PyPI - OpenEXR - Versions diffs - 3.3.11__tar.gz → 3.3.13__tar.gz - Mend

OpenEXR 3.3.11tar.gz → 3.3.13tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (969) hide show

{openexr-3.3.11 → openexr-3.3.13}/CHANGES.md RENAMED Viewed

@@ -3,10 +3,25 @@
 # OpenEXR Release Notes
+* [Version 3.4.12](#version-3412-may-24-2026) May 24, 2026
+* [Version 3.4.11](#version-3411-april-29-2026) April 29, 2026
+* [Version 3.4.10](#version-3410-april-17-2026) April 17, 2026
+* [Version 3.4.9](#version-349-april-3-2026) April 3, 2026
+* [Version 3.4.8](#version-348-march-26-2026) March 26, 2026
+* [Version 3.4.7](#version-347-march-15-2026) March 15, 2026
+* [Version 3.4.6](#version-346-march-1-2026) March 1, 2026
+* [Version 3.4.5](#version-345-february-21-2026) February 21, 2026
+* [Version 3.4.4](#version-344-november-19-2025) November 19, 2025
+* [Version 3.4.3](#version-343-november-4-2025) November 4, 2025
+* [Version 3.4.2](#version-342-october-15-2025) October 15, 2025
+* [Version 3.4.1](#version-341-october-8-2025) October 8, 2025
+* [Version 3.4.0](#version-340-september-5-2025) September 5, 2025
+* [Version 3.3.13](#version-3313-august-6-2026) August 6, 2026
+* [Version 3.3.12](#version-3312-june-21-2026) June 21, 2026
 * [Version 3.3.11](#version-3311-april-29-2026) April 29, 2026
-* [Version 3.3.10](#version-3310-april-17-2026) April 17, 2026
-* [Version 3.3.9](#version-339-april-3-2026) April 3, 2026
-* [Version 3.3.8](#version-338-february-26-2026) February 26, 2026
+* [Version 3.3.10](#version-339-april-17-2026) April 17, 2026
+* [Version 3.3.9](#version-339-april-4-2026) April 4, 2026
+* [Version 3.3.8](#version-338-march-1-2026) March 1, 2026
 * [Version 3.3.7](#version-337-february-19-2026) February 19, 2026
 * [Version 3.3.6](#version-336-november-4-2025) November 5, 2025
 * [Version 3.3.5](#version-335-july-26-2025) July 26, 2025
@@ -86,10 +101,107 @@
 * [Version 1.0.1](#version-101)
 * [Version 1.0](#version-10)
-## Version 3.3.11 (April 29, 2026)
+## Version 3.4.12 (May 24, 2026)
-Patch release for 3.3 that addresses the following security
-vulnerabilities:
+Patch release that addresses several bugs and security
+vulnerabilities.
+* :bug: Fix several minor memory leaks recovering from reading invalid
+  files.
+* :bug: The compressor API incorrectly identfied `HTJ2K` and `HTJ2K256` as
+  lossy; they are lossles.
+* :bug: Fix CMake AVX feature detection that caused DWA SIMD code to fail on
+  certain architectures.
+* :warning: The `WidenFilename` utility function is marked as deprecated, to be
+  removed in a future release.
+* :sparkles: `exrmetrics` now print the on-disk size of the data portion of each
+  part. Useful for determining compression impact on part data
+For the python module:
+* :snake: :bug: Reject files where the dataWindows does not match the
+  pixel array dimensions.
+* :snake: :sparkles: Support NumPy float vector attributes
+* :snake: :sparkles: Reading now skips over invalid parts, returns the valid parts only.
+* :snake: :book: Doc strings have proper indentation
+This release addresses the following security vulnerabilities:
+* [CVE-2026-45696](https://www.cve.org/CVERecord?id=CVE-2026-45696)
+OpenEXR `ht_undo_impl` heap-buffer-overflow READ via
+codestream/channel width mismatch in HTJ2K decode
+* [CVE-2026-44663](https://www.cve.org/CVERecord?id=CVE-2026-44663)
+Integer overflow in HTJ2K decoder ( `ht_undo_impl` ) leading to
+heap-buffer-overflow
+* [OSS-fuzz 512895184](https://issues.oss-fuzz.com/issues/512895184)
+Null-dereference WRITE in `Imf_4_0::TileProcess::run_decode`
+* [OSS-fuzz 512314697](https://issues.oss-fuzz.com/issues/512314697)
+Direct-leak in `internal_exr_add_part`
+* [OSS-fuzz 508362159](https://issues.oss-fuzz.com/issues/508362159)
+Heap-buffer-overflow in `DwaCompressor_uncompress`
+* [OSS-fuzz 507413960](https://issues.oss-fuzz.com/issues/507413960)
+Heap-buffer-overflow in `generic_unpack`
+### Merged Pull Requests
+* [2424](https://github.com/AcademySoftwareFoundation/openexr/pull/2424)
+exrmetrics print disk size of part
+* [2423](https://github.com/AcademySoftwareFoundation/openexr/pull/2423)
+Fix computation of chunk height
+* [2422](https://github.com/AcademySoftwareFoundation/openexr/pull/2422)
+Fix memory leaks
+* [2421](https://github.com/AcademySoftwareFoundation/openexr/pull/2421)
+Add test to validate python module reading of unfinished parts
+* [2416](https://github.com/AcademySoftwareFoundation/openexr/pull/2416)
+Add HTJ2K256 and HTJ2K32 to data compression scheme list
+* [2414](https://github.com/AcademySoftwareFoundation/openexr/pull/2414)
+Check for invalid Slice base and type in `TileProcess::copy_sample_count`
+* [2413](https://github.com/AcademySoftwareFoundation/openexr/pull/2413)
+Python: reject dataWindow size mismatch before write
+* [2409](https://github.com/AcademySoftwareFoundation/openexr/pull/2409)
+Python: fix docstring indentation
+* [2407](https://github.com/AcademySoftwareFoundation/openexr/pull/2407)
+Support NumPy float vectors in Python headers
+* [2406](https://github.com/AcademySoftwareFoundation/openexr/pull/2406)
+Update urllib3 to 2.7 in website/requirements.txt
+* [2405](https://github.com/AcademySoftwareFoundation/openexr/pull/2405)
+Signal HTJ2K* compressors as lossless
+* [2403](https://github.com/AcademySoftwareFoundation/openexr/pull/2403)
+htj2k compressor: validate codestream dimensions
+* [2402](https://github.com/AcademySoftwareFoundation/openexr/pull/2402)
+Release notes, news, and CVE info for v3.4.11, 3.3.11, 3.2.9
+* [2398](https://github.com/AcademySoftwareFoundation/openexr/pull/2398)
+Arcmantis/warning deprecate WidenFilename
+* [2397](https://github.com/AcademySoftwareFoundation/openexr/pull/2397)
+Cast to `size_t` to avoid int overflow in `ht_undo_impl`
+* [2392](https://github.com/AcademySoftwareFoundation/openexr/pull/2392)
+Correct index rejection for string access.
+* [2388](https://github.com/AcademySoftwareFoundation/openexr/pull/2388)
+Relax NaN comparison in compression tests
+* [2387](https://github.com/AcademySoftwareFoundation/openexr/pull/2387)
+Add install instructions for python module
+* [2385](https://github.com/AcademySoftwareFoundation/openexr/pull/2385)
+cmake: require YMM asm for inline AVX probe
+* [2373](https://github.com/AcademySoftwareFoundation/openexr/pull/2373)
+Bump and pin website/requirements.txt
+* [2359](https://github.com/AcademySoftwareFoundation/openexr/pull/2359)
+Add reference to "contribute" and Clotributor in README.md and website
+* [2148](https://github.com/AcademySoftwareFoundation/openexr/pull/2148)
+Fix unfinished multi-part file loading in the python wrapper
+### Merged Workflow Pull Requests
+* [2399](https://github.com/AcademySoftwareFoundation/openexr/pull/2399)
+Bump github/codeql-action from 4.35.2 to 4.35.4
+* [2396](https://github.com/AcademySoftwareFoundation/openexr/pull/2396)
+Bump sphinx from 7.2.6 to 7.4.7 in /website
+* [2394](https://github.com/AcademySoftwareFoundation/openexr/pull/2394)
+Bump platforms from 1.0.0 to 1.1.0
+## Version 3.4.11 (April 29, 2026)
+Patch release that addresses the following security vulnerabilities:
 * [CVE-2026-42217](https://www.cve.org/CVERecord?id=CVE-2026-42217)
 Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)
@@ -102,17 +214,1036 @@ Also:
 * OSS-fuzz [504280155](https://issues.oss-fuzz.com/issues/504280155)
 Heap-buffer-overflow in `DwaCompressor_uncompress`
+* OSS-fuzz [505062709](https://issues.oss-fuzz.com/issues/505062709)
+Null-dereference READ in `Imf_3_3::prefixFromLayerName`
+Build fixes:
+- Fix Windows ARM64EC build issues and correct SIMD ARM NEON path for ARM64/EC
+Also, some minor documentation updates:
+- GitHub Security Advisories are the preferred way of reporting
+  vulnerabilities, not email.
+- Some clarification around handling of UFT-8 of file paths
 ### Merged Pull Requests
 * [2383](https://github.com/AcademySoftwareFoundation/openexr/pull/2383)
 validate that the uncompressed sizes recorded in the dwa header are valid
+* [2382](https://github.com/AcademySoftwareFoundation/openexr/pull/2382)
+Fix Null-dereference READ in prefixFromLayerName
 * [2378](https://github.com/AcademySoftwareFoundation/openexr/pull/2378)
 Harden IDManifest parsing against illegal shift and string prefix OOB
 * [2377](https://github.com/AcademySoftwareFoundation/openexr/pull/2377)
 Fix OOB read when expanding IDManifest prefix-compressed strings
+* [2375](https://github.com/AcademySoftwareFoundation/openexr/pull/2375)
+Minor changes to website index page to make some sentences clearer. A…
+* [2368](https://github.com/AcademySoftwareFoundation/openexr/pull/2368)
+Add release notes and news for v3.4.10, v3.3.10, v3.2.8
 * [2367](https://github.com/AcademySoftwareFoundation/openexr/pull/2367)
 Fix int overflow in ImageChannel::resize pixel count
+* [2364](https://github.com/AcademySoftwareFoundation/openexr/pull/2364)
+Recommend GH Security Advisories for vulnerability reporting
+* [2361](https://github.com/AcademySoftwareFoundation/openexr/pull/2361)
+Add documentation and test for UTF-8 file paths
+* [2344](https://github.com/AcademySoftwareFoundation/openexr/pull/2344)
+Fix Windows ARM64EC build issues and correct SIMD ARM NEON path for ARM64/EC
+### Merged Workflow Pull Requests
+* [2370](https://github.com/AcademySoftwareFoundation/openexr/pull/2370)
+Bump msys2/setup-msys2 from 2.31.0 to 2.31.1
+* [2366](https://github.com/AcademySoftwareFoundation/openexr/pull/2366)
+Add workflow dispatch trigger to release-sign.yml
+* [2363](https://github.com/AcademySoftwareFoundation/openexr/pull/2363)
+Bump vmactions/freebsd-vm from 1.4.4 to 1.4.5
+* [2362](https://github.com/AcademySoftwareFoundation/openexr/pull/2362)
+Bump github/codeql-action from 4.35.1 to 4.35.2
+## Version 3.4.10 (April 17, 2026)
+Patch release that addresses the following security vulnerabilities:
+* [CVE-2026-39886](https://www.cve.org/CVERecord?id=CVE-2026-39886) HTJ2K Signed Integer Overflow in `ht_undo_impl()`
+* [CVE-2026-40244](https://www.cve.org/CVERecord?id=CVE-2026-40244) Integer overflow in DWA `setupChannelData` `planarUncRle` pointer arithmetic (missed variant of CVE-2026-34589)
+* [CVE-2026-40250](https://www.cve.org/CVERecord?id=CVE-2026-40250) Integer overflow in DWA decoder `outBufferEnd` pointer arithmetic (missed variant of CVE-2026-34589)
+### Merged Pull Requests
+* [2346](https://github.com/AcademySoftwareFoundation/openexr/pull/2346)
+Fix integer overflow in internal_dwa_compressor.h
+* [2345](https://github.com/AcademySoftwareFoundation/openexr/pull/2345)
+Fix HTJ2K bytes-per-line integer overflow in internal_ht.cpp
+* [2340](https://github.com/AcademySoftwareFoundation/openexr/pull/2340)
+Fix 3.4.9 cve list formatting
+* [2339](https://github.com/AcademySoftwareFoundation/openexr/pull/2339)
+fix link formatting typo
+* [2337](https://github.com/AcademySoftwareFoundation/openexr/pull/2337)
+notes and news for v3.4.9, v3.3.9, v3.2.7
+* [2334](https://github.com/AcademySoftwareFoundation/openexr/pull/2334)
+Add CVE-2026-34589,34588,34545,34544,34543,34380,34379,34378 to SECURITY.md
+* [2316](https://github.com/AcademySoftwareFoundation/openexr/pull/2316)
+Fix Pinned-Dependencies Scorecard alert in website workflow
+### Merged Workflow Pull Requests
+* [2360](https://github.com/AcademySoftwareFoundation/openexr/pull/2360)
+Bump actions/cache from 5.0.4 to 5.0.5
+* [2354](https://github.com/AcademySoftwareFoundation/openexr/pull/2354)
+Bump actions/upload-artifact from 7.0.0 to 7.0.1
+* [2343](https://github.com/AcademySoftwareFoundation/openexr/pull/2343)
+Bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0
+* [2341](https://github.com/AcademySoftwareFoundation/openexr/pull/2341)
+Bump jmertic/slack-release-notifier from 32206e01ee0b0f66865d2be13bb3c62e474b5ce0 to 9d7d3a84563d2ebc8f7b2271be6c9568fedd7f3a
+* [2338](https://github.com/AcademySoftwareFoundation/openexr/pull/2338)
+Fix CodeQL SARIF upload ref for pull_request workflows
+* [2336](https://github.com/AcademySoftwareFoundation/openexr/pull/2336)
+Bump pypa/cibuildwheel from 3.4.0 to 3.4.1
+* [2333](https://github.com/AcademySoftwareFoundation/openexr/pull/2333)
+Add CI test to validate "cmake --install .. --prefix <path>
+## Version 3.4.9 (April 3, 2026)
+Patch release that addresses several security vulnerabilities.
+This release also fixes a build issue where the library symlinks would
+get installed in the incorrect location when overriding the cached
+install prefix path.
+This release addresses the following CVEs:
+* [CVE-2026-34589](https://www.cve.org/CVERecord?id=CVE-2026-34589) DWA Lossy Decoder Heap Out-of-Bounds Write
+* [CVE-2026-34588](https://www.cve.org/CVERecord?id=CVE-2026-34588) Signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
+* [CVE-2026-34380](https://www.cve.org/CVERecord?id=CVE-2026-34380) Signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression
+* [CVE-2026-34379](https://www.cve.org/CVERecord?id=CVE-2026-34379) Misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)
+* [CVE-2026-34378](https://www.cve.org/CVERecord?id=CVE-2026-34378) Signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x
+### Merged Pull Requests
+* [2329](https://github.com/AcademySoftwareFoundation/openexr/pull/2329)
+Fix signed integer overflow in `LossyDctDecoder_execute()` pointer arithmatic
+* [2328](https://github.com/AcademySoftwareFoundation/openexr/pull/2328)
+fix integer overflow in PIZ wavelet buffer arithmetic
+* [2327](https://github.com/AcademySoftwareFoundation/openexr/pull/2327)
+Add a message about image size limits and OOM errors to SECURITY.md and website
+* [2326](https://github.com/AcademySoftwareFoundation/openexr/pull/2326)
+Fix shared lib symlink installation path
+* [2324](https://github.com/AcademySoftwareFoundation/openexr/pull/2324)
+Fix misaligned memory access in `LossyDctDecoder_execute` HALF→FLOAT expansion
+* [2323](https://github.com/AcademySoftwareFoundation/openexr/pull/2323)
+fix signed integer overflow in `undo_pxr24_impl()`
+* [2321](https://github.com/AcademySoftwareFoundation/openexr/pull/2321)
+Fix integer overflow in `srcbuffer` pointer arithmetic in `unpack_*`
+* [2317](https://github.com/AcademySoftwareFoundation/openexr/pull/2317)
+Add "cherry" and "changes" options to release.py
+### Merged Workflow Pull Requests
+* [2332](https://github.com/AcademySoftwareFoundation/openexr/pull/2332)
+Bump vmactions/freebsd-vm from 1.4.3 to 1.4.4
+* [2331](https://github.com/AcademySoftwareFoundation/openexr/pull/2331)
+Bump github/codeql-action from 4.34.1 to 4.35.1
+* [2330](https://github.com/AcademySoftwareFoundation/openexr/pull/2330)
+Bump jmertic/slack-release-notifier from f824585541879ef2a6388268eccb9be210aa6878 to 32206e01ee0b0f66865d2be13bb3c62e474b5ce0
+* [2325](https://github.com/AcademySoftwareFoundation/openexr/pull/2325)
+Bump sigstore/gh-action-sigstore-python from 3.2.0 to 3.3.0
+* [2320](https://github.com/AcademySoftwareFoundation/openexr/pull/2320)
+Bump jmertic/slack-release-notifier from 35fad060af5559c24decdec0f701e6ba93566704 to f824585541879ef2a6388268eccb9be210aa6878
+* [2319](https://github.com/AcademySoftwareFoundation/openexr/pull/2319)
+Bump msys2/setup-msys2 from 2.30.0 to 2.31.0
+* [2318](https://github.com/AcademySoftwareFoundation/openexr/pull/2318)
+Bump github/codeql-action from 4.33.0 to 4.34.1
+## Version 3.4.8 (March 26, 2026)
+Patch release with several bug/build fixes:
+- Fix an integer-overflow bug reading malformed files compressed with
+  B44A/B44B
+- Fix a buffer-overrun bug reading malformed files compressed with PXR24
+- Fix a bug compressing half data with ZIPS/ZIP data when the
+  compressed size equals packed size
+- Single part files no longer get assigned a part name when writing
+  via the python module
+- Fix a build failure on FreeBSD involving `threads.h`
+This also eliminates several compiler warnings, particularly about the
+deprecated `isOptimizationEnabled()` API and deprecates standard
+attributes.
+This version addresses the following security vulnerabilities:
+* [CVE-2026-34544](https://www.cve.org/CVERecord?id=CVE-2026-34544) integer overflow to OOB write in uncompress_b44_impl()
+* [CVE-2026-34543](https://www.cve.org/CVERecord?id=CVE-2026-34543) Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
+### Merged Pull Requests
+* [2312](https://github.com/AcademySoftwareFoundation/openexr/pull/2312)
+Fix B44/B44A integer overflow: use uint64_t for row offset
+* [2310](https://github.com/AcademySoftwareFoundation/openexr/pull/2310)
+PXR24: reject zlib output that does not match packed payload size
+* [2307](https://github.com/AcademySoftwareFoundation/openexr/pull/2307)
+Fix ZIPS/ZIP encoder corruption when compressed size equals packed size
+* [2303](https://github.com/AcademySoftwareFoundation/openexr/pull/2303)
+Fix MinGW -Walloc-size-larger-than= in general_attr string test
+* [2301](https://github.com/AcademySoftwareFoundation/openexr/pull/2301)
+don't insert name attributes into single part files
+* [2300](https://github.com/AcademySoftwareFoundation/openexr/pull/2300)
+Fix FreeBSD build failure involving threads.h, and add FreeBSD CI build
+* [2124](https://github.com/AcademySoftwareFoundation/openexr/pull/2124)
+Suppress deprecation warnings for isOptimizationEnabled and standard attributes
+### Merged Workflow Pull Requests
+* [2315](https://github.com/AcademySoftwareFoundation/openexr/pull/2315)
+Force macos cibuildwheel to use Xcode clang
+* [2311](https://github.com/AcademySoftwareFoundation/openexr/pull/2311)
+Bump actions/cache from 5.0.3 to 5.0.4
+* [2304](https://github.com/AcademySoftwareFoundation/openexr/pull/2304)
+Bump github/codeql-action from 4.32.6 to 4.33.0
+* [2297](https://github.com/AcademySoftwareFoundation/openexr/pull/2297)
+Restore Analysis build
+* [2295](https://github.com/AcademySoftwareFoundation/openexr/pull/2295)
+Restrict workflow permissions for ci_steps, release-sign, and codeql
+* [2294](https://github.com/AcademySoftwareFoundation/openexr/pull/2294)
+Pin pypa/cibuildwheel actions to release sha
+## Version 3.4.7 (March 15, 2026)
+Patch release bug/build fixes:
+* Fix an integer overflow decoding very wide htj2k images
+* Fix build failure with glibc 2.43
+* Fix Windows symbol visibility warnings
+Full changelog: [v3.4.6..v3.4.7](https://github.com/AcademySoftwareFoundation/openexr/compare/v3.4.6..v3.4.7)
+This version addresses the following security vulnerabilities:
+* [CVE-2026-34545](https://www.cve.org/CVERecord?id=CVE-2026-34545)
+  integer overflow lead to OOB in HTJ2K decoder
+### Merged Pull Requests
+* [2291](https://github.com/AcademySoftwareFoundation/openexr/pull/2291)
+Fix integer overflow in htj2k decode with width > 32767
+* [2283](https://github.com/AcademySoftwareFoundation/openexr/pull/2283)
+update SECURITY with CVE info for PR #2256
+* [2282](https://github.com/AcademySoftwareFoundation/openexr/pull/2282)
+Remove `website_preview_link` workflow
+* [2281](https://github.com/AcademySoftwareFoundation/openexr/pull/2281)
+Disable visibility attributes on Windows to fix msys2 -Wattributes warning
+* [2262](https://github.com/AcademySoftwareFoundation/openexr/pull/2262)
+Fix build failure with glibc 2.43 due to C11 threads.h conflicts
+### Merged Workflow Pull Requests
+* [2292](https://github.com/AcademySoftwareFoundation/openexr/pull/2292)
+Bump actions/download-artifact from 8.0.0 to 8.0.1
+* [2289](https://github.com/AcademySoftwareFoundation/openexr/pull/2289)
+Bump scikit-build-core from 0.12.1 to 0.12.2
+* [2288](https://github.com/AcademySoftwareFoundation/openexr/pull/2288)
+Bump jmertic/slack-release-notifier from 6fa159048d5313ff1177d248ad84beb627571670 to 35fad060af5559c24decdec0f701e6ba93566704
+* [2287](https://github.com/AcademySoftwareFoundation/openexr/pull/2287)
+Bump pypa/cibuildwheel from 3.3 to 3.4
+## Version 3.4.6 (March 1, 2026)
+Patch release with several bug fixes, enhancements, and build improvements.
+* :bug: A limit of ``UINT_MAX`` deep samples per pixel is now
+  enforced, which prevents an integer overflow when using the
+  `CompositeDeepScanLine` API to combine multiple deep parts.
+* :wrench: In `IlmThreadPool`, replace deprecated `std::atomic_load /
+  std::atomic_exchange` overloads for `std::shared_ptr` with the C++20
+  `std::atomic<std::shared_ptr<T>>` interface when available.
+* :bug: The ``ZIP`` and ``ZIPS`` Compressor objects had incorrect
+  compression types set, although the ill effects were minimal as the
+  value is seldom used.
+* :bug: Enable SSE2 on 32-bit x86 builds to fix test failures
+Build improvements:
+* :hammer_and_wrench: OpenEXR now ships with an internal "vendored" copy of the
+  ``OpenJPH`` library. At configuration time, if CMake finds an
+  external installation of ``OpenJPH``, it will use it, but if that
+  fails, or the CMake configuration option
+  ``OPENEXR_FORCE_INTERNAL_OPENJPH`` is set, it will use the internal
+  copy. For OpenEXR v3.4.6, the vendored version of OpenJPH is 0.26.3.
+* :hammer_and_wrench: A new CMake build option `DOPENEXR_FORCE_EMBEDDED_CORE`
+  builds the `OpenEXRCore` library statically and links it into the
+  `OpenEXR` library with symbols hidden, making it possible to link
+  multiple versions of OpenEXR into the same executable. The `OpenEXR`
+  library has namespaces for this situation, but the `OpenEXRCore`
+  library is written in C with no configurable namespace. See [Linking
+  Multiple OpenEXR Versions in the
+  Executable](https://openexr.com/en/latest/install.html#linking-multiple-openexr-versions-in-the-executable)
+  for details.
+* :hammer_and_wrench: Fix build failure with ``-march=sandybridge``
+Python:
+* :snake: :sparkles: Add python support for Opaque Attributes
+* :rocket: Python module I/O operations now release the GIL,
+  preventing blocking.
+Tools:
+* :sparkles: Add sanity check for correct arguments to exrstdattr, to
+  catch mistakes such as ``exrstdattr input.exr output.exr -comment
+  hello`` which would formerly write to a file called ``hello`` but
+  now fails with a usage error.
+Also, this release bumps the vendered version of `libdeflate` to 1.25.
+This release addresses the following CVEs:
+* [CVE-2026-27622](https://www.cve.org/CVERecord?id=CVE-2026-27622)
+CompositeDeepScanLine integer-overflow leads to heap OOB write
+### Merged Pull Requests:
+* [2274](https://github.com/AcademySoftwareFoundation/openexr/pull/2274)
+Update the vendored libdeflate to 1.25
+* [2273](https://github.com/AcademySoftwareFoundation/openexr/pull/2273)
+Release Python GIL during I/O operations in bindings
+* [2272](https://github.com/AcademySoftwareFoundation/openexr/pull/2272)
+Fix build failure with -march=sandybridge (#2231)
+* [2271](https://github.com/AcademySoftwareFoundation/openexr/pull/2271)
+Enable SSE2 on 32-bit x86 builds to fix test failures
+* [2269](https://github.com/AcademySoftwareFoundation/openexr/pull/2269)
+Mention OpenEXR dependencies on README
+* [2268](https://github.com/AcademySoftwareFoundation/openexr/pull/2268)
+Bazel: Use openjph 0.26.3
+* [2267](https://github.com/AcademySoftwareFoundation/openexr/pull/2267)
+Bump rules_cc from 0.2.16 to 0.2.17
+* [2265](https://github.com/AcademySoftwareFoundation/openexr/pull/2265)
+Bump jmertic/slack-release-notifier
+* [2264](https://github.com/AcademySoftwareFoundation/openexr/pull/2264)
+Bump github/codeql-action from 4.32.3 to 4.32.4
+* [2263](https://github.com/AcademySoftwareFoundation/openexr/pull/2263)
+Add sanity check for correct arguments to exrstdattr
+* [2261](https://github.com/AcademySoftwareFoundation/openexr/pull/2261)
+Fix sentence fragment typo in website python docs
+* [2260](https://github.com/AcademySoftwareFoundation/openexr/pull/2260)
+Add reference to `OPENEXR_FORCE_EMBEDDED_CORE` on install page
+* [2259](https://github.com/AcademySoftwareFoundation/openexr/pull/2259)
+Fix ZipCompressor to initialize compresson type correctly
+* [2258](https://github.com/AcademySoftwareFoundation/openexr/pull/2258)
+Bazel: Remove WORKSPACE.bazel file
+* [2256](https://github.com/AcademySoftwareFoundation/openexr/pull/2256)
+Report an error if a deep pixel as more than `UINT_MAX` samples
+* [2253](https://github.com/AcademySoftwareFoundation/openexr/pull/2253)
+Add CVE-2025-64181 to SECURITY.md
+* [2252](https://github.com/AcademySoftwareFoundation/openexr/pull/2252)
+Add news and release notes for v3.4.5 and v3.3.7
+* [2250](https://github.com/AcademySoftwareFoundation/openexr/pull/2250)
+Vendor OpenJPH v0.26.3
+* [2249](https://github.com/AcademySoftwareFoundation/openexr/pull/2249)
+Add python support for Opaque Attributes
+* [2248](https://github.com/AcademySoftwareFoundation/openexr/pull/2248)
+Fix tag check, git rm, and sed calls in vendor_openjph.sh
+* [2247](https://github.com/AcademySoftwareFoundation/openexr/pull/2247)
+Bump github/codeql-action from 4.31.9 to 4.32.3
+* [2243](https://github.com/AcademySoftwareFoundation/openexr/pull/2243)
+IlmThread: fix deprecated atomic `shared_ptr` ops for `shared_ptr` (GCC 15)
+* [2240](https://github.com/AcademySoftwareFoundation/openexr/pull/2240)
+Bump actions/cache from 5.0.1 to 5.0.3
+* [2239](https://github.com/AcademySoftwareFoundation/openexr/pull/2239)
+Fix links and formatting in CONTRIBUTING.md
+* [2236](https://github.com/AcademySoftwareFoundation/openexr/pull/2236)
+Bump actions/checkout from 6.0.1 to 6.0.2
+* [2235](https://github.com/AcademySoftwareFoundation/openexr/pull/2235)
+Bump actions/setup-python from 6.1.0 to 6.2.0
+* [2227](https://github.com/AcademySoftwareFoundation/openexr/pull/2227)
+Bump rules_cc from 0.2.14 to 0.2.16
+* [2226](https://github.com/AcademySoftwareFoundation/openexr/pull/2226)
+Bump bazel_skylib from 1.8.2 to 1.9.0
+* [2225](https://github.com/AcademySoftwareFoundation/openexr/pull/2225)
+Rename external/OpenJPH/src/core/common to openjph, instead of using a symlink
+* [2224](https://github.com/AcademySoftwareFoundation/openexr/pull/2224)
+Bump github/codeql-action from 4.31.8 to 4.31.9
+* [2222](https://github.com/AcademySoftwareFoundation/openexr/pull/2222)
+Bump actions/upload-artifact from 5 to 6
+* [2221](https://github.com/AcademySoftwareFoundation/openexr/pull/2221)
+Bump actions/cache from 4.3.0 to 5.0.1
+* [2220](https://github.com/AcademySoftwareFoundation/openexr/pull/2220)
+Bump msys2/setup-msys2 from 2.29.0 to 2.30.0
+* [2219](https://github.com/AcademySoftwareFoundation/openexr/pull/2219)
+Bump actions/download-artifact from 6.0.0 to 7.0.0
+* [2218](https://github.com/AcademySoftwareFoundation/openexr/pull/2218)
+Bump github/codeql-action from 4.31.7 to 4.31.8
+* [2216](https://github.com/AcademySoftwareFoundation/openexr/pull/2216)
+Add option to compile c++ libraries with an embedded core library
+* [2215](https://github.com/AcademySoftwareFoundation/openexr/pull/2215)
+Bump imath from 3.2.2 to 3.2.2.bcr.1
+* [2214](https://github.com/AcademySoftwareFoundation/openexr/pull/2214)
+Bump github/codeql-action from 4.31.5 to 4.31.7
+* [2213](https://github.com/AcademySoftwareFoundation/openexr/pull/2213)
+Bump sigstore/gh-action-sigstore-python from 3.1.0 to 3.2.0
+* [2212](https://github.com/AcademySoftwareFoundation/openexr/pull/2212)
+Bump actions/checkout from 6.0.0 to 6.0.1
+* [2210](https://github.com/AcademySoftwareFoundation/openexr/pull/2210)
+Bump actions/setup-python from 6.0.0 to 6.1.0
+* [2209](https://github.com/AcademySoftwareFoundation/openexr/pull/2209)
+Bump github/codeql-action from 4.31.4 to 4.31.5
+* [2208](https://github.com/AcademySoftwareFoundation/openexr/pull/2208)
+Remove enable-beta-ecosystem since Bazel is no officially supported
+* [2204](https://github.com/AcademySoftwareFoundation/openexr/pull/2204)
+Bump actions/checkout from 3.6.0 to 6.0.0
+* [2202](https://github.com/AcademySoftwareFoundation/openexr/pull/2202)
+Bump github/codeql-action from 4.31.3 to 4.31.4
+* [2193](https://github.com/AcademySoftwareFoundation/openexr/pull/2193)
+Vendor in an internal version of OpenJPH
+* [2167](https://github.com/AcademySoftwareFoundation/openexr/pull/2167)
+Bazel build: Bump openjph to 0.25.0 and libdeflate to 1.25
+## Version 3.4.5 (February 21, 2026)
+Patch release that fixes an incorrect size check in
+`istream_nonparallel_read` that could lead to a buffer overflow on
+invalid input data.
+This release addresses the following CVEs:
+* [CVE-2026-26981](https://www.cve.org/CVERecord?id=CVE-2026-26981)
+Heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp
+### Merged Pull Requests:
+* [2244](https://github.com/AcademySoftwareFoundation/openexr/pull/2244)
+Fix incorrect size check in `istream_nonparallel_read`
+## Version 3.4.4 (November 19, 2025)
+Patch release with an optimization to reduce the size of the library.
+B44 and DWA compression tables are now initialized at first use rather
+than being hard-coded in the source code and compiled binary. This
+reduces the library size at a slight performance cost. Initialization
+takes under a millisecond, but the size of libOpenEXRCore.so is
+reduced from 890K to 360K.
+This also fixes a build issue with `ILMTHREAD_THREADING_ENABLED` which
+inadvertently enabled threading when it should have been disabed.
+This also fixes a bug where importing the python module from a parent
+directory would fail.
+### Merged Pull Requests:
+* [2199](https://github.com/AcademySoftwareFoundation/openexr/pull/2199)
+OpenEXRCore: fix `ILMTHREAD_THREADING_ENABLED` checks
+* [2198](https://github.com/AcademySoftwareFoundation/openexr/pull/2198)
+OpenEXRCore: avoid direct dependency on imath
+* [2196](https://github.com/AcademySoftwareFoundation/openexr/pull/2196)
+Bump github/codeql-action from 4.31.2 to 4.31.3
+* [2194](https://github.com/AcademySoftwareFoundation/openexr/pull/2194)
+Add missing copywrite comments
+* [2192](https://github.com/AcademySoftwareFoundation/openexr/pull/2192)
+Bump pypa/cibuildwheel from 3.2 to 3.3
+* [2190](https://github.com/AcademySoftwareFoundation/openexr/pull/2190)
+Bump github/codeql-action from 3.27.9 to 4.31.2
+* [2189](https://github.com/AcademySoftwareFoundation/openexr/pull/2189)
+Bump msys2/setup-msys2 from 2.27.0 to 2.29.0
+* [2188](https://github.com/AcademySoftwareFoundation/openexr/pull/2188)
+Bump actions/download-artifact from 4.1.8 to 6.0.0
+* [2187](https://github.com/AcademySoftwareFoundation/openexr/pull/2187)
+Bump ossf/scorecard-action from 2.4.0 to 2.4.3
+* [2186](https://github.com/AcademySoftwareFoundation/openexr/pull/2186)
+Bump pypa/cibuildwheel from 2.23 to 3.2
+* [2185](https://github.com/AcademySoftwareFoundation/openexr/pull/2185)
+Bump actions/cache from 4.2.0 to 4.3.0
+* [2184](https://github.com/AcademySoftwareFoundation/openexr/pull/2184)
+Bump actions/upload-artifact from 4 to 5
+* [2183](https://github.com/AcademySoftwareFoundation/openexr/pull/2183)
+Bump actions/checkout from 2.7.0 to 5.0.0
+* [2182](https://github.com/AcademySoftwareFoundation/openexr/pull/2182)
+Add recent CVEs to SECURITY.md
+* [2181](https://github.com/AcademySoftwareFoundation/openexr/pull/2181)
+Bump sigstore/gh-action-sigstore-python from 3.0.0 to 3.1.0
+* [2180](https://github.com/AcademySoftwareFoundation/openexr/pull/2180)
+Bump actions/setup-python from 5.3.0 to 6.0.0
+* [2178](https://github.com/AcademySoftwareFoundation/openexr/pull/2178)
+Bump snyk/actions from 0.4.0 to 1.0.0
+* [2177](https://github.com/AcademySoftwareFoundation/openexr/pull/2177)
+Bump pypa/gh-action-pypi-publish from 1.12.3 to 1.13.0
+* [2176](https://github.com/AcademySoftwareFoundation/openexr/pull/2176)
+Imporve Bazel support
+* [2175](https://github.com/AcademySoftwareFoundation/openexr/pull/2175)
+Converts asserts in internal_ht.cpp to if statement that throws an exception.
+* [2174](https://github.com/AcademySoftwareFoundation/openexr/pull/2174)
+DWA: initialize linear/nonlinear tables at runtime
+* [2173](https://github.com/AcademySoftwareFoundation/openexr/pull/2173)
+Update macos-13 to macos-15-intel
+* [2171](https://github.com/AcademySoftwareFoundation/openexr/pull/2171)
+Properly set `OpenEXR_error` in legacy python API
+* [2126](https://github.com/AcademySoftwareFoundation/openexr/pull/2126)
+B44: initialize exp/log tables at runtime
+## Version 3.4.3 (November 4, 2025)
+Patch release that addresses several bugs, primarily involving
+properly rejecting corrupt input data.
+Specifically:
+- Buffer overflow in PyOpenEXR_old's `channels()` and `channel()` in
+  legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
+- Use after free in PyObject_StealAttrString in legacy python, reported
+  by Joshua Rogers (GitHub: MegaManSec).
+- Use of Uninitialized Memory in openexr, reported by Aldo Ristori
+  (GitHub: Kaldreic).
+- Heap-based Buffer Overflow Remote Code Execution Vulnerability,
+  reported by Trend Micro Zero Day Initiative.
+This release addresses the following CVEs:
+* [CVE-2025-64183](https://www.cve.org/CVERecord?id=CVE-2025-64183)
+Use after free in PyObject_StealAttrString
+* [CVE-2025-64182](https://www.cve.org/CVERecord?id=CVE-2025-64182)
+Buffer overflow in PyOpenEXR_old's channels() and channel()
+* [CVE-2025-64181](https://www.cve.org/CVERecord?id=CVE-2025-64181)
+Security Issue: Use of Uninitialized Memory in openexr
+* [CVE-2025-12840](https://www.cve.org/CVERecord?id=CVE-2025-12840)
+Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
+* [CVE-2025-12839](https://www.cve.org/CVERecord?id=CVE-2025-12839)
+Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
+* [CVE-2025-12495](https://www.cve.org/CVERecord?id=CVE-2025-12495)
+Academy Software Foundation OpenEXR EXR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
+Also:
+* OSS-fuzz [456158449](https://issues.oss-fuzz.com/issues/456158449)
+Heap-buffer-overflow in `generic_unpack`
+* OSS-fuzz [447429458](https://issues.oss-fuzz.com/issues/447429458)
+Heap-buffer-overflow in `DwaCompressor_uncompress`
+* OSS-fuzz [439237843](https://issues.oss-fuzz.com/issues/439237843)
+Heap-buffer-overflow in `internal_exr_undo_ht`
+* OSS-fuzz [436037111](https://issues.oss-fuzz.com/issues/436037111)
+Heap-buffer-overflow in `generic_unpack`
+* OSS-fuzz [435779241](https://issues.oss-fuzz.com/issues/435779241)
+Heap-buffer-overflow in `generic_unpack`
+* OSS-fuzz [420744464](https://issues.oss-fuzz.com/issues/420744464)
+Abrt in `__cxxabiv1::failed_throw`
+Other fixes:
+* Fix a bug with re-reading a scanline file with a different set of
+  channels.
+* Only populate `CMAKE_DEBUG_POSTFIX` with `_d` if it is undefined,
+  which makes it possible to set `CMAKE_DEBUG_POSTFIX=""`.
+This version also bumps the auto-fetched version of OpenJPH to
+0.24.4. OpenJPH 0.24.4 addresses these OSS-Fuzz issues:
+* OSS-fuzz [455374208](https://issues.oss-fuzz.com/issues/455374208)
+Floating-point-exception in `ojph::local::tile::pre_alloc`
+* OSS-fuzz [444963190](https://issues.oss-fuzz.com/issues/444963190)
+Index-out-of-bounds in `ojph::local::param_qcd::read_qcc`
+* OSS-fuzz [444878558](https://issues.oss-fuzz.com/issues/444878558)
+Segv on unknown address in `ojph::local::param_qcd::~param_qcd`
+* OSS-fuzz [444878557](https://issues.oss-fuzz.com/issues/444878557)
+Null-dereference READ in `ojph::local::param_qcd::~param_qcd`
+### Merged Pull Requests:
+* [2168](https://github.com/AcademySoftwareFoundation/openexr/pull/2168)
+ Fix improper use of `Py_DECREF` in legacy python module
+* [2166](https://github.com/AcademySoftwareFoundation/openexr/pull/2166)
+Only define `CMAKE_DEBUG_POSTFIX` if it is not already defined
+* [2164](https://github.com/AcademySoftwareFoundation/openexr/pull/2164)
+check storage_mode when computing chunk sizes
+* [2163](https://github.com/AcademySoftwareFoundation/openexr/pull/2163)
+Check for image size overflow in legacy python module
+* [2162](https://github.com/AcademySoftwareFoundation/openexr/pull/2162)
+verify packed/unpacked size with uncompressed data
+* [2161](https://github.com/AcademySoftwareFoundation/openexr/pull/2161)
+ImfCheckFile: handle partial deep tiles
+* [2160](https://github.com/AcademySoftwareFoundation/openexr/pull/2160)
+Fix issues with negative coordinates and sampling != 0
+* [2159](https://github.com/AcademySoftwareFoundation/openexr/pull/2159)
+Fix memset in `exr_read_chunk` when nread is negative
+* [2156](https://github.com/AcademySoftwareFoundation/openexr/pull/2156)
+Fix handling of corrupt RLE data
+* [2150](https://github.com/AcademySoftwareFoundation/openexr/pull/2150)
+Fix bug with re-reading scanline file with a different set of channels
+## Version 3.4.2 (October 15, 2025)
+Patch release that fixes a Windows build issue introduced in v3.4.1.
+No change in functionality.
+### Merged Pull Requests:
+* [2146](https://github.com/AcademySoftwareFoundation/openexr/pull/2146)
+Update Bazel dependencies
+* [2144](https://github.com/AcademySoftwareFoundation/openexr/pull/2144)
+handle CMake CREATE_LINK failures for openjph headers
+## Version 3.4.1 (October 8, 2025)
+Patch release that fixes a build issue: OpenJPH headers are now
+included from the openjph folder, as required by OpenJPH 0.23+.
+No change in functionality.
+### Merged Pull Requests:
+* [2140](https://github.com/AcademySoftwareFoundation/openexr/pull/2140)
+Update `HELP2MAN_URL` in `install_help2man.sh`
+* [2139](https://github.com/AcademySoftwareFoundation/openexr/pull/2139)
+Fix doxygen/sphinx/rst website issues
+* [2138](https://github.com/AcademySoftwareFoundation/openexr/pull/2138)
+Bazel cleanup
+* [2137](https://github.com/AcademySoftwareFoundation/openexr/pull/2137)
+Bump macos runners to 14 and 15, drop 13
+* [2136](https://github.com/AcademySoftwareFoundation/openexr/pull/2136)
+Include the openjph headers from the openjph folder, required for OpenJPH 0.23+
+* [2127](https://github.com/AcademySoftwareFoundation/openexr/pull/2127)
+cmake: remove trailing spaces
+* [2119](https://github.com/AcademySoftwareFoundation/openexr/pull/2119)
+News for v3.4.0 release
+* [2118](https://github.com/AcademySoftwareFoundation/openexr/pull/2118)
+fix formatting in release notes
+* [2107](https://github.com/AcademySoftwareFoundation/openexr/pull/2107)
+Add section on OpenEXR/Imath version compatibility to install instructions
+## Version 3.4.0 (September 5, 2025)
+OpenEXR v3.4 introduces a new, additional compression option to the
+OpenEXR file format for **lossless compression with High Throughput
+JPEG-2000 (HTJ2K)** encoding:
+* A new HTJ2K compressor uses the **High-Throughput (HT) block
+  coder**. It supports the full range of OpenEXR features, including
+  16-bit and 32-bit floating-point image channels, both scanline and
+  tiled.
+* The HT block coder is standardized in [Rec. ITU-T
+  T.814](https://loc.gov/preservation/digital/formats/fdd/fdd000566.shtml)
+  and [ISO/IEC 15444-15](https://www.iso.org/standard/76621.html). It
+  is **royalty-free**, widely used in cinema and distribution servicing,
+  and implemented in both commercial and open-source toolkits.
+* In experiments, we've found that HTJ2K produces smaller files, and
+  depending on the nature of the image data, is one of the fastest
+  compression types available in OpenEXR.
+* Integration with OpenEXR uses the
+  [OpenJPH](https://github.com/aous72/OpenJPH) open-source
+  library. For ease in managing the dependency, the OpenEXR CMake
+  configuration supports **automatically fetching and building `OpenJPH`
+  internally**, or linking against an **external installation**.
+* OpenEXR supports two new compression types with distinct space/time
+  trade-offs:
+  - `htj2k256` -- encodes/decodes chunks of 256 scanlines, producing
+    slightly smaller file size than `htj2k32`.
+  - `htj2k32` -- encodes/decodes chunks of 32 scanlines, better suited
+    to multi-threading, so it offers significantly faster encoding and
+    decoding (4-6x in some cases) than `htj2k256`, with a slight
+    increase in file size.
+* All existing OpenEXR compression options remain unchanged. This new
+  feature simply extends the range of compression types available.
+* Software compiled with OpenEXR v3.4 will be able to read HTJ2K
+  compressed OpenEXRs without any code changes. Software that writes
+  files may automatically support the new type, but may need a small
+  update to make the new type available as a user option.
+* :warning: This is a **backwards-compatible extension** to the OpenEXR
+  file format. Files written with OpenEXR v3.4 will be readable by
+  applications built against previous releases, _unless_ they use the
+  new `htj2k32` or `htj2k256` compression options.
+* :warning: This feature was first introduced for evaluation in
+  February, 2025 via the `htj2k-beta` branch with a single 256
+  scanlines/chunk compression option, with the 32-scanline option
+  added more recently. Application software written during this
+  evaluation period will need to change `IMF_HTJ2K_COMPRESSION` to
+  `IMF_HTJ2K256_COMPRESSION`, although files written with the earlier
+  evaluation version should still read properly.
+### Other New Features:
+* :sparkles: **New `colorInteropID` standard attribute**
+  The ID string endorsed by the Color Interop Forum to communicate the
+  color space of RGB images in an interoperable manner.
+  - The contents of the string is described in the specification [An
+    ID for Color
+    Interop](https://docs.google.com/document/d/1T94lYbis9uCskL_ZEMxGBF2JryLfZnjxlEoNgRHZzBE/edit?usp=sharing).
+  - Guidance to application developers is provided in [Identifying the
+    Color Space of OpenEXR
+    Files](https://docs.google.com/document/d/1MTH1bq2L67ifvdDf64Amhzg4AbkIM5LG6yPHrB96Vwo/edit?usp=sharing)
+* :sparkles: **New `bytes` attribute type**
+  Designed to hold an arbitrary binary blob of metadata.
+  - The OpenEXR library forces no interpretations of the attribute
+    contents; it is strictly application-dependent.
+  - The attribute also holds a `typeHint` string which applications
+    can use to suggest the intended interpretation of the contents,
+    but it is strictly informational.
+* :wrench: **TBB as a global thread provider**
+  - A new cmake option `-DOPENEXR_USE_TBB=ON` switches the internals
+    of the thread pool to use TBB by default.
+  - Building with this option adds a link dependency on the `OneAPI
+    TBB` distribution.
+* :wrench: **Vendored `libdeflate`**
+  - OpenEXR v3.4 now ships with a bundled distribution of the
+    `libdeflate` library, replacing the previous "auto-fetch"
+    mechanism.
+  - By default, building OpenEXR will use a system installation of
+    `libdeflate` as before, but if none is found, the build will use
+    the internal copy of `libdeflate`.
+  - Use `-DOPENEXR_USE_INTERNAL_DEFLATE=ON` to force the use of the
+    internal vendored version.
+### Bug fixes:
+* :bug: Using openexr via cmake `add_subdirectory` now works properly.
+### Changes to the OpenEXR Python module:
+* :snake: :bug: The Python module now allows an empty part name for a
+  single-part file
+* :snake: :bug: The `header_only` option for Python module's `OpenEXR.File`
+  now works properly.
+* :snake: :package: :warning: `pypi` distributions now **add support
+  for Python 3.13** and **drop support for Python 3.7**xc.
+### Merged Pull Requests:
+* [2115](https://github.com/AcademySoftwareFoundation/openexr/pull/2115)
+Move openjph to Requires.private in OpenEXR.pc
+* [2114](https://github.com/AcademySoftwareFoundation/openexr/pull/2114)
+Remove openjph includes from ImfHTCompressor.h
+* [2113](https://github.com/AcademySoftwareFoundation/openexr/pull/2113)
+Improve handling of Imath and OpenJPH library versions
+* [2112](https://github.com/AcademySoftwareFoundation/openexr/pull/2112)
+Fix compiler warnings
+* [2106](https://github.com/AcademySoftwareFoundation/openexr/pull/2106)
+Bump scikit-build-core from 0.11.5 to 0.11.6
+* [2105](https://github.com/AcademySoftwareFoundation/openexr/pull/2105)
+Add details about branches to install instructions
+* [2104](https://github.com/AcademySoftwareFoundation/openexr/pull/2104)
+Add support for 32-line HTJ2K Compressor
+* [2103](https://github.com/AcademySoftwareFoundation/openexr/pull/2103)
+remove extra allocation, fix invalid dereference on corrupt file
+* [2102](https://github.com/AcademySoftwareFoundation/openexr/pull/2102)
+add fallback catch to avoid exceptions from crossing C boundary
+* [2099](https://github.com/AcademySoftwareFoundation/openexr/pull/2099)
+documentation install OpenJPH
+* [2098](https://github.com/AcademySoftwareFoundation/openexr/pull/2098)
+Create symlink for the `add_subdirectory` CI test in the CI step
+* [2097](https://github.com/AcademySoftwareFoundation/openexr/pull/2097)
+Bump OpenJPH to 0.21.5
+* [2095](https://github.com/AcademySoftwareFoundation/openexr/pull/2095)
+docs: fix incorrect function names in C API docs
+* [2094](https://github.com/AcademySoftwareFoundation/openexr/pull/2094)
+Properly implement header_only for python module's OpenEXR.File
+* [2093](https://github.com/AcademySoftwareFoundation/openexr/pull/2093)
+Update CVE links in SECURITY.md to https://www.cve.org
+* [2090](https://github.com/AcademySoftwareFoundation/openexr/pull/2090)
+Fix python module to allow empty part name for single-part file
+* [2088](https://github.com/AcademySoftwareFoundation/openexr/pull/2088)
+Add CI test to validate cmake add_subdirectory(openexr)
+* [2087](https://github.com/AcademySoftwareFoundation/openexr/pull/2087)
+Fix aliases for IexConfig and IlmThreadConfig
+* [2086](https://github.com/AcademySoftwareFoundation/openexr/pull/2086)
+Fix HTJ2K chunk header length error and group common HTJ2K functions
+* [2084](https://github.com/AcademySoftwareFoundation/openexr/pull/2084)
+Add CVEs from OSTIF report to SECURITY.md and CHANGES.md
+* [2083](https://github.com/AcademySoftwareFoundation/openexr/pull/2083)
+Add CI jobs for C++20, and build tools/tests against standard
+* [2079](https://github.com/AcademySoftwareFoundation/openexr/pull/2079)
+Helper script release.py to automate release notes steps
+* [2075](https://github.com/AcademySoftwareFoundation/openexr/pull/2075)
+Add colorInteropID standard attribute
+* [2074](https://github.com/AcademySoftwareFoundation/openexr/pull/2074)
+OpenEXR - Adds New Bytes Attribute
+* [2072](https://github.com/AcademySoftwareFoundation/openexr/pull/2072)
+Add HTJ2K Compressor support to Tiled images
+* [2070](https://github.com/AcademySoftwareFoundation/openexr/pull/2070)
+Drop support for python 3.7; add support for python 3.13
+* [2066](https://github.com/AcademySoftwareFoundation/openexr/pull/2066)
+Standardize handling of directories and paths in ci_steps.yml
+* [2064](https://github.com/AcademySoftwareFoundation/openexr/pull/2064)
+Improve example reader code in README.md/website, and add to CI
+* [2063](https://github.com/AcademySoftwareFoundation/openexr/pull/2063)
+Fix problem with OpenJPH downstream dependency
+* [2061](https://github.com/AcademySoftwareFoundation/openexr/pull/2061)
+Remove realloc from HTJ2K coder
+* [2058](https://github.com/AcademySoftwareFoundation/openexr/pull/2058)
+Add macOS universal2 build to CI, and bump OpenJPG to 0.21.3
+* [2053](https://github.com/AcademySoftwareFoundation/openexr/pull/2053)
+Supplemental to 2051: Adjust the "Unknown" compression threshold to 11
+* [2051](https://github.com/AcademySoftwareFoundation/openexr/pull/2051)
+add htj2k as one of the compression names
+* [2048](https://github.com/AcademySoftwareFoundation/openexr/pull/2048)
+Rename "HT256" to "htj2k"
+* [2044](https://github.com/AcademySoftwareFoundation/openexr/pull/2044)
+Improve reliability/readability of bin tests scripts and failure output
+* [2041](https://github.com/AcademySoftwareFoundation/openexr/pull/2041)
+merge htj2k-beta branch with main
+* [2037](https://github.com/AcademySoftwareFoundation/openexr/pull/2037)
+Add vendored deflate
+* [2017](https://github.com/AcademySoftwareFoundation/openexr/pull/2017)
+Fix quoting an cmake args in `ci_workflow.yml`
+* [2016](https://github.com/AcademySoftwareFoundation/openexr/pull/2016)
+Address mingw32 issues
+* [2014](https://github.com/AcademySoftwareFoundation/openexr/pull/2014)
+Add MSYS2 jobs to CI
+* [2012](https://github.com/AcademySoftwareFoundation/openexr/pull/2012)
+Fix botched htj2k news title
+* [1995](https://github.com/AcademySoftwareFoundation/openexr/pull/1995)
+Bazel support: Bump rules_cc
+* [1886](https://github.com/AcademySoftwareFoundation/openexr/pull/1886)
+Bump github/codeql-action from 3.26.12 to 3.26.13
+* [1882](https://github.com/AcademySoftwareFoundation/openexr/pull/1882)
+Bazel Support: Use Imath and libdeflate live at head
+* [1879](https://github.com/AcademySoftwareFoundation/openexr/pull/1879)
+Fetch master branch of libdeflate on main
+* [1852](https://github.com/AcademySoftwareFoundation/openexr/pull/1852)
+Add an option to use TBB as the global provider
+## Version 3.3.13 (August 6, 2026)
+v3.3.13 is a security-focused patch release for the v3.3 release
+stream. It fixes 15 CVEs plus a broad set of additional hardening
+changes uncovered by the same fuzzing/audit effort.
+For each of these vulnerabilities, an attacker's vector is a
+maliciously crafted `.exr` file that must be opened by a victim,
+whether through the OpenEXR/OpenEXRUtil C++ libraries, the
+command-line tools (`exrmetrics`, `exrmultiview`, `exrmultipart`), or
+the PyOpenEXR Python bindings. The primary flaw for most of the CVEs
+is **memory corruption** — heap buffer overflows and out-of-bounds
+reads/writes — which at minimum crashes the reading process (denial of
+service) and in several cases could plausibly be leveraged for
+information disclosure or, in the worst cases, arbitrary code
+execution.
+No user interaction beyond opening the file is required, so any
+pipeline, service, or application that decodes untrusted or
+third-party EXR files should treat this as a priority
+upgrade. Severity generally ranges from **moderate** (crash-only, or
+requiring an uncommon build configuration) to **high** (heap overflow
+reachable with a small, easily-crafted file on common configurations).
+The individual vulnerabilities fall into four broad groups:
+* **PyOpenEXR RGB-channel-coalescing bugs**
+  ([CVE-2026-68514](https://www.cve.org/CVERecord?id=CVE-2026-68514),
+  [CVE-2026-68513](https://www.cve.org/CVERecord?id=CVE-2026-68513),
+  [CVE-2026-62986](https://www.cve.org/CVERecord?id=CVE-2026-62986),
+  [CVE-2026-61703](https://www.cve.org/CVERecord?id=CVE-2026-61703)).
+  When the Python bindings combine per-channel data (e.g. `left.R`,
+  `left.G`, `left.B`) into a single coalesced RGB array, conflicting or
+  mismatched channel names/types were not fully validated, which could
+  undersize the destination NumPy buffer. The result is a heap buffer
+  overflow on read, or, in the deep-image case, disclosure of
+  uninitialized ("stale") heap memory through the returned array. This
+  affects only code paths that read files with `separate_channels=False`
+  (the default for RGB coalescing).
+* **Integer-overflow-driven heap overflows on 32-bit (ILP32) builds**
+  ([CVE-2026-59985](https://www.cve.org/CVERecord?id=CVE-2026-59985),
+  [CVE-2026-59984](https://www.cve.org/CVERecord?id=CVE-2026-59984),
+  [CVE-2026-59983](https://www.cve.org/CVERecord?id=CVE-2026-59983),
+  [CVE-2026-59982](https://www.cve.org/CVERecord?id=CVE-2026-59982),
+  [CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981),
+  [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189),
+  [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186)).
+  On platforms where `size_t`/`int` are 32 bits, buffer sizes computed
+  from attacker-controlled header fields (dimensions, sample counts,
+  tile sizes) could overflow before an allocation or bounds check,
+  yielding an undersized buffer and a subsequent heap out-of-bounds
+  read or write during RLE, B44/B44A, or DWAA decompression, deep
+  sample-count-table decoding, or large-tile handling. These do not
+  affect typical 64-bit desktop/server builds, but are significant for
+  32-bit Linux, embedded, and some mobile/CI targets.
+* **Heap out-of-bounds access in `OpenEXRUtil` and the command-line
+  tools with non-default data windows**
+  ([CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981),
+  [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189),
+  [CVE-2026-59187](https://www.cve.org/CVERecord?id=CVE-2026-59187),
+  [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186),
+  [CVE-2026-59184](https://www.cve.org/CVERecord?id=CVE-2026-59184)).
+  `FlatImageChannel`/`DeepImageChannel`/`SampleCountChannel` row
+  addressing, and the deep-pixel path in `exrmetrics`, assumed a
+  data window originating at (0, 0). Crafted files with a nonzero data
+  window origin, or subsampled channels, caused row-address
+  computations to land outside the allocated buffer, producing a heap
+  read or write out of bounds.
+* **Crashes from malformed metadata (denial of service)**
+  ([CVE-2026-61555](https://www.cve.org/CVERecord?id=CVE-2026-61555),
+  [CVE-2026-59183](https://www.cve.org/CVERecord?id=CVE-2026-59183)).
+  An empty `multiView` attribute could crash `viewFromChannelName()`,
+  and a signed integer overflow while decoding deep tile chunks could
+  lead to an out-of-bounds access. Both are reachable simply by opening
+  a crafted file and result in a crash rather than corrupting memory
+  in an attacker-controlled way.
+A handful of the merged pull requests below are incidental hardening
+rather than fixes for a specific numbered CVE — for example, avoiding an
+unnecessary allocation in idmanifest parsing, a `Name::operator=`
+null-termination fix, and the unrelated (non-security) multi-part
+loading fix carried over from PR #2148 — but the bulk of this release is
+driven by the CVEs above.
+CVEs addressed:
+* [CVE-2026-68514](https://www.cve.org/CVERecord?id=CVE-2026-68514)
+  PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow
+* [CVE-2026-68513](https://www.cve.org/CVERecord?id=CVE-2026-68513)
+  PyOpenEXR prefixed literal RGB key collision heap buffer overflow
+* [CVE-2026-62986](https://www.cve.org/CVERecord?id=CVE-2026-62986)
+  PyOpenEXR deep prefixed RGB stale lane disclosure
+* [CVE-2026-61703](https://www.cve.org/CVERecord?id=CVE-2026-61703)
+  PyOpenEXR deep mixed RGB heap buffer overflow
+* [CVE-2026-61555](https://www.cve.org/CVERecord?id=CVE-2026-61555)
+  empty multiView viewFromChannelName file crash
+* [CVE-2026-59985](https://www.cve.org/CVERecord?id=CVE-2026-59985)
+  ILP32 OpenEXRCore RLE decode heap OOB read DoS
+* [CVE-2026-59984](https://www.cve.org/CVERecord?id=CVE-2026-59984)
+  ILP32 B44 InputFile decode scratch buffer overflow
+* [CVE-2026-59983](https://www.cve.org/CVERecord?id=CVE-2026-59983)
+  ILP32 DeepTiledInputFile sample count table decode OOB read
+* [CVE-2026-59982](https://www.cve.org/CVERecord?id=CVE-2026-59982)
+  ILP32 DWAA InputFile packed AC buffer overflow
+* [CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981)
+  OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read
+* [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189)
+  OpenEXRUtil DeepImageChannel row nonzero dataWindow heap OOB read
+* [CVE-2026-59187](https://www.cve.org/CVERecord?id=CVE-2026-59187)
+  OpenEXR exrmetrics deep pixelmode heap buffer overflow
+* [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186)
+  OpenEXR ILP32 TiledRgbaInputFile large tile Array2D heap OOB write
+* [CVE-2026-59184](https://www.cve.org/CVERecord?id=CVE-2026-59184)
+  OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write
+* [CVE-2026-59183](https://www.cve.org/CVERecord?id=CVE-2026-59183)
+  Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding
+### Merged Pull Requests
+* [2530](https://github.com/AcademySoftwareFoundation/openexr/pull/2530)
+  Fix exrmultiview heap OOB when union dataWindow misaligns with subsampling
+* [2529](https://github.com/AcademySoftwareFoundation/openexr/pull/2529)
+  Refuse to coalesce RGB channels when there's a conflicting channel name
+* [2527](https://github.com/AcademySoftwareFoundation/openexr/pull/2527)
+  Upgrade manylinux cibuildwheel images to manylinux_2_28
+* [2522](https://github.com/AcademySoftwareFoundation/openexr/pull/2522)
+  Fix name comparison in deep prefixed RGB channel coalescing
+* [2502](https://github.com/AcademySoftwareFoundation/openexr/pull/2502)
+  Reject mixed pixel types when coalescing RGB channels in PyOpenEXR.
+* [2500](https://github.com/AcademySoftwareFoundation/openexr/pull/2500)
+  Fix Name::operator= to null-terminate long strings
+* [2498](https://github.com/AcademySoftwareFoundation/openexr/pull/2498)
+  Avoid memory allocation in idmanifest parsing
+* [2496](https://github.com/AcademySoftwareFoundation/openexr/pull/2496)
+  Fix empty multiView crash in viewFromChannelName()
+* [2494](https://github.com/AcademySoftwareFoundation/openexr/pull/2494)
+  Reject oversized DWAA buffer allocations on ILP32
+* [2493](https://github.com/AcademySoftwareFoundation/openexr/pull/2493)
+  Fix ILP32 unpacked buffer size truncation in RLE decode
+* [2492](https://github.com/AcademySoftwareFoundation/openexr/pull/2492)
+  Fix ILP32 deep sample-count table size overflow in decoding
+* [2491](https://github.com/AcademySoftwareFoundation/openexr/pull/2491)
+  Fix ILP32 B44/B44A scratch buffer overflow in decode
+* [2488](https://github.com/AcademySoftwareFoundation/openexr/pull/2488)
+  Fix OpenEXRUtil row() OOB read with non-zero data window origin
+* [2487](https://github.com/AcademySoftwareFoundation/openexr/pull/2487)
+  Fix deep pixelmode heap buffer overflow in exrmetrics
+* [2486](https://github.com/AcademySoftwareFoundation/openexr/pull/2486)
+  Fix integer overflow in Array2D::resizeErase() on ILP32/LLP64 builds
+* [2484](https://github.com/AcademySoftwareFoundation/openexr/pull/2484)
+  Fix signed integer overflow in unpack_sample_table()
+* [2148](https://github.com/AcademySoftwareFoundation/openexr/pull/2148)
+  Fix unfinished multi-part file loading in the python wrapper
+## Version 3.3.12 (June 21, 2026)
+This release addresses the following security vulnerabilities:
+* [CVE-2026-55373](https://www.cve.org/CVERecord?id=CVE-2026-55373)
+  OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts
+* [CVE-2026-55059](https://www.cve.org/CVERecord?id=CVE-2026-55059)
+  OpenEXRUtil SampleCountChannel row setter heap out-of-bounds write
+* [CVE-2026-54920](https://www.cve.org/CVERecord?id=CVE-2026-54920)
+  Integer Overflow and Use of Uninitialized Pointer leading to Invalid Delete in OpenEXRUtil Image Resize
+### Merged Pull Requests
+* [2476](git@github.com:AcademySoftwareFoundation/openexr/pull/2476)
+  Fix the DWAA size checks regression
+* [2472](git@github.com:AcademySoftwareFoundation/openexr/pull/2472)
+  Unlock write context in exr_get_chunk_table_offset() return paths
+* [2468](git@github.com:AcademySoftwareFoundation/openexr/pull/2468)
+  Fix infinite loop in SampleCountChannel roundListSizeUp()
+* [2464](git@github.com:AcademySoftwareFoundation/openexr/pull/2464)
+  Fix heap out-of-bounds write in SampleCountChannel row setter.
+* [2463](git@github.com:AcademySoftwareFoundation/openexr/pull/2463)
+  Fix integer overflow and invalid delete in OpenEXRUtil Image::resize()
+* [2442](git@github.com:AcademySoftwareFoundation/openexr/pull/2442)
+  Bugfix: Fix interger overflows
+* [2438](git@github.com:AcademySoftwareFoundation/openexr/pull/2438)
+  Break release.py into separate small scripts for each step
+## Version 3.3.11 (April 29, 2026)
+Patch release for 3.3 that addresses the following security
+vulnerabilities:
+* [CVE-2026-42217](https://www.cve.org/CVERecord?id=CVE-2026-42217)
+Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`)
+* [CVE-2026-42216](https://www.cve.org/CVERecord?id=CVE-2026-42216)
+Out-of-bounds read in `IDManifest::init()` during prefix expansion
+* [CVE-2026-41142](https://www.cve.org/CVERecord?id=CVE-2026-41142)
+Integer overflow in `ImageChannel::resize` leads to heap OOB write via OpenEXRUtil public API
+Also:
+* OSS-fuzz [504280155](https://issues.oss-fuzz.com/issues/504280155)
+Heap-buffer-overflow in `DwaCompressor_uncompress`
+### Merged Pull Requests
+* [2383](https://github.com/AcademySoftwareFoundation/openexr/pull/2383)
+  validate that the uncompressed sizes recorded in the dwa header are valid
+* [2378](https://github.com/AcademySoftwareFoundation/openexr/pull/2378)
+  Harden IDManifest parsing against illegal shift and string prefix OOB
+* [2377](https://github.com/AcademySoftwareFoundation/openexr/pull/2377)
+  Fix OOB read when expanding IDManifest prefix-compressed strings
+* [2367](https://github.com/AcademySoftwareFoundation/openexr/pull/2367)
+  Fix int overflow in ImageChannel::resize pixel count
 ## Version 3.3.10 (April 17, 2026)
@@ -124,9 +1255,9 @@ Patch release that addresses the following security vulnerabilities:
 ### Merged Pull Requests
 * [2346](https://github.com/AcademySoftwareFoundation/openexr/pull/2346)
-Fix integer overflow in internal_dwa_compressor.h
+  Fix integer overflow in internal_dwa_compressor.h
-## Version 3.3.9 (April 3, 2026)
+## Version 3.3.9 (April 4, 2026)
 Patch release for v3.3 that addresses the following security vulnerabilities:
@@ -5655,7 +6786,7 @@ we're working to restore them.
 * Added new function, isImfMagic (). (Florian Kainz)
-## Version 1.0.6:
+## Version 1.0.6
 * Added README.win32 to disted files.
@@ -5781,7 +6912,7 @@ the source code.
 * OpenEXR is now covered by a modified BSD license.  See LICENSE
 	  for the new terms.
-## Version 1.0.3:
+## Version 1.0.3
 ### Detailed Changes:

OpenEXR 3.3.11__tar.gz → 3.3.13__tar.gz

OpenEXR 3.3.11tar.gz → 3.3.13tar.gz