OpenEXR 3.5.1__tar.gz → 3.5.3__tar.gz

openexr-3.5.3/.bazelversion

@@ -0,0 +1 @@
+9.2.0

{openexr-3.5.1 → openexr-3.5.3}/.readthedocs.yml

@@ -11,8 +11,8 @@ version: 2
 build:
   os: "ubuntu-22.04"
   tools:
-    # urllib3>=2.7 (website/requirements.txt) requires Python >=3.10
-    python: "3.11"
+    # sphinx>=9.2.0 (website/requirements.txt) requires Python >=3.13
+    python: "3.13"
        
 sphinx:
   configuration: website/conf.py

{openexr-3.5.1 → openexr-3.5.3}/BUILD.bazel

@@ -11,6 +11,22 @@ config_setting(
     constraint_values = ["@platforms//os:windows"],
 )
 
+# conf.py reads the project version out of the top-level CMakeLists.txt.
+exports_files(
+    ["CMakeLists.txt"],
+    visibility = ["//website:__pkg__"],
+)
+
+filegroup(
+    name = "OpenEXRCore_doc_srcs",
+    srcs = glob([
+        "src/lib/OpenEXRCore/*.c",
+        "src/lib/OpenEXRCore/*.cpp",
+        "src/lib/OpenEXRCore/*.h",
+    ]),
+    visibility = ["//website:__pkg__"],
+)
+
 expand_template(
     name = "IexConfig",
     out = "src/lib/Iex/IexConfig.h",

{openexr-3.5.1 → openexr-3.5.3}/CHANGES.md

@@ -3,6 +3,8 @@
 
 # OpenEXR Release Notes
 
+* [Version 3.5.3](#version-353-october-30-2026) October 30, 2026
+* [Version 3.5.2](#version-352-october-2-2026) October 2, 2026
 * [Version 3.5.1](#version-351-september-25-2026) September 25, 2026
 * [Version 3.5.0](#version-350-september-21-2026) September 21, 2026
 * [Version 3.4.15](#version-3415-august-21-2026) August 21, 2026
@@ -115,6 +117,271 @@
 * [Version 1.0.1](#version-101)
 * [Version 1.0](#version-10)
 
+## Version 3.5.3 (October 30, 2026)
+
+Patch release that addresses 15 security vulnerabilities, 10 with
+pending CVE IDs, primarily heap buffer overflows and out-of-bounds
+writes triggered by malformed or malicious EXR files — several capable
+of remote code execution. See the Security section below for details.
+
+This release includes no new features or changes in behavior other
+than improved error detection and rejection of invalid input, except
+for a fix for a regression introduced in v3.4.14 in reading deep
+images on big-endian hosts, due to a byte-order bug that returned an
+incorrect deep sample count table. Little-endian hosts are unaffected.
+
+As part of this effort, the full test suite now passes cleanly under
+the address, undefined-behavior, and thread sanitizers.
+
+Also in this release:
+
+* Add support for Python 3.15
+* Several diagnostic/correctness fixes across the utility tools
+  (exrmetrics, exrmultipart, exrcheck) and core decompression
+  paths (courtesy of @ssoj13/Alex Khal)
+* Address several long-standing build errors and test failures on i686
+  (32-bit linux) and s390x (big-endian) hosts.
+* Fix build issues on macOS < 10.15
+* Fix build issues on powerpc
+* Fix for absolute paths for `libm` in OpenEXRTargets.cmake
+* Fix for running on Windows 7 involving `CreateFile2`
+
+### Security
+
+This release addresses the following security vulnerabilities:
+
+* ***CVE Pending*** ([GHSA-WHF5-29MJ-GP53](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-WHF5-29MJ-GP53)) Heap Out-of-Bounds Write via Signed Integer Overflow in DWAA/DWAB LossyDctDecoder
+* ***CVE Pending*** ([GHSA-VP77-HHRC-M2C3](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-VP77-HHRC-M2C3)) Subsampled chunk-height miscount: heap overflow in B44 encoder, NULL dereference in DWA decoder/encoder
+* ***CVE Pending*** ([GHSA-RXWG-X3WX-PGFH](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-RXWG-X3WX-PGFH)) Heap out-of-bounds write via 32-bit tile-area integer overflow in DeepTiledOutputFile (deep-image re-save path) — possible incomplete fix of PR #939
+* ***CVE Pending*** ([GHSA-RJG8-982X-JHC2](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-RJG8-982X-JHC2)) Uninitialized Heap Memory Disclosure in DWA Decompression via Short zlib Stream Mapped to Success
+* ***CVE Pending*** ([GHSA-J76P-H7GW-VMPF](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-J76P-H7GW-VMPF)) Heap buffer overflow in the OpenEXR Python bindings when two RGB channel groups coalesce to the same key
+* ***CVE Pending*** ([GHSA-G248-596F-9995](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-G248-596F-9995)) Unvalidated extra `chlist` header attributes merged into `Header::channels()` cause a heap overflow in `run_fill`
+* ***CVE Pending*** ([GHSA-FRX8-5P4H-J8M7](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-FRX8-5P4H-J8M7)) Heap OOB Write via Integer Overflow in B44 Chunk Unpacked-Size Computation — Remote Code Execution in OpenEXRCore
+* ***CVE Pending*** ([GHSA-98RX-QPFV-QCWV](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-98RX-QPFV-QCWV)) Missing grid-total bound in ZSTD deep decode causes heap out-of-bounds write in OpenEXRCore
+* ***CVE Pending*** ([GHSA-638X-X7MR-89XC](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-638X-X7MR-89XC)) Out-of-bounds write at an attacker-chosen displacement in legacy Python InputFile.channel()
+* ***CVE Pending*** ([GHSA-6358-7H9P-8G5C](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-6358-7H9P-8G5C)) Heap buffer overflow in OpenEXRCore ZSTD deep decode via unvalidated signed sample counts
+* ***CVE Pending*** ([GHSA-3CP4-779M-H837](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3CP4-779M-H837)) Use-after-free in OpenEXRCore exr_copy_unset_attributes() when a channel name exceeds 31 bytes
+* ([GHSA-RJG8-982X-JHC2](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-RJG8-982X-JHC2)) Uninitialized Heap Memory Disclosure in DWA Decompression via Short zlib Stream Mapped to Success
+* ([GHSA-X92J-9982-GJG7](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-X92J-9982-GJG7)) DWA Encoder `tmpHalfBuffer` Integer Overflow → Undersized Allocation
+* ([GHSA-HRP4-XJP5-CQ7J](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-HRP4-XJP5-CQ7J)) Misaligned pointer store in `ht_undo_impl()` (HTJ2K decode)
+* ([GHSA-FP76-2FH4-4XWW](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-FP76-2FH4-4XWW)) Uncontrolled Resource Consumption and O(N^2) Processing Overhead via Unbounded Multipart Header Parsing
+* ([GHSA-HCP5-MX7Q-9642](https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-HCP5-MX7Q-9642)) Null pointer read in the DWA decoder: `compute_sampled_height` counts one row instead of zero when y sampling exceeds the chunk height
+
+### Merged Pull Requests
+
+* [2790](https://github.com/AcademySoftwareFoundation/openexr/pull/2790)
+  ci: add Linux i686 (-m32) job to the full build (by @cary-ilm/Cary Phillips)
+* [2785](https://github.com/AcademySoftwareFoundation/openexr/pull/2785)
+  Fix exrmetrics bugs and preserve synthesized part header in *InputPart (by @ssoj13/Alex Khal)
+* [2784](https://github.com/AcademySoftwareFoundation/openexr/pull/2784)
+  Fix four bugs in OpenEXRUtil (CheckFile, Image, DeepImageLevel, SampleCountChannel) (by @ssoj13/Alex Khal)
+* [2783](https://github.com/AcademySoftwareFoundation/openexr/pull/2783)
+  Set decode->bytes_decompressed in HTJ2K and ZSTD decoders (by @ssoj13/Alex Khal)
+* [2782](https://github.com/AcademySoftwareFoundation/openexr/pull/2782)
+  Guard against null _sFile / _tFile in InputFile raw data methods (by @ssoj13/Alex Khal)
+* [2781](https://github.com/AcademySoftwareFoundation/openexr/pull/2781)
+  Fix exrmultipart -combine zeroing the last part's chunk offset table (by @ssoj13/Alex Khal)
+* [2780](https://github.com/AcademySoftwareFoundation/openexr/pull/2780)
+  Fix swapped tile coordinates in readDeepTile in ImfCheckFile.cpp (by @ssoj13/Alex Khal)
+* [2776](https://github.com/AcademySoftwareFoundation/openexr/pull/2776)
+  Fix undefined behavior reported by UBSan (by @cary-ilm/Cary Phillips)
+* [2775](https://github.com/AcademySoftwareFoundation/openexr/pull/2775)
+  Make the OpenEXRTest random number helpers thread-safe (by @cary-ilm/Cary Phillips)
+* [2773](https://github.com/AcademySoftwareFoundation/openexr/pull/2773)
+  share/util/release/log.py treats unrecognized prs as warnings (by @cary-ilm/Cary Phillips)
+* [2772](https://github.com/AcademySoftwareFoundation/openexr/pull/2772)
+  ci: add s390x big-endian and sanitizer jobs to the full build (by @cary-ilm/Cary Phillips)
+* [2771](https://github.com/AcademySoftwareFoundation/openexr/pull/2771)
+  Fix byte-swapped deep sample count table on big-endian hosts (by @cary-ilm/Cary Phillips)
+* [2770](https://github.com/AcademySoftwareFoundation/openexr/pull/2770)
+  Fix DWA lossy compression on big-endian hosts (by @cary-ilm/Cary Phillips)
+* [2769](https://github.com/AcademySoftwareFoundation/openexr/pull/2769)
+  Fix HTJ2K/LJ2K compression on big-endian hosts (by @cary-ilm/Cary Phillips)
+* [2768](https://github.com/AcademySoftwareFoundation/openexr/pull/2768)
+  Fix the ZSTD codec on big-endian hosts (by @cary-ilm/Cary Phillips)
+* [2763](https://github.com/AcademySoftwareFoundation/openexr/pull/2763)
+  Use unaligned stores for Core unpack destination writes (by @anishagg17/Anish Aggarwal)
+* [2762](https://github.com/AcademySoftwareFoundation/openexr/pull/2762)
+  Fix compute_sampled_height() for chunks with no sampled row (by @cary-ilm/Cary Phillips)
+* [2761](https://github.com/AcademySoftwareFoundation/openexr/pull/2761)
+  Update python build and website requirements (by @cary-ilm/Cary Phillips)
+* [2760](https://github.com/AcademySoftwareFoundation/openexr/pull/2760)
+  Fix dangling channels pointer in exr_copy_unset_attributes() (by @cary-ilm/Cary Phillips)
+* [2759](https://github.com/AcademySoftwareFoundation/openexr/pull/2759)
+  Fix CI and CMake configuration bugs (by @cary-ilm/Cary Phillips)
+* [2757](https://github.com/AcademySoftwareFoundation/openexr/pull/2757)
+  Fix unsigned wraparound in legacy Python InputFile.channel() (by @cary-ilm/Cary Phillips)
+* [2755](https://github.com/AcademySoftwareFoundation/openexr/pull/2755)
+  Validate ZSTD deep sample counts before unsorting pixel data (by @vlazar-ilm/Vlad Lazar)
+* [2754](https://github.com/AcademySoftwareFoundation/openexr/pull/2754)
+  Compile the Python module with /bigobj on MSVC (by @cary-ilm/Cary Phillips)
+* [2753](https://github.com/AcademySoftwareFoundation/openexr/pull/2753)
+  Add share/util/run_full_build.sh to trigger the "Full Build" CI (by @cary-ilm/Cary Phillips)
+* [2751](https://github.com/AcademySoftwareFoundation/openexr/pull/2751)
+  Document OPENEXR_ENABLE_THREADING in install.rst (by @manish-9245/Manish)
+* [2749](https://github.com/AcademySoftwareFoundation/openexr/pull/2749)
+  Use size_t block indexing in DWA lossy DCT decoder (by @cary-ilm/Cary Phillips)
+* [2748](https://github.com/AcademySoftwareFoundation/openexr/pull/2748)
+  Fix tile area overflow in DeepTiledOutputFile::initialize (by @cary-ilm/Cary Phillips)
+* [2747](https://github.com/AcademySoftwareFoundation/openexr/pull/2747)
+  Reject Python RGB channel groups that coalesce to the same key (by @cary-ilm/Cary Phillips)
+* [2746](https://github.com/AcademySoftwareFoundation/openexr/pull/2746)
+  Fix null read in DWA decoder when y sampling exceeds chunk height (by @cary-ilm/Cary Phillips)
+* [2745](https://github.com/AcademySoftwareFoundation/openexr/pull/2745)
+  Only merge the "channels" chlist attribute into Header::channels() (by @cary-ilm/Cary Phillips)
+* [2744](https://github.com/AcademySoftwareFoundation/openexr/pull/2744)
+  Grow the part table geometrically when adding parts (by @cary-ilm/Cary Phillips)
+* [2737](https://github.com/AcademySoftwareFoundation/openexr/pull/2737)
+  Update Joseph Goldstone's TSC listing (by @JGoldstone/Joseph Goldstone)
+* [2726](https://github.com/AcademySoftwareFoundation/openexr/pull/2726)
+  Fix heap OOB read in deep PIZ encoder path (by @kalt2212/Kalt2212)
+* [2723](https://github.com/AcademySoftwareFoundation/openexr/pull/2723)
+  CI: expand coverage, premerge/full workflows, reduce compute (by @cary-ilm/Cary Phillips)
+* [2719](https://github.com/AcademySoftwareFoundation/openexr/pull/2719)
+  Fix integer overflow in readCoreScanlinePart scanline size accumulation (by @kalt2212/Kalt2212)
+* [2718](https://github.com/AcademySoftwareFoundation/openexr/pull/2718)
+  Fix B44 integer overflow OOB write (by @cary-ilm/Cary Phillips)
+* [2717](https://github.com/AcademySoftwareFoundation/openexr/pull/2717)
+  Fix DWA uninitialized heap memory disclosure (by @cary-ilm/Cary Phillips)
+* [2714](https://github.com/AcademySoftwareFoundation/openexr/pull/2714)
+  website: Add AppleClang to warning suppression for example code (by @cary-ilm/Cary Phillips)
+* [2713](https://github.com/AcademySoftwareFoundation/openexr/pull/2713)
+  bound the ZSTD grid total against uncompressed_size (by @cary-ilm/Cary Phillips)
+* [2712](https://github.com/AcademySoftwareFoundation/openexr/pull/2712)
+  Use CreateFileW unconditionally on Windows (by @cary-ilm/Cary Phillips)
+* [2709](https://github.com/AcademySoftwareFoundation/openexr/pull/2709)
+  J2K: fix UB (by @palemieux/Pierre-Anthony Lemieux)
+* [2708](https://github.com/AcademySoftwareFoundation/openexr/pull/2708)
+  J2K: Optimize pixel copy (by @palemieux/Pierre-Anthony Lemieux)
+* [2707](https://github.com/AcademySoftwareFoundation/openexr/pull/2707)
+  internal_zstd.c: fix macOS < 10.15 builds (by @barracuda156/Sergey Fedorov)
+* [2706](https://github.com/AcademySoftwareFoundation/openexr/pull/2706)
+  Re-enable dispatch on 10.6 powerpc (by @barracuda156/Sergey Fedorov)
+* [2699](https://github.com/AcademySoftwareFoundation/openexr/pull/2699)
+  unpack.c: fix data race in half_to_float_buffer selection (by @cary-ilm/Cary Phillips)
+* [2698](https://github.com/AcademySoftwareFoundation/openexr/pull/2698)
+  Add missing upper bound check for deep tile sample table size (by @cary-ilm/Cary Phillips)
+* [2697](https://github.com/AcademySoftwareFoundation/openexr/pull/2697)
+  Cast to size_t to avoid int overflow in make_channel_map (by @cary-ilm/Cary Phillips)
+* [2695](https://github.com/AcademySoftwareFoundation/openexr/pull/2695)
+  J2K: fix misaligned access (by @palemieux/Pierre-Anthony Lemieux)
+* [2687](https://github.com/AcademySoftwareFoundation/openexr/pull/2687)
+  Add NetBSD CI workflow and fix NetBSD build/test issues (by @cary-ilm/Cary Phillips)
+* [2686](https://github.com/AcademySoftwareFoundation/openexr/pull/2686)
+  Bazel support: Enable building of website (by @Vertexwahn/Vertexwahn)
+* [2657](https://github.com/AcademySoftwareFoundation/openexr/pull/2657)
+  website: replace Press theme with PyData Sphinx Theme (by @QuantaDude/Abhirup Bhattacharyya)
+* [2546](https://github.com/AcademySoftwareFoundation/openexr/pull/2546)
+  Scikit-build-core fixes (by @LonerDan/Daniel Brát)
+* [1376](https://github.com/AcademySoftwareFoundation/openexr/pull/1376)
+  [cmake] don't find_library for libm to avoid absolute path in OpenEXRTargets.cmake (by @rosalyntg/Rosalyn Greene)
+
+### Merged Workflow Pull Requests
+
+* [2788](https://github.com/AcademySoftwareFoundation/openexr/pull/2788)
+  Bump actions/setup-python from 7.0.0 to 7.1.0 in the actions-deps group (by @app/dependabot)
+* [2779](https://github.com/AcademySoftwareFoundation/openexr/pull/2779)
+  Bump the actions-deps group with 2 updates (by @app/dependabot)
+* [2778](https://github.com/AcademySoftwareFoundation/openexr/pull/2778)
+  Bump the codeql group with 3 updates (by @app/dependabot)
+* [2777](https://github.com/AcademySoftwareFoundation/openexr/pull/2777)
+  Bump the python-module-deps group with 4 updates (by @app/dependabot)
+* [2774](https://github.com/AcademySoftwareFoundation/openexr/pull/2774)
+  Bump the actions-deps group with 3 updates (by @app/dependabot)
+* [2767](https://github.com/AcademySoftwareFoundation/openexr/pull/2767)
+  ci: run the full build when its workflow files change (by @cary-ilm/Cary Phillips)
+* [2764](https://github.com/AcademySoftwareFoundation/openexr/pull/2764)
+  ci: find the multi-arch dependencies in /usr/local for universal2 (by @cary-ilm/Cary Phillips)
+* [2753](https://github.com/AcademySoftwareFoundation/openexr/pull/2753)
+  Add `share/util/run_full_build.sh` to trigger the "Full Build" CI (by @cary-ilm/Cary Phillips)
+* [2752](https://github.com/AcademySoftwareFoundation/openexr/pull/2752)
+  ci: Remove outdated OpenJPH job (by @cary-ilm/Cary Phillips)
+* [2750](https://github.com/AcademySoftwareFoundation/openexr/pull/2750)
+  Bump the actions-deps group with 3 updates (by @app/dependabot)
+* [2739](https://github.com/AcademySoftwareFoundation/openexr/pull/2739)
+  Bump the bazel-deps group with 4 updates (by @app/dependabot)
+* [2735](https://github.com/AcademySoftwareFoundation/openexr/pull/2735)
+  Bump pypa/cibuildwheel from 4.3.0 to 4.3.1 (by @app/dependabot)
+* [2731](https://github.com/AcademySoftwareFoundation/openexr/pull/2731)
+  Bump actions/upload-artifact from 7.0.1 to 7.0.2 (by @app/dependabot)
+* [2730](https://github.com/AcademySoftwareFoundation/openexr/pull/2730)
+  Bump actions/download-artifact from 8.0.1 to 8.0.2 (by @app/dependabot)
+* [2723](https://github.com/AcademySoftwareFoundation/openexr/pull/2723)
+  CI: expand coverage, premerge/full workflows, reduce compute (by @cary-ilm/Cary Phillips)
+* [2722](https://github.com/AcademySoftwareFoundation/openexr/pull/2722)
+  Bump rules_python from 2.3.4 to 2.4.1 (by @app/dependabot)
+* [2721](https://github.com/AcademySoftwareFoundation/openexr/pull/2721)
+  Bump sphinxdocs from 2.3.4 to 2.4.1 (by @app/dependabot)
+* [2720](https://github.com/AcademySoftwareFoundation/openexr/pull/2720)
+  Bump rules_cc from 0.2.25 to 0.2.26 (by @app/dependabot)
+* [2715](https://github.com/AcademySoftwareFoundation/openexr/pull/2715)
+  Bump pypa/cibuildwheel from 4.2.1 to 4.3.0 (by @app/dependabot)
+* [2711](https://github.com/AcademySoftwareFoundation/openexr/pull/2711)
+  Bump vmactions/freebsd-vm from 1.5.8 to 1.5.9 (by @app/dependabot)
+* [2703](https://github.com/AcademySoftwareFoundation/openexr/pull/2703)
+  Strip Contributors from notes in slack release post (by @cary-ilm/Cary Phillips)
+* [2696](https://github.com/AcademySoftwareFoundation/openexr/pull/2696)
+  Add support for Python 3.15 (by @cary-ilm/Cary Phillips)
+* [2687](https://github.com/AcademySoftwareFoundation/openexr/pull/2687)
+  Add NetBSD CI workflow and fix NetBSD build/test issues (by @cary-ilm/Cary Phillips)
+
+## Version 3.5.2 (October 2, 2026)
+
+Patch release that introduces the use of OpenJPH's built-in LUT to
+apply the decode/encode transfer function for lossy LJ2K compression.
+
+:warning: WARNING: EXR files written by OpenEXR v3.5.0 and v3.5.1
+using lossy LJ2K compression lack the LUT in their codestream and
+should be regenerated. This v3.5.2 release includes a backwards
+compatibility fallback so that such files can be successfully decoded,
+but for best results, please regenerate any files using LJ2K written
+by v3.5.0 and v3.5.1.
+
+Also in this release:
+
+* Prebuilt wheels Python 3.14.
+* Fix for a bug when when statically linking when libdeflate, zstd, or
+  OpenJPH is found via pkg-config rather than CMake config.
+* Pin the `IMATH_TAG` to `v3.2.3`; it was previously incorrectly set to `main`.
+* Pin the JPEG 2000 progression order to RPCL and adds TLM markers to
+  allow efficient random access to resolution layers for J2K compression. 
+
+### Merged Pull Requests
+
+* [2694](https://github.com/AcademySoftwareFoundation/openexr/pull/2694)
+  LJ2K: add compatibility with v3.5.0 an v3.5.1 files (by @palemieux/Pierre-Anthony Lemieux)
+* [2688](https://github.com/AcademySoftwareFoundation/openexr/pull/2688)
+  Fix integer overflow in exrcheck's readCoreTiledPart tile size accumulation (by @cary-ilm/Cary Phillips)
+* [2679](https://github.com/AcademySoftwareFoundation/openexr/pull/2679)
+  Remove forward declarations in `IMATH_INTERNAL_NAMESPACE` (by @cary-ilm/Cary Phillips)
+* [2673](https://github.com/AcademySoftwareFoundation/openexr/pull/2673)
+  Recreate pkg-config dependency targets in OpenEXRConfig.cmake (by @lgritz/Larry Gritz)
+* [2672](https://github.com/AcademySoftwareFoundation/openexr/pull/2672)
+  J2K: pin progression order to RPCL and add TLM (by @palemieux/Pierre-Anthony Lemieux)
+* [2637](https://github.com/AcademySoftwareFoundation/openexr/pull/2637)
+  LJ2K: Use J2K Type 4 NLT LUT to apply the transfer function (by @palemieux/Pierre-Anthony Lemieux)
+
+### Merged Workflow Pull Requests
+
+* [2692](https://github.com/AcademySoftwareFoundation/openexr/pull/2692)
+  Bump jmertic/slack-release-notifier from 20260820 to 20260930 (by @app/dependabot)
+* [2689](https://github.com/AcademySoftwareFoundation/openexr/pull/2689)
+  Bump msys2/setup-msys2 from 2.32.0 to 2.33.0 (by @app/dependabot)
+* [2685](https://github.com/AcademySoftwareFoundation/openexr/pull/2685)
+  Build wheel for Python 3.14 (by @cary-ilm/Cary Phillips)
+* [2677](https://github.com/AcademySoftwareFoundation/openexr/pull/2677)
+  Bump vmactions/freebsd-vm from 1.5.7 to 1.5.8 (by @app/dependabot)
+* [2676](https://github.com/AcademySoftwareFoundation/openexr/pull/2676)
+  Bump the codeql group with 3 updates (by @app/dependabot)
+* [2664](https://github.com/AcademySoftwareFoundation/openexr/pull/2664)
+  Bump vmactions/freebsd-vm from 1.5.6 to 1.5.7 (by @app/dependabot)
+* [2663](https://github.com/AcademySoftwareFoundation/openexr/pull/2663)
+  Bump the codeql group with 3 updates (by @app/dependabot)
+* [2662](https://github.com/AcademySoftwareFoundation/openexr/pull/2662)
+  Update urllib3 requirement from >=2.7 to >=2.8.0 in /website (by @app/dependabot)
+* [2661](https://github.com/AcademySoftwareFoundation/openexr/pull/2661)
+  Update idna requirement from >=3.19 to >=3.20 in /website (by @app/dependabot)
+
 ## Version 3.5.1 (September 25, 2026)
 
 Patch release that addresses a security vulnerability in ZSTD:
@@ -246,8 +513,6 @@ This release addresses the following security vulnerabilities:
 * [2640](https://github.com/AcademySoftwareFoundation/openexr/pull/2640)
   LJ2K: declare the chunk padding in a COM marker segment (by
   @osamu620/Osamu Watanabe)
-* [2637](https://github.com/AcademySoftwareFoundation/openexr/pull/2637)
-  LJ2K: Use J2K Type 4 NLT LUT to apply the transfer function (by @palemieux/Pierre-Anthony Lemieux)
 * [2633](https://github.com/AcademySoftwareFoundation/openexr/pull/2633)
   LJ2K: pad lossy chunks so that wavelet folds stay on low-pass
   positions (by @osamu620/Osamu Watanabe)

{openexr-3.5.1 → openexr-3.5.3}/CONTRIBUTING.md

@@ -658,7 +658,7 @@ while on the appropriate `RB-` branch:
 
    Adding the release notes as the tag message is good practice.
 
-   Push the tags. This triggers the `python-wheels-publish-test`
+   Push the tags. This triggers the `python_candidate`
    CI workflow. Confirm it succeeds.
 
    Run the `candidate.py` script to format a

{openexr-3.5.1 → openexr-3.5.3}/GOVERNANCE.md

@@ -113,7 +113,7 @@ represents the project at ASWF TAC meetings.
 * Kimball Thurston - Weta Digital, Ltd.
 * Nick Porcino - Pixar Animation Studios
 * Christina Tempelaar-Lietz - Industrial Light & Magic
-* Joseph Goldstone - Lilliputian Pictures LLC
+* Joseph Goldstone
 * John Mertic - The Linux Foundation
 
 ### TSC Meetings

openexr-3.5.3/MODULE.bazel

@@ -0,0 +1,74 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright Contributors to the OpenEXR Project.
+
+module(
+    name = "openexr",
+)
+
+bazel_dep(name = "bazel_skylib", version = "1.9.2")
+bazel_dep(name = "imath", version = "3.2.3")
+bazel_dep(name = "libdeflate", version = "1.26")
+bazel_dep(name = "openjph", version = "0.32.0")
+bazel_dep(name = "platforms", version = "1.1.0")
+bazel_dep(name = "rules_cc", version = "0.2.26")
+bazel_dep(name = "zstd", version = "1.5.7.bcr.3")
+
+# Documentation (Doxygen + Sphinx/Breathe), see //website:docs.
+bazel_dep(name = "rules_doxygen", version = "2.7.0", dev_dependency = True)
+bazel_dep(name = "rules_python", version = "2.4.2", dev_dependency = True)
+bazel_dep(name = "sphinxdocs", version = "2.4.2", dev_dependency = True)
+
+doxygen_extension = use_extension(
+    "@rules_doxygen//:extensions.bzl",
+    "doxygen_extension",
+    dev_dependency = True,
+)
+
+# Matches the doxygen shipped by ubuntu-24.04, which the CMake website build uses.
+# Note: doxygen 1.9.1 (pinned in .github/workflows/website.yml) links against
+# libclang-9.so.1, which is not available on ubuntu-24.04.
+DOXYGEN_VERSION = "1.9.8"
+
+[
+    doxygen_extension.configuration(
+        platform = platform,
+        sha256 = sha256,
+        version = DOXYGEN_VERSION,
+    )
+    for platform, sha256 in {
+        "windows": "03f98f585acee18df0575262feffccc8a93a5aeacd4ee8c21872aeef12532244",
+        "linux": "dda773bdc62384b7d796fe8b6c5029daad72483e4c8ad4abf6ee9fb98b649388",
+        "linux-arm": "dda773bdc62384b7d796fe8b6c5029daad72483e4c8ad4abf6ee9fb98b649388",
+        "mac": "028d120e4baea55005c7ec1086bbbd56802730bcf80f99d730b56cbb5816f197",
+    }.items()
+]
+
+# Doxygen 1.9.8's macOS archive is Intel-only; use the native ARM release.
+doxygen_extension.configuration(
+    platform = "mac-arm",
+    sha256 = "f473c0f76cc969309b86c0f441934e844bc9c049112ae3482678bd45a7c8a28c",
+    version = "1.16.1",
+)
+
+use_repo(doxygen_extension, "doxygen")
+
+PYTHON_VERSION = "3.14"
+
+python = use_extension(
+    "@rules_python//python/extensions:python.bzl",
+    "python",
+    dev_dependency = True,
+)
+python.toolchain(python_version = PYTHON_VERSION)
+
+pip = use_extension(
+    "@rules_python//python/extensions:pip.bzl",
+    "pip",
+    dev_dependency = True,
+)
+pip.parse(
+    hub_name = "docs_pypi",
+    python_version = PYTHON_VERSION,
+    requirements_lock = "//website:requirements-lock.txt",
+)
+use_repo(pip, "docs_pypi")

{openexr-3.5.1 → openexr-3.5.3}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.2
 Name: OpenEXR
-Version: 3.5.1
+Version: 3.5.3
 Summary: Python bindings for the OpenEXR image file format
 Author-Email: Contributors to the OpenEXR project <info@openexr.com>
 Project-URL: Homepage, https://openexr.com
 Project-URL: Source, https://github.com/AcademySoftwareFoundation/OpenEXR
 Project-URL: Bug Tracker, https://github.com/AcademySoftwareFoundation/OpenEXR/issues
-Requires-Python: >=3.7
+Requires-Python: >=3.11
 Requires-Dist: numpy>=1.7.0
 Provides-Extra: test
 Requires-Dist: pytest; extra == "test"

{openexr-3.5.1 → openexr-3.5.3}/cmake/CMakeLists.txt

@@ -80,7 +80,7 @@ else()
 endif()
 
 if (UNIX AND NOT APPLE AND NOT BEOS)
-  find_library(OPENEXR_EXTRA_MATH_LIB m)
+  set(OPENEXR_EXTRA_MATH_LIB m PARENT_SCOPE)
   mark_as_advanced(OPENEXR_EXTRA_MATH_LIB)
 endif()
 

openexr-3.5.3/cmake/OpenEXRConfig.cmake.in

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright (c) Contributors to the OpenEXR Project.
+
+@PACKAGE_INIT@
+
+include(CMakeFindDependencyMacro)
+
+set(openexr_needthreads @OPENEXR_ENABLE_THREADING@)
+if (openexr_needthreads)
+  set(THREADS_PREFER_PTHREAD_FLAG ON)
+  find_dependency(Threads)
+endif()
+unset(openexr_needthreads)
+
+find_dependency(Imath)
+
+# A static OpenEXRCore links to any dependency found via pkg-config through
+# a PkgConfig:: imported target, which must be recreated here.
+macro(openexr_find_pkgconfig_dependency prefix module)
+  if (NOT TARGET PkgConfig::${prefix})
+    find_dependency(PkgConfig)
+    pkg_check_modules(${prefix} REQUIRED QUIET IMPORTED_TARGET GLOBAL ${module})
+  endif()
+endmacro()
+
+if ("@EXR_DEFLATE_LIB@" STREQUAL "PkgConfig::deflate")
+  if (NOT @BUILD_SHARED_LIBS@)
+    openexr_find_pkgconfig_dependency(deflate libdeflate)
+  endif()
+elseif (@libdeflate_FOUND@)
+  find_dependency(libdeflate)
+endif()
+
+if ("@EXR_OPENJPH_LIB@" STREQUAL "PkgConfig::openjph")
+  if (NOT @BUILD_SHARED_LIBS@)
+    openexr_find_pkgconfig_dependency(openjph "openjph=@openjph_VERSION@")
+  endif()
+elseif (NOT @OPENEXR_USE_INTERNAL_OPENJPH@)
+  find_dependency(openjph)
+endif()
+
+if ("@EXR_ZSTD_LIB@" STREQUAL "PkgConfig::libzstd")
+  if (NOT @BUILD_SHARED_LIBS@)
+    openexr_find_pkgconfig_dependency(libzstd libzstd)
+  endif()
+elseif (@zstd_FOUND@)
+  find_dependency(zstd CONFIG)
+endif()
+
+include("${CMAKE_CURRENT_LIST_DIR}/@PROJECT_NAME@Targets.cmake")
+check_required_components("@PROJECT_NAME@")

{openexr-3.5.1 → openexr-3.5.3}/cmake/OpenEXRSetup.cmake

@@ -175,7 +175,7 @@ endif()
 option(OPENEXR_USE_CLANG_TIDY "Check if clang-tidy is available, and enable that" OFF)
 if(OPENEXR_USE_CLANG_TIDY)
   find_program(OPENEXR_CLANG_TIDY_BIN clang-tidy)
-  if(OPENEXR_CLANG_TIDY_BIN-NOTFOUND)
+  if(NOT OPENEXR_CLANG_TIDY_BIN)
     message(FATAL_ERROR "clang-tidy processing requested, but no clang-tidy found")
   endif()
   # TODO: Need to define the list of valid checks and add a file with said list
@@ -206,7 +206,7 @@ if(OPENEXR_ENABLE_THREADING)
   if(OPENEXR_USE_TBB)
     find_package(TBB)
     if(NOT TBB_FOUND)
-      message(FATAL_ERROR "Unable to find the OneTBB cmake library, disable with ILMTHREAD_USE_TBB=OFF or fix TBB install")
+      message(FATAL_ERROR "Unable to find the OneTBB cmake library, disable with OPENEXR_USE_TBB=OFF or fix TBB install")
     endif()
   endif()
 endif()
@@ -336,7 +336,7 @@ endif()
 option(OPENEXR_FORCE_INTERNAL_IMATH "Force using an internal imath" OFF)
 # Check to see if Imath is installed outside of the current build directory.
 set(OPENEXR_IMATH_REPO "https://github.com/AcademySoftwareFoundation/Imath.git" CACHE STRING "Repo for auto-build of Imath")
-set(OPENEXR_IMATH_TAG "main" CACHE STRING "Tag for auto-build of Imath (branch, tag, or SHA)")
+set(OPENEXR_IMATH_TAG "v3.2.3" CACHE STRING "Tag for auto-build of Imath (branch, tag, or SHA)")
 if(NOT OPENEXR_FORCE_INTERNAL_IMATH)
   #TODO: ^^ Release should not clone from main, this is a place holder
   set(CMAKE_IGNORE_PATH "${CMAKE_CURRENT_BINARY_DIR}/_deps/imath-src/config;${CMAKE_CURRENT_BINARY_DIR}/_deps/imath-build/config")
@@ -531,7 +531,15 @@ endif()
 # Enable SSE2 on 32-bit x86
 ###########################################
 
-if(CMAKE_SYSTEM_PROCESSOR MATCHES "^(i[3-6]86|x86)$" AND NOT MSVC)
+# CMAKE_SYSTEM_PROCESSOR reflects the host's uname, not the actual
+# build target; a 32-bit x86 build made by adding -m32 to a native
+# x86_64 compiler still reports x86_64 there, even though
+# CMAKE_SIZEOF_VOID_P (derived by actually compiling a test program
+# with the real compiler flags) correctly shows a 4-byte pointer. Catch
+# that case explicitly, in addition to a genuine i686/x86 host.
+if((CMAKE_SYSTEM_PROCESSOR MATCHES "^(i[3-6]86|x86)$" OR
+    (CMAKE_SYSTEM_PROCESSOR MATCHES "amd64.*|AMD64.*|x86_64.*|X86_64.*" AND CMAKE_SIZEOF_VOID_P EQUAL 4))
+   AND NOT MSVC)
   include(CheckCCompilerFlag)
   check_c_compiler_flag("-msse2" HAS_SSE2_FLAG)
   if(HAS_SSE2_FLAG)

{openexr-3.5.1 → openexr-3.5.3}/pyproject.toml

@@ -2,7 +2,7 @@
 # Copyright (c) Contributors to the OpenEXR Project.
 
 [build-system]
-requires = ["scikit-build-core==0.12.2", "pybind11==2.13.6", "build==1.2.2.post1"]
+requires = ["scikit-build-core==1.1.1", "pybind11==3.1.0", "build==1.6.1"]
 build-backend = "scikit_build_core.build"
 
 [project]
@@ -14,7 +14,7 @@ readme = "src/wrappers/python/README.md"
 authors = [
   { name="Contributors to the OpenEXR project", email="info@openexr.com" },
 ]
-requires-python = ">=3.7"
+requires-python = ">=3.11"
 
 dependencies = [
   "numpy>=1.7.0"
@@ -43,7 +43,7 @@ wheel.expand-macos-universal-tags = true
 sdist.exclude = [".github", "src/examples", "ASWF", "bazel", "share"]
 
 # Only build the PyOpenEXR (cmake --build --target PyOpenEXR).
-cmake.targets = ["PyOpenEXR"]
+build.targets = ["PyOpenEXR"]
 # Only install the "python" component (cmake --install --component python).
 # This makes sure that only files marked as "python" component are installed.
 install.components = ["python"]

{openexr-3.5.1 → openexr-3.5.3}/src/bin/exrmetrics/exrmetrics.cpp

@@ -239,9 +239,9 @@ initTiled (
                     pixelSize += samplesize;
                 }
                 totalPixels += numPixels;
+                tileCount += in.numXTiles (xLevel) * in.numYTiles (yLevel);
                 ++levelIndex;
             }
-            tileCount += in.numXTiles (xLevel) * in.numYTiles (yLevel);
         }
     }
     partSizeData data;
@@ -565,8 +565,8 @@ initAndReadDeepTiled (
     sampleData.resize (numChans);
     channelNumber = 0;
 
-    for (ChannelList::ConstIterator i = in.header ().channels ().begin ();
-         i != in.header ().channels ().end ();
+    for (ChannelList::ConstIterator i = outHeader.channels ().begin ();
+         i != outHeader.channels ().end ();
          ++i)
     {
         int samplesize = pixelTypeSize (i.channel ().type);
@@ -592,10 +592,13 @@ initAndReadDeepTiled (
     }
 
     partSizeData data;
-    data.rawSize    = totalSamples * bytesPerSample + numPixels * sizeof (int);
-    data.pixelCount = numPixels;
-    data.isDeep     = true;
-    data.isTiled    = true;
+    data.rawSize      = totalSamples * bytesPerSample + numPixels * sizeof (int);
+    data.pixelCount   = numPixels;
+    data.tileCount    = in.numXTiles (0) * in.numYTiles (0);
+    data.isDeep       = true;
+    data.isTiled      = true;
+    data.partType     = in.header ().type ();
+    data.compression  = in.header ().compression ();
     data.channelCount = numChans;
     return data;
 }
@@ -1082,7 +1085,7 @@ exrmetrics (
             {
                 // find channel suffix within full channel name (so 'R' in 'layer.R')
                 const char* name = i.name ();
-                const char* dot  = strrchr (name, 'r');
+                const char* dot  = strrchr (name, '.');
                 if (dot) { name = dot + 1; }
 
                 if (pixelMode == PIXELMODE_ALL_HALF ||
@@ -1128,7 +1131,7 @@ exrmetrics (
             DummyOStream        tmp;
             MultiPartOutputFile out (
                 tmp, outHeaders.data (), outHeaders.size ());
-            writeFile (out, parts, metrics, false);
+            writeFile (out, parts, metrics, false, &tmp);
             fileSize = tmp.tellp ();
         }