >=3.10 + python: "3.11" sphinx: configuration: website/conf.py diff -Nru openexr-3.4.6+ds/SECURITY.md openexr-3.4.14/SECURITY.md --- openexr-3.4.6+ds/SECURITY.md 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/SECURITY.md 2026-08-05 04:29:55.000000000 +0300 @@ -16,59 +16,91 @@ within 48 hours. Our policy is to address critical security vulnerabilities rapidly and post patches within 14 days if possible. +## CVE Assignment + +We request a CVE when an untrusted party can plausibly trigger the flaw +through normal product inputs (for example, a crafted EXR or other data +the application is meant to process); otherwise we treat it as a regular +bugfix, document it in a GitHub security advisory or release notes when +helpful, and do not request a CVE for API-only or caller-controlled +failures with no realistic adversarial path. + +Flaws whose root cause lies in a bundled dependency (such as OpenJPH) +are fixed upstream; the upstream project owns the CVE when one is +warranted. Note that this applies even when a flaw is detected in +dependency code vendored into OpenEXR's `external/` source directory. +OpenEXR addresses them by updating the dependency and noting the +upstream advisory in release notes. We request a CVE for OpenEXR +itself only when the flaw is in our code and untrusted input can reach +it through normal use of the library. + ## Known Vulnerabilities -These vulnerabilities are present in the given versions: +| CVE | Affected Versions | Patched Versions | +| --- | ----------------- | ---------------- | -* [CVE-2026-26981](https://www.cve.org/CVERecord?id=CVE-2025-64181) 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.4.4 -* [CVE-2025-64181](https://www.cve.org/CVERecord?id=CVE-2025-64181) 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.0, 3.4.1, 3.4.2 -* [CVE-2025-64182](https://www.cve.org/CVERecord?id=CVE-2025-64182) 3.2.0, 3.2.1, 3.2.3, 3.2.4, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, - 3.4.0, 3.4.1, 3.4.2 -* [CVE-2025-64183](https://www.cve.org/CVERecord?id=CVE-2025-64183) 3.2.0, 3.2.1, 3.2.3, 3.2.4, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, - 3.4.0, 3.4.1, 3.4.2 -* [CVE-2025-48074](https://www.cve.org/CVERecord?id=CVE-2025-48074) 3.3.2 -* [CVE-2025-48073](https://www.cve.org/CVERecord?id=CVE-2025-48073) 3.3.2 -* [CVE-2025-48072](https://www.cve.org/CVERecord?id=CVE-2025-48072) 3.3.2 -* [CVE-2025-48071](https://www.cve.org/CVERecord?id=CVE-2025-48071) 3.3.2 3.3.1 3.3.0 -* [CVE-2025-12840](https://www.cve.org/CVERecord?id=CVE-2025-12840) 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.0, 3.4.1, 3.4.2 -* [CVE-2025-12839](https://www.cve.org/CVERecord?id=CVE-2025-12839) 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.0, 3.4.1, 3.4.2 -* [CVE-2025-12495](https://www.cve.org/CVERecord?id=CVE-2025-12495) 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.0, 3.4.1, 3.4.2 -* [CVE-2023-5841](https://nvd.nist.gov/vuln/detail/CVE-2023-5841) 3.1.0, 3.1.1, 3.1.2, 3.1.3 3.1.4 3.1.5 3.1.6 3.1.7 3.1.8 3.1.9 3.1.10 3.1.11 3.2.0 3.2.1 -* [CVE-2021-45942](https://nvd.nist.gov/vuln/detail/CVE-2021-45942) 3.1.0, 3.1.1, 3.1.2, 3.1.3 -* [CVE-2021-20296](https://nvd.nist.gov/vuln/detail/CVE-2021-20296) 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.5.1, 2.5.2, 2.5.3 -* [CVE-2021-3479](https://nvd.nist.gov/vuln/detail/CVE-2021-3479) 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.5.1, 2.5.2, 2.5.3 -* [CVE-2021-3478](https://nvd.nist.gov/vuln/detail/CVE-2021-3478) 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.5.1, 2.5.2, 2.5.3 -* [CVE-2021-3477](https://nvd.nist.gov/vuln/detail/CVE-2021-3477) 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.5.1, 2.5.2, 2.5.3 -* [CVE-2021-3476](https://nvd.nist.gov/vuln/detail/CVE-2021-3476) 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.5.1, 2.5.2, 2.5.3 -* [CVE-2021-3475](https://nvd.nist.gov/vuln/detail/CVE-2021-3475) 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.5.1, 2.5.2, 2.5.3 -* [CVE-2021-3474](https://nvd.nist.gov/vuln/detail/CVE-2021-3474) 2.4.0, 2.4.1, 2.4.2, 2.5.0, 2.5.1, 2.5.2, 2.5.3 -* [CVE-2020-16589](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16589) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0 -* [CVE-2020-16588](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16588) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0 -* [CVE-2020-16587](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16587) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0 -* [CVE-2020-15306](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15306) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.4.1, 2.5.0, 2.5.1 -* [CVE-2020-15305](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15305) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.4.1, 2.5.0, 2.5.1 -* [CVE-2020-15304](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15304) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.4.1, 2.5.0, 2.5.1 -* [CVE-2020-11765](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11765) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0 -* [CVE-2020-11764](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11764) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0 -* [CVE-2020-11763](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11763) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0 -* [CVE-2020-11762](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11762) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0 -* [CVE-2020-11761](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11761) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0 -* [CVE-2020-11760](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11760) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0 -* [CVE-2020-11759](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11759) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0 -* [CVE-2020-11758](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11758) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0 -* [CVE-2018-18444](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18444) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0 -* [CVE-2018-18443](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18443) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0 -* [CVE-2017-9116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9116) 2.0.0, 2.0.1, 2.1.0, 2.2.0 -* [CVE-2017-9115](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9115) 2.0.0, 2.0.1, 2.1.0, 2.2.0 -* [CVE-2017-9114](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9114) 2.0.0, 2.0.1, 2.1.0, 2.2.0 -* [CVE-2017-9113](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9113) 2.0.0, 2.0.1, 2.1.0, 2.2.0 -* [CVE-2017-9112](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9112) 2.0.0, 2.0.1, 2.1.0, 2.2.0 -* [CVE-2017-9111](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9111) 2.0.0, 2.0.1, 2.1.0, 2.2.0 -* [CVE-2017-9110](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9110) 2.0.0, 2.0.1, 2.1.0, 2.2.0 -* [CVE-2017-12596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12596) 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0 -* [CVE-2009-1722](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1722) 1.0.*, 1.1.*, 1.2.*, 1.3.*, 1.4.*, 1.5.*, 1.6.* -* [CVE-2009-1721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1721) 1.0.*, 1.1.*, 1.2.*, 1.3.*, 1.4.*, 1.5.*, 1.6.* -* [CVE-2009-1720](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1720) 1.0.*, 1.1.*, 1.2.*, 1.3.*, 1.4.*, 1.5.*, 1.6.* +| [CVE-2026-42217](https://www.cve.org/CVERecord?id=CVE-2026-42217) | 3.2.0–3.2.8, 3.3.0–3.3.10, 3.4.0–3.4.10 | 3.2.9, 3.3.11, 3.4.11 | +| [CVE-2026-42216](https://www.cve.org/CVERecord?id=CVE-2026-42216) | 3.2.0–3.2.8, 3.3.0–3.3.10, 3.4.0–3.4.10 | 3.2.9, 3.3.11, 3.4.11 | +| [CVE-2026-41142](https://www.cve.org/CVERecord?id=CVE-2026-41142) | 3.2.0–3.2.8, 3.3.0–3.3.10, 3.4.0–3.4.10 | 3.2.9, 3.3.11, 3.4.11 | +| [CVE-2026-40250](https://www.cve.org/CVERecord?id=CVE-2026-40250) | 3.2.0–3.2.7, 3.3.0–3.3.9, 3.4.0–3.4.9 | 3.2.8, 3.3.10, 3.4.10 | +| [CVE-2026-40244](https://www.cve.org/CVERecord?id=CVE-2026-40244) | 3.2.0–3.2.7, 3.3.0–3.3.9, 3.4.0–3.4.9 | 3.2.8, 3.3.10, 3.4.10 | +| [CVE-2026-39886](https://www.cve.org/CVERecord?id=CVE-2026-39886) | 3.4.0–3.4.9 | 3.4.10 | +| [CVE-2026-34589](https://www.cve.org/CVERecord?id=CVE-2026-34589) | 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.8 | 3.2.7, 3.3.9, 3.4.9 | +| [CVE-2026-34588](https://www.cve.org/CVERecord?id=CVE-2026-34588) | 3.1.x, 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.8 | 3.2.7, 3.3.9, 3.4.9 | +| [CVE-2026-34545](https://www.cve.org/CVERecord?id=CVE-2026-34545) | 3.4.0–3.4.6 | 3.4.7 | +| [CVE-2026-34544](https://www.cve.org/CVERecord?id=CVE-2026-34544) | 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.7 | 3.2.7, 3.3.9, 3.4.8 | +| [CVE-2026-34543](https://www.cve.org/CVERecord?id=CVE-2026-34543) | 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.7 | 3.2.7, 3.3.9, 3.4.8 | +| [CVE-2026-34380](https://www.cve.org/CVERecord?id=CVE-2026-34380) | 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.8 | 3.2.7, 3.3.9, 3.4.9 | +| [CVE-2026-34379](https://www.cve.org/CVERecord?id=CVE-2026-34379) | 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.8 | 3.2.7, 3.3.9, 3.4.9 | +| [CVE-2026-34378](https://www.cve.org/CVERecord?id=CVE-2026-34378) | 3.4.0–3.4.8 | 3.4.9 | +| [CVE-2026-27622](https://www.cve.org/CVERecord?id=CVE-2026-27622) | 2.x, 3.0.x, 3.1.x, 3.2.0–3.2.5, 3.3.0–3.3.7, 3.4.0–3.4.5 | 3.2.6, 3.3.8, 3.4.6 | +| [CVE-2026-26981](https://www.cve.org/CVERecord?id=CVE-2026-26981) | 3.3.0–3.3.6, 3.4.0–3.4.4 | 3.3.7, 3.4.5 | +| [CVE-2025-64183](https://www.cve.org/CVERecord?id=CVE-2025-64183) | 3.2.0–3.2.4, 3.3.0–3.3.5, 3.4.0–3.4.2 | 3.2.5, 3.3.6, 3.4.3 | +| [CVE-2025-64182](https://www.cve.org/CVERecord?id=CVE-2025-64182) | 3.2.0–3.2.4, 3.3.0–3.3.5, 3.4.0–3.4.2 | 3.2.5, 3.3.6, 3.4.3 | +| [CVE-2025-64181](https://www.cve.org/CVERecord?id=CVE-2025-64181) | 3.3.0–3.3.5, 3.4.0–3.4.2 | 3.3.6, 3.4.3 | +| [CVE-2025-48074](https://www.cve.org/CVERecord?id=CVE-2025-48074) | 3.3.2 | 3.3.3 | +| [CVE-2025-48073](https://www.cve.org/CVERecord?id=CVE-2025-48073) | 3.3.2 | 3.3.3 | +| [CVE-2025-48072](https://www.cve.org/CVERecord?id=CVE-2025-48072) | 3.3.2 | 3.3.3 | +| [CVE-2025-48071](https://www.cve.org/CVERecord?id=CVE-2025-48071) | 3.3.0–3.3.2 | 3.3.3 | +| [CVE-2025-12840](https://www.cve.org/CVERecord?id=CVE-2025-12840) | 3.3.0–3.3.5, 3.4.0–3.4.2 | 3.3.6, 3.4.3 | +| [CVE-2025-12839](https://www.cve.org/CVERecord?id=CVE-2025-12839) | 3.3.0–3.3.5, 3.4.0–3.4.2 | 3.3.6, 3.4.3 | +| [CVE-2025-12495](https://www.cve.org/CVERecord?id=CVE-2025-12495) | 3.3.0–3.3.5, 3.4.0–3.4.2 | 3.3.6, 3.4.3 | +| [CVE-2023-5841](https://nvd.nist.gov/vuln/detail/CVE-2023-5841) | 3.1.0–3.1.11, 3.2.0–3.2.1 | 3.2.2 | +| [CVE-2021-45942](https://nvd.nist.gov/vuln/detail/CVE-2021-45942) | 3.1.0–3.1.3 | 3.1.4 | +| [CVE-2021-20296](https://nvd.nist.gov/vuln/detail/CVE-2021-20296) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 | +| [CVE-2021-3479](https://nvd.nist.gov/vuln/detail/CVE-2021-3479) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 | +| [CVE-2021-3478](https://nvd.nist.gov/vuln/detail/CVE-2021-3478) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 | +| [CVE-2021-3477](https://nvd.nist.gov/vuln/detail/CVE-2021-3477) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 | +| [CVE-2021-3476](https://nvd.nist.gov/vuln/detail/CVE-2021-3476) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 | +| [CVE-2021-3475](https://nvd.nist.gov/vuln/detail/CVE-2021-3475) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 | +| [CVE-2021-3474](https://nvd.nist.gov/vuln/detail/CVE-2021-3474) | 2.4.0–2.4.2, 2.5.0–2.5.3 | 2.4.3, 2.5.4 | +| [CVE-2020-16589](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16589) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0 | 2.4.0 | +| [CVE-2020-16588](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16588) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0 | 2.4.0 | +| [CVE-2020-16587](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16587) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0 | 2.4.0 | +| [CVE-2020-15306](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15306) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0–2.4.1, 2.5.0–2.5.1 | 2.5.2 | +| [CVE-2020-15305](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15305) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0–2.4.1, 2.5.0–2.5.1 | 2.5.2 | +| [CVE-2020-15304](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15304) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0–2.4.1, 2.5.0–2.5.1 | 2.5.2 | +| [CVE-2020-11765](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11765) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 | +| [CVE-2020-11764](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11764) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 | +| [CVE-2020-11763](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11763) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 | +| [CVE-2020-11762](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11762) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 | +| [CVE-2020-11761](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11761) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 | +| [CVE-2020-11760](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11760) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 | +| [CVE-2020-11759](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11759) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 | +| [CVE-2020-11758](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11758) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0, 2.4.0 | 2.4.1 | +| [CVE-2018-18444](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18444) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0 | 2.4.0 | +| [CVE-2018-18443](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18443) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1, 2.3.0 | 2.4.0 | +| [CVE-2017-9116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9116) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 | +| [CVE-2017-9115](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9115) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 | +| [CVE-2017-9114](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9114) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 | +| [CVE-2017-9113](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9113) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 | +| [CVE-2017-9112](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9112) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 | +| [CVE-2017-9111](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9111) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 | +| [CVE-2017-9110](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9110) | 2.0.0–2.0.1, 2.1.0, 2.2.0 | 2.2.1 | +| [CVE-2017-12596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12596) | 2.0.0–2.0.1, 2.1.0, 2.2.0–2.2.1 | 2.3.0 | +| [CVE-2009-1722](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1722) | 1.0.x, 1.1.x, 1.2.x, 1.3.x, 1.4.x, 1.5.x, 1.6.x | 1.7.0 | +| [CVE-2009-1721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1721) | 1.0.x, 1.1.x, 1.2.x, 1.3.x, 1.4.x, 1.5.x, 1.6.x | 1.7.0 | +| [CVE-2009-1720](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1720) | 1.0.x, 1.1.x, 1.2.x, 1.3.x, 1.4.x, 1.5.x, 1.6.x | 1.7.0 | See the [release notes](CHANGES.md) for more information. @@ -80,6 +112,7 @@ | Version / branch | Supported | |-------| ---------------------------------------------------- | | main | :white_check_mark: :construction: All fixes immediately, although this branch is under development with potential unstable ABI/API +| 3.4.x | :white_check_mark: All fixes that can be backported without breaking ABI compatibility | 3.3.x | :white_check_mark: All fixes that can be backported without breaking ABI compatibility | 3.2.x | :warning: Patch releases considered in response to specific requests | 3.1.x | :warning: Patch releases considered in response to specific requests @@ -161,6 +194,32 @@ overflows, out-of-memory faults, or segmentation faults that could be exploitable as denial-of-service attacks. +### Image Size Limits and Out-of-Memory Failures + +The OpenEXR file format places no fixed limit on image size, except +that image width and height are represented by signed 32-bit integers +and therefore technically limited to a maximum of 2,147,483,647. + +Memory allocation failures caused by large image dimensions declared +in file headers are not considered security vulnerabilities when the +allocation size is proportional to the declared image dimensions. EXR +files can legitimately describe very large images, and the memory +required to decode them is inherently proportional to their pixel +count. Exhausting available memory on a given machine is a system +resource constraint, not a library defect — the same file that +triggers an out-of-memory error on one machine may load successfully +on another with more memory. + +The OpenEXR library provides +`Imf::Header::setMaxImageSize(int maxWidth,int maxHeight)` and +`Imf::Header:"setMaxTileSize(int maxWidth,int maxHeight)` (and +`exr_set_default_maximum_image_size()` and +`exr_set_default_maximum_tile_size()` in OpenEXRCore) to allow +applications to reject files with dimensions exceeding a configurable +limit before any large allocation occurs. Applications processing +untrusted EXR files should set these limits to values appropriate for +their deployment environment. + ### Hardening #### Testing diff -Nru openexr-3.4.6+ds/share/ci/install_manifest/install_manifest.linux.13.txt openexr-3.4.14/share/ci/install_manifest/install_manifest.linux.13.txt --- openexr-3.4.6+ds/share/ci/install_manifest/install_manifest.linux.13.txt 1970-01-01 02:00:00.000000000 +0200 +++ openexr-3.4.14/share/ci/install_manifest/install_manifest.linux.13.txt 2026-08-05 04:29:55.000000000 +0300 @@ -0,0 +1,206 @@ +# SPDX-License-Identifier: BSD-3-Clause +# Copyright (c) Contributors to the OpenEXR Project. +# cmake -B /__w/openexr/openexr/_build -S /__w/openexr/openexr -DCMAKE_INSTALL_PREFIX=/__w/openexr/openexr/_install -DCMAKE_BUILD_TYPE=Release -DOPENEXR_CXX_STANDARD=17 -DBUILD_SHARED_LIBS=OFF -DOPENEXR_ENABLE_THREADING=ON -DOPENEXR_INSTALL_PKG_CONFIG=ON -DOPENEXR_INSTALL_DOCS=ON -DOPENEXR_BUILD_EXAMPLES=ON -DOPENEXR_BUILD_TOOLS=ON -DOPENEXR_FORCE_INTERNAL_IMATH=OFF -DOPENEXR_FORCE_INTERNAL_DEFLATE=OFF -DOPENEXR_FORCE_INTERNAL_OPENJPH=ON -DBUILD_TESTING=ON -DOPENEXR_RUN_FUZZ_TESTS=OFF -DCMAKE_VERBOSE_MAKEFILE=ON +bin/exr2aces +bin/exrenvmap +bin/exrheader +bin/exrinfo +bin/exrmakepreview +bin/exrmaketiled +bin/exrmanifest +bin/exrmetrics +bin/exrmultipart +bin/exrmultiview +bin/exrstdattr +include/OpenEXR/Iex.h +include/OpenEXR/IexBaseExc.h +include/OpenEXR/IexConfig.h +include/OpenEXR/IexErrnoExc.h +include/OpenEXR/IexExport.h +include/OpenEXR/IexForward.h +include/OpenEXR/IexMacros.h +include/OpenEXR/IexMathExc.h +include/OpenEXR/IexMathFloatExc.h +include/OpenEXR/IexMathIeeeExc.h +include/OpenEXR/IexNamespace.h +include/OpenEXR/IexThrowErrnoExc.h +include/OpenEXR/IlmThread.h +include/OpenEXR/IlmThreadConfig.h +include/OpenEXR/IlmThreadExport.h +include/OpenEXR/IlmThreadForward.h +include/OpenEXR/IlmThreadMutex.h +include/OpenEXR/IlmThreadNamespace.h +include/OpenEXR/IlmThreadPool.h +include/OpenEXR/IlmThreadProcessGroup.h +include/OpenEXR/IlmThreadSemaphore.h +include/OpenEXR/ImfAcesFile.h +include/OpenEXR/ImfArray.h +include/OpenEXR/ImfAttribute.h +include/OpenEXR/ImfBoxAttribute.h +include/OpenEXR/ImfBytesAttribute.h +include/OpenEXR/ImfCRgbaFile.h +include/OpenEXR/ImfChannelList.h +include/OpenEXR/ImfChannelListAttribute.h +include/OpenEXR/ImfCheckFile.h +include/OpenEXR/ImfChromaticities.h +include/OpenEXR/ImfChromaticitiesAttribute.h +include/OpenEXR/ImfCompositeDeepScanLine.h +include/OpenEXR/ImfCompression.h +include/OpenEXR/ImfCompressionAttribute.h +include/OpenEXR/ImfCompressor.h +include/OpenEXR/ImfContext.h +include/OpenEXR/ImfContextInit.h +include/OpenEXR/ImfConvert.h +include/OpenEXR/ImfDeepCompositing.h +include/OpenEXR/ImfDeepFrameBuffer.h +include/OpenEXR/ImfDeepImage.h +include/OpenEXR/ImfDeepImageChannel.h +include/OpenEXR/ImfDeepImageIO.h +include/OpenEXR/ImfDeepImageLevel.h +include/OpenEXR/ImfDeepImageState.h +include/OpenEXR/ImfDeepImageStateAttribute.h +include/OpenEXR/ImfDeepScanLineInputFile.h +include/OpenEXR/ImfDeepScanLineInputPart.h +include/OpenEXR/ImfDeepScanLineOutputFile.h +include/OpenEXR/ImfDeepScanLineOutputPart.h +include/OpenEXR/ImfDeepTiledInputFile.h +include/OpenEXR/ImfDeepTiledInputPart.h +include/OpenEXR/ImfDeepTiledOutputFile.h +include/OpenEXR/ImfDeepTiledOutputPart.h +include/OpenEXR/ImfDoubleAttribute.h +include/OpenEXR/ImfEnvmap.h +include/OpenEXR/ImfEnvmapAttribute.h +include/OpenEXR/ImfExport.h +include/OpenEXR/ImfFlatImage.h +include/OpenEXR/ImfFlatImageChannel.h +include/OpenEXR/ImfFlatImageIO.h +include/OpenEXR/ImfFlatImageLevel.h +include/OpenEXR/ImfFloatAttribute.h +include/OpenEXR/ImfFloatVectorAttribute.h +include/OpenEXR/ImfForward.h +include/OpenEXR/ImfFrameBuffer.h +include/OpenEXR/ImfFramesPerSecond.h +include/OpenEXR/ImfGenericInputFile.h +include/OpenEXR/ImfGenericOutputFile.h +include/OpenEXR/ImfHTCompressor.h +include/OpenEXR/ImfHeader.h +include/OpenEXR/ImfHuf.h +include/OpenEXR/ImfIDManifest.h +include/OpenEXR/ImfIDManifestAttribute.h +include/OpenEXR/ImfIO.h +include/OpenEXR/ImfImage.h +include/OpenEXR/ImfImageChannel.h +include/OpenEXR/ImfImageChannelRenaming.h +include/OpenEXR/ImfImageDataWindow.h +include/OpenEXR/ImfImageIO.h +include/OpenEXR/ImfImageLevel.h +include/OpenEXR/ImfInputFile.h +include/OpenEXR/ImfInputPart.h +include/OpenEXR/ImfInt64.h +include/OpenEXR/ImfIntAttribute.h +include/OpenEXR/ImfKeyCode.h +include/OpenEXR/ImfKeyCodeAttribute.h +include/OpenEXR/ImfLineOrder.h +include/OpenEXR/ImfLineOrderAttribute.h +include/OpenEXR/ImfLut.h +include/OpenEXR/ImfMatrixAttribute.h +include/OpenEXR/ImfMisc.h +include/OpenEXR/ImfMultiPartInputFile.h +include/OpenEXR/ImfMultiPartOutputFile.h +include/OpenEXR/ImfMultiView.h +include/OpenEXR/ImfName.h +include/OpenEXR/ImfNamespace.h +include/OpenEXR/ImfOpaqueAttribute.h +include/OpenEXR/ImfOutputFile.h +include/OpenEXR/ImfOutputPart.h +include/OpenEXR/ImfPartHelper.h +include/OpenEXR/ImfPartType.h +include/OpenEXR/ImfPixelType.h +include/OpenEXR/ImfPreviewImage.h +include/OpenEXR/ImfPreviewImageAttribute.h +include/OpenEXR/ImfRational.h +include/OpenEXR/ImfRationalAttribute.h +include/OpenEXR/ImfRgba.h +include/OpenEXR/ImfRgbaFile.h +include/OpenEXR/ImfRgbaYca.h +include/OpenEXR/ImfSampleCountChannel.h +include/OpenEXR/ImfStandardAttributes.h +include/OpenEXR/ImfStdIO.h +include/OpenEXR/ImfStringAttribute.h +include/OpenEXR/ImfStringVectorAttribute.h +include/OpenEXR/ImfTestFile.h +include/OpenEXR/ImfThreading.h +include/OpenEXR/ImfTileDescription.h +include/OpenEXR/ImfTileDescriptionAttribute.h +include/OpenEXR/ImfTiledInputFile.h +include/OpenEXR/ImfTiledInputPart.h +include/OpenEXR/ImfTiledOutputFile.h +include/OpenEXR/ImfTiledOutputPart.h +include/OpenEXR/ImfTiledRgbaFile.h +include/OpenEXR/ImfTimeCode.h +include/OpenEXR/ImfTimeCodeAttribute.h +include/OpenEXR/ImfUtilExport.h +include/OpenEXR/ImfVecAttribute.h +include/OpenEXR/ImfVersion.h +include/OpenEXR/ImfWav.h +include/OpenEXR/ImfXdr.h +include/OpenEXR/OpenEXRConfig.h +include/OpenEXR/openexr.h +include/OpenEXR/openexr_attr.h +include/OpenEXR/openexr_base.h +include/OpenEXR/openexr_chunkio.h +include/OpenEXR/openexr_coding.h +include/OpenEXR/openexr_compression.h +include/OpenEXR/openexr_config.h +include/OpenEXR/openexr_context.h +include/OpenEXR/openexr_debug.h +include/OpenEXR/openexr_decode.h +include/OpenEXR/openexr_encode.h +include/OpenEXR/openexr_errors.h +include/OpenEXR/openexr_part.h +include/OpenEXR/openexr_std_attr.h +include/OpenEXR/openexr_version.h +lib64/cmake/OpenEXR/OpenEXRConfig.cmake +lib64/cmake/OpenEXR/OpenEXRConfigVersion.cmake +lib64/cmake/OpenEXR/OpenEXRTargets-release.cmake +lib64/cmake/OpenEXR/OpenEXRTargets.cmake +lib64/libIex-${OPENEXR_VERSION_MAJOR}_${OPENEXR_VERSION_MINOR}.a +lib64/libIlmThread-${OPENEXR_VERSION_MAJOR}_${OPENEXR_VERSION_MINOR}.a +lib64/libOpenEXR-${OPENEXR_VERSION_MAJOR}_${OPENEXR_VERSION_MINOR}.a +lib64/libOpenEXRCore-${OPENEXR_VERSION_MAJOR}_${OPENEXR_VERSION_MINOR}.a +lib64/libOpenEXRUtil-${OPENEXR_VERSION_MAJOR}_${OPENEXR_VERSION_MINOR}.a +lib64/pkgconfig/OpenEXR.pc +share/doc/OpenEXR/examples/deepExamples.cpp +share/doc/OpenEXR/examples/deepExamples.h +share/doc/OpenEXR/examples/deepTiledExamples.cpp +share/doc/OpenEXR/examples/deepTiledExamples.h +share/doc/OpenEXR/examples/drawImage.cpp +share/doc/OpenEXR/examples/drawImage.h +share/doc/OpenEXR/examples/generalInterfaceExamples.cpp +share/doc/OpenEXR/examples/generalInterfaceExamples.h +share/doc/OpenEXR/examples/generalInterfaceTiledExamples.cpp +share/doc/OpenEXR/examples/generalInterfaceTiledExamples.h +share/doc/OpenEXR/examples/lowLevelIoExamples.cpp +share/doc/OpenEXR/examples/lowLevelIoExamples.h +share/doc/OpenEXR/examples/main.cpp +share/doc/OpenEXR/examples/multipartExamples.cpp +share/doc/OpenEXR/examples/multipartExamples.h +share/doc/OpenEXR/examples/namespaceAlias.h +share/doc/OpenEXR/examples/previewImageExamples.cpp +share/doc/OpenEXR/examples/previewImageExamples.h +share/doc/OpenEXR/examples/rgbaInterfaceExamples.cpp +share/doc/OpenEXR/examples/rgbaInterfaceExamples.h +share/doc/OpenEXR/examples/rgbaInterfaceTiledExamples.cpp +share/doc/OpenEXR/examples/rgbaInterfaceTiledExamples.h +share/man/man1/exr2aces.1 +share/man/man1/exrcheck.1 +share/man/man1/exrenvmap.1 +share/man/man1/exrheader.1 +share/man/man1/exrinfo.1 +share/man/man1/exrmakepreview.1 +share/man/man1/exrmaketiled.1 +share/man/man1/exrmanifest.1 +share/man/man1/exrmetrics.1 +share/man/man1/exrmultipart.1 +share/man/man1/exrmultiview.1 +share/man/man1/exrstdattr.1 diff -Nru openexr-3.4.6+ds/share/ci/scripts/install_imath.sh openexr-3.4.14/share/ci/scripts/install_imath.sh --- openexr-3.4.6+ds/share/ci/scripts/install_imath.sh 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/share/ci/scripts/install_imath.sh 2026-08-05 04:29:55.000000000 +0300 @@ -15,12 +15,20 @@ # The sudo is nececessary since the installation goes to /usr/local. SUDO=$(command -v sudo >/dev/null 2>&1 && echo sudo || echo "") +# In an MSYS2 mingw shell, install into $MINGW_PREFIX (e.g. /mingw32) +# instead of the default /usr/local, so find_package() locates it the +# same way it would find a pacboy-installed package. +PREFIX_ARG=() +if [ -n "$MINGW_PREFIX" ]; then + PREFIX_ARG=("-DCMAKE_INSTALL_PREFIX=$MINGW_PREFIX") +fi + git clone https://github.com/AcademySoftwareFoundation/Imath.git cd Imath git checkout ${TAG} -cmake -S . -B _build -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF +cmake -S . -B _build -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF "${PREFIX_ARG[@]}" $SUDO cmake --build _build \ --target install \ --config Release \ diff -Nru openexr-3.4.6+ds/share/ci/scripts/install_openjph.sh openexr-3.4.14/share/ci/scripts/install_openjph.sh --- openexr-3.4.6+ds/share/ci/scripts/install_openjph.sh 2026-03-01 23:08:42.000000000 +0200 +++ openexr-3.4.14/share/ci/scripts/install_openjph.sh 2026-08-05 04:29:55.000000000 +0300 @@ -15,13 +15,21 @@ # The sudo is nececessary since the installation goes to /usr/local. SUDO=$(command -v sudo >/dev/null 2>&1 && echo sudo || echo "") +# In an MSYS2 mingw shell, install into $MINGW_PREFIX (e.g. /mingw32) +# instead of the default /usr/local, so find_package()/pkg_check_modules() +# locates it the same way it would find a pacboy-installed package. +PREFIX_ARG=() +if [ -n "$MINGW_PREFIX" ]; then + PREFIX_ARG=("-DCMAKE_INSTALL_PREFIX=$MINGW_PREFIX") +fi + git clone https://github.com/aous72/OpenJPH.git cd OpenJPH git checkout ${TAG} cd build -cmake -DOJPH_ENABLE_TIFF_SUPPORT=OFF -DCMAKE_BUILD_TYPE=Release .. +cmake -DOJPH_ENABLE_TIFF_SUPPORT=OFF -DCMAKE_BUILD_TYPE=Release "${PREFIX_ARG[@]}" .. $SUDO cmake --build . \ --target install \ --config Release \ diff -Nru openexr-3.4.6+ds/share/util/release/candidate.py openexr-3.4.14/share/util/release/candidate.py --- openexr-3.4.6+ds/share/util/release/candidate.py 1970-01-01 02:00:00.000000000 +0200 +++ openexr-3.4.14/share/util/release/candidate.py 2026-08-05 04:29:55.000000000 +0300 @@ -0,0 +1,53 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: BSD-3-Clause +# Copyright Contributors to the OpenEXR Project. + +"""Format a staged-release announcement message and print to stdout.""" + +from __future__ import annotations + +import sys +from subprocess import PIPE, run + +from _common import format_weekday_month_day, load_release_notes, require_repo_url + + +def markdown_to_html(markdown_text: str) -> str: + result = run( + ["pandoc", "-f", "markdown", "-t", "html"], + input=markdown_text, + text=True, + capture_output=True, + check=True, + ) + return ( + " " + f"{result.stdout}" + ) + + +def main() -> None: + if len(sys.argv) < 2: + print("Usage: python share/util/release/candidate.py e.g. candidate.py v3.4.7-rc", file=sys.stderr) + sys.exit(1) + tag = sys.argv[1] + release_date, release_notes, release_version = load_release_notes(tag) + html_notes = markdown_to_html(release_notes) + date_string = format_weekday_month_day(release_date) + url = require_repo_url() + project = url.split("/")[-1] + if project == "openexr": + project = "OpenEXR" + print( + f"{project} {release_version} is staged for release at tag " + f'{tag} and will be released ' + f"officially {date_string} barring any issues.

{html_notes}" + ) + + +if __name__ == "__main__": + try: + main() + except KeyboardInterrupt: + sys.exit(130) diff -Nru openexr-3.4.6+ds/share/util/release/changes.py openexr-3.4.14/share/util/release/changes.py --- openexr-3.4.6+ds/share/util/release/changes.py 1970-01-01 02:00:00.000000000 +0200 +++ openexr-3.4.14/share/util/release/changes.py 2026-08-05 04:29:55.000000000 +0300 @@ -0,0 +1,288 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: BSD-3-Clause +# Copyright Contributors to the OpenEXR Project. + +"""Add or update a release section in CHANGES.md with merged PR entries.""" + +from __future__ import annotations + +import json +import re +import sys +from datetime import datetime, timedelta +from subprocess import PIPE, run + +from _common import ( + changes_anchor_date_slug, + format_month_day_year, + prev_patch_version, + require_repo_url, +) +from _security import ( + collect_security_refs_for_prs, + gh_security_advisories_cve_titles, + oss_fuzz_issue_titles, +) + +MERGED_PR_HEADING_RE = re.compile( + r"^###\s+Merged Pull Requests\s*:?\s*$", re.IGNORECASE +) +MERGED_WORKFLOW_HEADING_RE = re.compile( + r"^###\s+Merged Workflow Pull Requests\s*:?\s*$", re.IGNORECASE +) +SECURITY_HEADING_RE = re.compile(r"^###\s+Security\s*:?\s*$", re.IGNORECASE) +PR_BULLET_RE = re.compile(r"^\*\s*\[(\d+)\]\(") + + +def gh_pr_view(pr_number: str) -> dict: + result = run( + [ + "gh", + "pr", + "view", + pr_number, + "--json", + "title,author", + ], + stdout=PIPE, + stderr=PIPE, + universal_newlines=True, + check=False, + ) + if result.returncode != 0: + sys.stderr.write(result.stderr or "gh pr view failed\n") + sys.exit(1) + return json.loads(result.stdout) + + +def strip_security_from_heading(heading_lines: list[str]) -> list[str]: + out: list[str] = [] + i = 0 + n = len(heading_lines) + while i < n: + if SECURITY_HEADING_RE.match(heading_lines[i].strip()): + if out and not out[-1].strip(): + out.pop() + i += 1 + while i < n and not heading_lines[i].startswith("### "): + i += 1 + continue + out.append(heading_lines[i]) + i += 1 + return out + + +def parse_pr_blocks_dict(lines, i, stop_at_workflow_heading): + out = {} + n = len(lines) + while i < n: + line = lines[i] + if stop_at_workflow_heading and MERGED_WORKFLOW_HEADING_RE.match( + line.strip() + ): + break + mo = PR_BULLET_RE.match(line.strip()) + if mo: + pr = mo.group(1) + bullet = line + if i + 1 < n: + nxt = lines[i + 1] + if stop_at_workflow_heading and MERGED_WORKFLOW_HEADING_RE.match( + nxt.strip() + ): + out[pr] = bullet + i += 1 + continue + if PR_BULLET_RE.match(nxt.strip()): + out[pr] = bullet + i += 1 + continue + out[pr] = "\n".join([bullet, nxt]) + i += 2 + continue + out[pr] = bullet + i += 1 + continue + i += 1 + return out, i + + +def parse_section(lines): + heading = [] + i = 0 + n = len(lines) + + while i < n: + line = lines[i] + if MERGED_PR_HEADING_RE.match(line.strip()): + break + heading.append(line) + i += 1 + + merged_prs = {} + if i < n and MERGED_PR_HEADING_RE.match(lines[i].strip()): + i += 1 + merged_prs, i = parse_pr_blocks_dict(lines, i, stop_at_workflow_heading=True) + + merged_workflow_prs = {} + if i < n and MERGED_WORKFLOW_HEADING_RE.match(lines[i].strip()): + i += 1 + merged_workflow_prs, i = parse_pr_blocks_dict( + lines, i, stop_at_workflow_heading=False + ) + + return heading, merged_prs, merged_workflow_prs + + +def pr_is_workflow_only(pr_number: str) -> bool: + result = run( + ["gh", "pr", "view", pr_number, "--json", "files", "--jq", "[.files[].path]"], + stdout=PIPE, + stderr=PIPE, + universal_newlines=True, + check=False, + ) + if result.returncode != 0: + sys.stderr.write(result.stderr or "gh pr view failed\n") + sys.exit(1) + paths = json.loads(result.stdout or "[]") + return bool(paths) and all(p.startswith(".github/workflows/") for p in paths) + + +def main() -> None: + if len(sys.argv) < 3: + print( + "Usage: changes.py ...\n" + "Example: changes.py v3.4.7 1234 1235", + file=sys.stderr, + ) + sys.exit(1) + + tag = sys.argv[1] + prs = sys.argv[2:] + + with open("CHANGES.md", encoding="utf-8") as f: + lines = f.read().splitlines() + + base_tag = tag.lstrip("v").split("-rc")[0] + prev_tag = prev_patch_version(base_tag) + + section_re = re.compile( + rf"^##\s+Version\s+{re.escape(base_tag)}\b", re.IGNORECASE + ) + prev_re = ( + re.compile(rf"^##\s+Version\s+{re.escape(prev_tag)}\b", re.IGNORECASE) + if prev_tag + else None + ) + + section_index = None + footer_index = None + for i, line in enumerate(lines): + if section_index is None and section_re.match(line): + section_index = i + if prev_re is not None and footer_index is None and prev_re.match(line): + footer_index = i + + header_index = section_index if section_index is not None else footer_index + if header_index is None: + print( + "Could not locate insertion point (no matching version section and no " + "previous patch release heading in CHANGES.md).", + file=sys.stderr, + ) + sys.exit(1) + + release_date = datetime.now() + timedelta(days=2) + date_str = format_month_day_year(release_date) + + if section_index is not None: + section_heading, merged_prs, merged_workflow_prs = parse_section( + lines[section_index:footer_index] + ) + section_heading = strip_security_from_heading(section_heading) + else: + section_heading = [f"## Version {base_tag} ({date_str})\n"] + merged_prs = {} + merged_workflow_prs = {} + + toc, prev_toc = None, None + toc_re = re.compile(rf"^\*\s+\[Version\s+{re.escape(base_tag)}\]", re.IGNORECASE) + prev_toc_re = ( + re.compile(rf"^\*\s+\[Version\s+{re.escape(prev_tag)}\]", re.IGNORECASE) + if prev_tag + else None + ) + for i, line in enumerate(lines[:footer_index]): + if toc is None and toc_re.match(line): + toc = i + elif prev_toc is None and prev_toc_re and prev_toc_re.match(line): + prev_toc = i + break + + url = require_repo_url() + for pr_number in prs: + info = gh_pr_view(pr_number) + title = info.get("title") or "" + author = (info.get("author") or {}).get("login") or "" + is_workflow = "dependabot" in author or pr_is_workflow_only(pr_number) + title_one_line = " ".join(title.split()) + pr_block = f"* [{pr_number}]({url}/pull/{pr_number})\n{title_one_line}" + if is_workflow: + merged_workflow_prs[pr_number] = pr_block + else: + merged_prs[pr_number] = pr_block + + all_prs_for_security = sorted( + set(merged_prs) | set(merged_workflow_prs), + key=int, + reverse=True, + ) + cves, oss_fuzz_issues = collect_security_refs_for_prs(all_prs_for_security) + + advisory_titles = gh_security_advisories_cve_titles() + oss_fuzz_titles = oss_fuzz_issue_titles(list(dict.fromkeys(oss_fuzz_issues))) + + with open("CHANGES.md", "w", encoding="utf-8", newline="\n") as f: + if toc is None: + f.write("\n".join(lines[:prev_toc]) + "\n") + base_tag_nonum = base_tag.replace(".", "") + date_str_lower = changes_anchor_date_slug(release_date) + f.write( + f"* [Version {base_tag}](#version-{base_tag_nonum}-{date_str_lower}) " + f"{date_str}\n" + ) + f.write("\n".join(lines[prev_toc:header_index]) + "\n") + else: + f.write("\n".join(lines[:header_index]) + "\n") + f.write("\n".join(section_heading)) + if cves or oss_fuzz_issues: + f.write("\n\n### Security\n") + f.write( + "\nThis release addresses the following security " + "vulnerabilities:\n\n" + ) + for cve in sorted(set(cves), reverse=True): + title = advisory_titles.get(cve, "") + suffix = f"\n {title}" if title else "" + f.write(f"* [{cve}](https://www.cve.org/CVERecord?id={cve}){suffix}\n") + for issue_id in sorted(set(oss_fuzz_issues), reverse=True): + url_issue = f"https://issues.oss-fuzz.com/issues/{issue_id}" + f.write(f"* OSS-Fuzz [{issue_id}]({url_issue})\n") + short = oss_fuzz_titles.get(issue_id, "") + if short: + f.write(f" {short}\n") + f.write("\n### Merged Pull Requests\n\n") + for pr, value in sorted(merged_prs.items(), key=lambda kv: int(kv[0]), reverse=True): + f.write(" " + value + "\n") + f.write("\n### Merged Workflow Pull Requests\n\n") + for pr, value in sorted(merged_workflow_prs.items(), key=lambda kv: int(kv[0]), reverse=True): + f.write(" " + value + "\n") + f.write("\n" + "\n".join(lines[footer_index:])) + + +if __name__ == "__main__": + try: + main() + except KeyboardInterrupt: + sys.exit(130) diff -Nru openexr-3.4.6+ds/share/util/release/cherry.py openexr-3.4.14/share/util/release/cherry.py --- openexr-3.4.6+ds/share/util/release/cherry.py 1970-01-01 02:00:00.000000000 +0200 +++ openexr-3.4.14/share/util/release/cherry.py 2026-08-05 04:29:55.000000000 +0300 @@ -0,0 +1,97 @@ +#!/usr/bin/env python +# SPDX-License-Identifier: BSD-3-Clause +# Copyright Contributors to the OpenEXR Project. + +"""List merged PRs with a GitHub label; print cherry-pick commands (oldest merge first). + +By default prints one combined ``git cherry-pick`` line plus a ``changes.py`` line. +With ``--single``, prints one ``git cherry-pick`` command per PR instead. +""" + +from __future__ import annotations + +import json +import sys +from subprocess import PIPE, run + + +def main() -> None: + args = sys.argv[1:] + single = False + if "--single" in args: + single = True + args.remove("--single") + if len(args) != 1: + print( + "Usage: cherry.py [--single]