Skip to content

Bump rules_cc from 0.2.22 to 0.2.25 - #2655

Merged
cary-ilm merged 1 commit into
mainfrom
dependabot/bazel/rules_cc-0.2.25
Sep 20, 2026
Merged

Bump rules_cc from 0.2.22 to 0.2.25#2655
cary-ilm merged 1 commit into
mainfrom
dependabot/bazel/rules_cc-0.2.25

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps rules_cc from 0.2.22 to 0.2.25.

Release notes

Sourced from rules_cc's releases.

0.2.25

Using bzlmod with Bazel 6 or later:

  1. [Bazel 6] Add common --enable_bzlmod to .bazelrc.

  2. Add to your MODULE.bazel file:

bazel_dep(name = "rules_cc", version = "0.2.25")

Using WORKSPACE:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
name = "rules_cc",
sha256 = "bd7124a844d0403b4b353bcea34d6c8b2ba88dc26881c26c9ee668da89b71846",
strip_prefix = "rules_cc-0.2.25",
url = "https://github.com/bazelbuild/rules_cc/releases/download/0.2.25/rules_cc-0.2.25.tar.gz",
)
load("@​rules_cc//cc:extensions.bzl", "compatibility_proxy_repo")
compatibility_proxy_repo()

What's Changed

Notable changes

  • Throw an error if include attributes contain an absolute path instead of silently ignoring them. by @​a-googler in c85b4d3179cfb51a20a5380c26b7e28cf1a63609
  • Disable macOS toolchain by default (use apple_support instead) by @​keith in 0c36f2bb6c2421e2416040d214641d7abe89b31b
  • Allow 'includes = ["."]' in the root of the repo by @​keith in 0d150d5268c362c0da2cbb497d9c03d1466c2bee
  • Add //cc/libc config settings for C standard libraries (#792) by @​fmeum in dc424059b634480fdca0250e4ecc2af88f127059
  • Add best effort toolchain feature docs by @​keith in 2c276638d159b2bd97fd139a67d6c00cd92e2e91
  • Add loongarch64 support by @​zhaixiaojuan in 51784080f788bc816242bf1362d76cf14f306107
  • Support path mapping in CppLink IFF it's non-lto. by @​lilygorsheneva in ad214a9cb17d41e4e03199d61d436974a2261885
  • Create features to enable/disable path mapping for CppLink. by @​lilygorsheneva in ab613e1060c895e45689aa79f951e5f1a6d3c193
  • Add toolchain env + default env to dwp actions by @​keith in d8eea5a37fb096c879127e66c3f1845d9587db05
  • Fix system_include_paths with textual_hdrs/hdrs and strip_include_prefix by @​keith in db798494c28debf440576d79dc97b254908dcfb0
  • Expose Bazel cc rule functions for extension by @​hvadehra in 6c6a87ed23335eda4d01c12f4a10965897813d56
  • Expand tree artifacts in textual_hdrs in generated module maps (#787) by @​fmeum in 6cc1bf04ed7a89e39788cea1e10738136c9dd082
  • Honor object extensions for ThinLTO merged artifacts (#853) by @​cerisier in aff544134bc9d29006f27adbe63d824dfe1436f6
  • Expose a new API that copying from an existing library with overrides, so that callers don't need to know all internal attributes to avoid silently dropping some. by @​a-googler in 14686ad81e1cd50c8d2bf2ae3e2d45eb16339943
  • Implement Starlark-level enforcement of disallowed compiler flags in copts, conlyopts, cxxopts. by @​a-googler in f687cbc1bd9e23e1eeb61072ac8dc01d8577d793
  • Move coverage script / flag to public package (#867) by @​keith in 661b75de668c3b673f5550e0340e134ccf923956
  • Support C++20 modules, GCC part by @​PikachuHyA in faf2113fe24f2676afbe4fec7eaf0bbd15818698

... (truncated)

Commits
  • 77064f0 Skip C++20 test if missing clang-scan-deps (#880)
  • 661b75d Move coverage script / flag to public package (#867)
  • 3000380 Default cc_sysroot data to sysroot if not passed (#875)
  • c1ba7a0 Fix unused variable buildifier warning now that this always returns true.
  • 5ef9b69 Remove MODULE.bazel.lock usage from integration tests (#866)
  • fb4d05e No public description
  • a7a2e15 Remove my ownership from most of rules_cc
  • f687cbc Implement Starlark-level enforcement of disallowed compiler flags in copts, c...
  • de72c61 Support C++20 modules, MSVC part (#836)
  • 5e0038d Fix cc_integration_test workspace isolation and toolchain guards under Bzlmod.
  • Additional commits viewable in compare view

@dependabot dependabot Bot added bazel Pull requests that update bazel code dependencies Pull requests that update a dependency file labels Sep 19, 2026
@dependabot
Bump rules_cc from 0.2.22 to 0.2.25
ffb8635 
Bumps [rules_cc](https://github.com/bazelbuild/rules_cc) from 0.2.22 to 0.2.25.
- [Release notes](https://github.com/bazelbuild/rules_cc/releases)
- [Commits](bazelbuild/rules_cc@0.2.22...0.2.25)

---
updated-dependencies:
- dependency-name: rules_cc
  dependency-version: 0.2.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bazel/rules_cc-0.2.25 branch from 41974fb to ffb8635 Compare September 20, 2026 03:58
@cary-ilm
cary-ilm merged commit 08ccf28 into main Sep 20, 2026
103 checks passed
@dependabot
dependabot Bot deleted the dependabot/bazel/rules_cc-0.2.25 branch September 20, 2026 19:27
cary-ilm pushed a commit that referenced this pull request Sep 20, 2026
@dependabot @cary-ilm
Bump rules_cc from 0.2.22 to 0.2.25 (#2655)
8271260 
Bumps [rules_cc](https://github.com/bazelbuild/rules_cc) from 0.2.22 to 0.2.25.
- [Release notes](https://github.com/bazelbuild/rules_cc/releases)
- [Commits](bazelbuild/rules_cc@0.2.22...0.2.25)

---
updated-dependencies:
- dependency-name: rules_cc
  dependency-version: 0.2.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request Sep 28, 2026
@0-wiz-0
openexr: update to 3.5.1.
c12f001 
## Version 3.5.1 (September 25, 2026)

Patch release that addresses a security vulnerability in ZSTD:
- fix heap buffer overflow in ZSTD deep scanline decoding

Also, the v3.5.0 release incorrectly identified the
`OPENEXR_VERSION_RELEASE_TYPE` and associated `OPENEXR_PACKAGE_NAME`
as `-dev`.

### Merged Pull Requests

* [2669](AcademySoftwareFoundation/openexr#2669)
  Fix heap buffer overflow in ZSTD deep scanline decoding (by @cary-ilm/Cary Phillips)

## Version 3.5.0 (September 21, 2026)

* Support for lossless compression via
  [Zstandard](https://github.com/facebook/zstd)

  - Introduces `ZSTD_COMPRESSION/EXR_COMPRESSION_ZSTD` enum
  - Features a custom data prep stage that includes ByteShuffle,
    optional Delta Encoding, and custom data reordering.
  - Universal lossless support: Works for all image types (including
    Deep) and supports all OpenEXR pixel/data types.
  - Deep image gains: Extensive testing with Deep scanlines shows a
    20–30% size reduction compared to ZIPS based on image channels
    (with the best gains on Deep Alpha and Deep ID).
  - Flat image file size: Achieves comparable compressed sizes to ZIPS.
  - Flat image speed: Delivers slightly faster compression and
    decompression speeds compared to ZIPS
  - Introduces a new dependency on the zstd library; a vendored
    version (v1.5.7) is provided as a fallback if no installed version
    is present.

* Support for lossy compression based on the High Throughput JPEG 2000
  (HTJ2K) standard.

  - The LJ2K compressor uses the same JPEG 2000 constraints and codec
    library (OpenJPH) as HTJ2K256, but with lossy coding, producing
    smaller files at the cost of distortion.

  - LJ2K should generally offer reduced file sizes and higher
    throughput compared to DWA.

  - Currently supports 16-bit HALF, 32-bit FLOAT and 32-bit UINT
    channels. Lossy coding is currently applied only to RGB channels;
    other channels are losslessly coded.

  - The amount of distortion is controlled via a quality level
    parameter that ranges from 1 to 150.

  - As with DWA, lossy RGB channels are first transformed to a
    non-linear preceptual domain before coding. The transformation is
    log-based when the sample's magnitude is greater than 1, and
    power-law otherwise.

* Improved support for the `colorInteropID` standard attribute as a
  mechanism to identify the color space of the RGB images:

  - Added support for `colorInteropID` to command-line tool `exrstdattr`.
  - Added API functions to validate color metadata in the header to both the C++ and core APIs.
  - Extended the exrinfo command-line tool to print warnings regarding header color metadata.
  - Added helper functions to convert between chromaticities and `colorInteropID`.
  - Added Python bindings for all new functions.
  - See [An ID for Color
    Interop](https://github.com/AcademySoftwareFoundation/ColorInterop/blob/main/Recommendations/03_ColorInteropID/ColorInteropID.md)
    and [Identifying the Color Space of OpenEXR
    Files](https://github.com/AcademySoftwareFoundation/ColorInterop/blob/main/Recommendations/04_OpenEXRFiles/OpenEXRFiles.md)
    for details.

* Support for a cache for a (de)compression context in the core decode pipeline.

  - This is a backwards compatible change (i.e. older versions of code
    compiled against previous headers will still work), with the
    exception that it does add the requirement that application code
    actually use the provided initializer when defining
    `exr_decode_pipeline_t` objects.

* For the OpenEXR python module:
  - Support for the `idManifest` attribute and object
  - Support for multithreaded read and write
  - Support for reading/writing from/to `BytesIO` object
  - Add `setMaxImageSize/setMaxTileSize` functions

* Other changes:

  - `AcesInputFile/AcesOutputFile` and `exr2aces` as marked as
    deprecated and will be removed in a future release.
  - Improved handling of many channels
  - All Imath headers are now included internally via `#include <Imath/...>`
  - Remove `iex_debugTrap()` function (was not used)
  - Improved `ChannelList` Iterator API
  - Fixed a bug that with DWA compression that could silently produce
    corrupted files.

* Also of note:

  - The vendored version of deflate is 1.26
  - The vendored version of OpenJPH is 0.32.0
  - The minimum required version of OpenJPH is 0.32.0

### Security

This release addresses the following security vulnerabilities:

* OSS-Fuzz [514487287](https://issues.oss-fuzz.com/issues/514487287)
  Floating-point-exception in `part_exceeds_memory_limits`
* OSS-Fuzz [514423826](https://issues.oss-fuzz.com/issues/514423826)
  Divide-by-zero in `part_exceeds_memory_limits`
* OSS-Fuzz [513282267](https://issues.oss-fuzz.com/issues/513282267)
  Timeout in `openexr_exrgaps_fuzzer`
* OSS-Fuzz [512988066](https://issues.oss-fuzz.com/issues/512988066)
  Out-of-memory in `openexr_exrgaps_fuzzer`

### Merged Pull Requests

* [2660](AcademySoftwareFoundation/openexr#2660)
  Look for version headers in `CMAKE_CURRENT_SOURCE_DIR/external`  (by @cary-ilm/Cary Phillips)
* [2656](AcademySoftwareFoundation/openexr#2656)
  Bump zstd from 1.5.7.bcr.1 to 1.5.7.bcr.2
* [2655](AcademySoftwareFoundation/openexr#2655)
  Bump rules_cc from 0.2.22 to 0.2.25
* [2654](AcademySoftwareFoundation/openexr#2654)
  Bump required OpenJPH to 0.32.0 (by @cary-ilm/Cary Phillips)
* [2650](AcademySoftwareFoundation/openexr#2650)
  Fix null pointer memcpy in BytesAttribute for zero-length data (by @x4evexnol/babayaga)
* [2648](AcademySoftwareFoundation/openexr#2648)
  Fix DWAB corrupted file (by @vlazar-ilm/Vlad Lazar)
* [2640](AcademySoftwareFoundation/openexr#2640)
  LJ2K: declare the chunk padding in a COM marker segment (by
  @osamu620/Osamu Watanabe)
* [2637](AcademySoftwareFoundation/openexr#2637)
  LJ2K: Use J2K Type 4 NLT LUT to apply the transfer function (by @palemieux/Pierre-Anthony Lemieux)
* [2633](AcademySoftwareFoundation/openexr#2633)
  LJ2K: pad lossy chunks so that wavelet folds stay on low-pass
  positions (by @osamu620/Osamu Watanabe)
* [2627](AcademySoftwareFoundation/openexr#2627)
  Reconsitute compression ctxt cache (by @kdt3rd/Kimball Thurston)
* [2626](AcademySoftwareFoundation/openexr#2626)
  Misc warning cleanup (by @kdt3rd/Kimball Thurston)
* [2625](AcademySoftwareFoundation/openexr#2625)
  Cleanup compression information routines (by @kdt3rd/Kimball Thurston)
* [2623](AcademySoftwareFoundation/openexr#2623)
  Zstd compression support (by @vlazar-ilm/Vlad Lazar)
* [2620](AcademySoftwareFoundation/openexr#2620)
  LJ2K: handle non-finite and out-of-bound samples gracefully (by @palemieux/Pierre-Anthony Lemieux)
* [2618](AcademySoftwareFoundation/openexr#2618)
  Update vendored libdeflate to 1.26 (by @cary-ilm/Cary Phillips)
* [2599](AcademySoftwareFoundation/openexr#2599)
  Add support for loss HTJ2K compressor (LJ2K) (by @palemieux/Pierre-Anthony Lemieux)
* [2581](AcademySoftwareFoundation/openexr#2581)
  Mark AcesInputFile/AcesOutputFile and exr2aces as deprecated (by @cary-ilm/Cary Phillips)
* [2577](AcademySoftwareFoundation/openexr#2577)
  Revert "Add compression context cache (#2440)" (by @cary-ilm/Cary Phillips)
* [2560](AcademySoftwareFoundation/openexr#2560)
  Refine colorInteropID support (by @doug-walker/Doug Walker)
* [2525](AcademySoftwareFoundation/openexr#2525)
  Add check to avoid overflow, add tests for reading / writing many channels (by @kthurston/Kimball Thurston)
* [2453](AcademySoftwareFoundation/openexr#2453)
  Use std::deque for IDManifest storage to keep references stable (by @mshooter-ilm/Moira Shooter)
* [2443](AcademySoftwareFoundation/openexr#2443)
  Fix Imath include on CMake reconfigure (by @cary-ilm/Cary Phillips)
* [2440](AcademySoftwareFoundation/openexr#2440)
  Add compression context cache (by @kdt3rd/Kimball Thurston)
* [2435](AcademySoftwareFoundation/openexr#2435)
  Add setMaxImageSize/setMaxTileSize to python module (by @cary-ilm/Cary Phillips)
* [2432](AcademySoftwareFoundation/openexr#2432)
  Add Python bindings for idManifest (IDManifest) header attribute (by @mshooter-ilm/Moira Shooter)
* [2429](AcademySoftwareFoundation/openexr#2429)
  Check for xSize==0 in gaps fuzzer `part_exceeds_memory_limits` (by @cary-ilm/Cary Phillips)
* [2428](AcademySoftwareFoundation/openexr#2428)
  Add required includes to website examples (by @ijayhub/Ijay)
* [2419](AcademySoftwareFoundation/openexr#2419)
  Impose memory limits in `openexr_exrgaps_fuzzer` (by @cary-ilm/Cary Phillips)
* [2418](AcademySoftwareFoundation/openexr#2418)
  Add support for multithreading in Python module (by @cary-ilm/Cary Phillips)
* [2412](AcademySoftwareFoundation/openexr#2412)
  Ability to read/write from/to BytesIO buffers in Python API (by @mshooter-ilm/Moira Shooter)
* [2401](AcademySoftwareFoundation/openexr#2401)
  test/oss-fuzz: add `openexr_exrgaps_fuzzer` (by @jortles/Anthony Hurtado)
* [2391](AcademySoftwareFoundation/openexr#2391)
  Add new fuzzing harnesses that can be consumed by OSS-Fuzz (by @DavidKorczynski)
* [2384](AcademySoftwareFoundation/openexr#2384)
  Completing ChannelList Iterator API (by @Arcmantis18/ArcMantis)
* [2376](AcademySoftwareFoundation/openexr#2376)
  Include all Imath headers via #include <Imath/...> (by @cary-ilm/Cary Phillips)
* [2369](AcademySoftwareFoundation/openexr#2369)
  Clarify #include policy and make usage consistent (by @cary-ilm/Cary Phillips)
* [2309](AcademySoftwareFoundation/openexr#2309)
  Don't hardcode the python module install dir (by @antonio-rojas/Antonio Rojas)
* [2276](AcademySoftwareFoundation/openexr#2276)
  Build oss-fuzz via oss-fuzz_build.sh (by @cary-ilm/Cary Phillips)
* [2151](AcademySoftwareFoundation/openexr#2151)
  Remove iex_debugTrap() function (by @cary-ilm/Cary Phillips)
* [2143](AcademySoftwareFoundation/openexr#2143)
  Make the release.py generic, so it works with Imath (by @cary-ilm/Cary Phillips)
* [2117](AcademySoftwareFoundation/openexr#2117)
  Bump version on main branch to 4.0.0 (by @cary-ilm/Cary Phillips)

### Documentation Pull Requests

* [2652](AcademySoftwareFoundation/openexr#2652)
  website: improve documentation code and equation formatting (by @QuantaDude/Abhirup Bhattacharyya)
* [2651](AcademySoftwareFoundation/openexr#2651)
  Set 'align: left' for tables that had central text alignment in
  TechnicalIntroduction.rst for better formatting (by @dmitryshurov/Dmitry Shurov)
* [2649](AcademySoftwareFoundation/openexr#2649)
  website: document LJ2K compression (by @QuantaDude/Abhirup Bhattacharyya)
* [2647](AcademySoftwareFoundation/openexr#2647)
  website: compile documentation examples independently (by @QuantaDude/Abhirup Bhattacharyya)
* [2638](AcademySoftwareFoundation/openexr#2638)
  Release notes for v3.5.0 (by @cary-ilm/Cary Phillips)
* [2634](AcademySoftwareFoundation/openexr#2634)
  docs: Fix SECURITY.md formatting (by @lgritz/Larry Gritz)
* [2624](AcademySoftwareFoundation/openexr#2624)
  Release notes and news for v3.4.15, v3.3.14, v3.2.12 (by @cary-ilm/Cary Phillips)
* [2580](AcademySoftwareFoundation/openexr#2580)
  Release notes and news for v3.4.14, v3.3.13, v3.2.11 (by @cary-ilm/Cary Phillips)
* [2549](AcademySoftwareFoundation/openexr#2549)
  Fix broken links identified in ASWF Health Check 2026 (by @cary-ilm/Cary Phillips)
* [2512](AcademySoftwareFoundation/openexr#2512)
  Update security policy regarding CVE requests (by @cary-ilm/Cary Phillips)
* [2501](AcademySoftwareFoundation/openexr#2501)
  Update SECURITY.md with CVE fixes from v3.4.12 and 3.4.13 (by @cary-ilm/Cary Phillips)
* [2497](AcademySoftwareFoundation/openexr#2497)
  Release notes and news for v3.4.13, v3.3.12, and v3.2.10 (by @cary-ilm/Cary Phillips)
* [2322](AcademySoftwareFoundation/openexr#2322)
  news and release notes for v3.4.8 and v3.4.7 (by @cary-ilm/Cary Phillips)
* [2280](AcademySoftwareFoundation/openexr#2280)
  release notes and news for 3.4.6, 3.3.8, and 3.2.6 (by @cary-ilm/Cary Phillips)
* [2275](AcademySoftwareFoundation/openexr#2275)
  Fix install doc to note vendored OpenJPH started with v3.4.6 (by @cary-ilm/Cary Phillips)
* [2203](AcademySoftwareFoundation/openexr#2203)
  V3.4.4 news (by @cary-ilm/Cary Phillips)
* [2195](AcademySoftwareFoundation/openexr#2195)
  Add copyright notices to website example code (by @cary-ilm/Cary Phillips)
* [2172](AcademySoftwareFoundation/openexr#2172)
  release notes and news for v3.4.3, v3.3.6, and 3.2.5 (by @cary-ilm/Cary Phillips)
* [2152](AcademySoftwareFoundation/openexr#2152)
  Release notes and news for v3.4.2 (by @cary-ilm/Cary Phillips)

### Merged Workflow Pull Requests

* [2636](AcademySoftwareFoundation/openexr#2636)
  Bump vmactions/freebsd-vm from 1.5.5 to 1.5.6
* [2635](AcademySoftwareFoundation/openexr#2635)
  Bump the codeql group with 3 updates
* [2631](AcademySoftwareFoundation/openexr#2631)
  Add Windows ARM64 Python wheel CI (by @xieofxie)
* [2630](AcademySoftwareFoundation/openexr#2630)
  Bump pypa/cibuildwheel from 4.2.0 to 4.2.1
* [2576](AcademySoftwareFoundation/openexr#2576)
  Bump pypa/cibuildwheel from 4.1.1 to 4.2.0
* [2559](AcademySoftwareFoundation/openexr#2559)
  Bump pypa/cibuildwheel from 4.1.0 to 4.1.1
* [2537](AcademySoftwareFoundation/openexr#2537)
  Bump the codeql group with 3 updates
* [2523](AcademySoftwareFoundation/openexr#2523)
  Group CodeQL GitHub Actions bumps in Dependabot. (by @cary-ilm/Cary Phillips)
* [2521](AcademySoftwareFoundation/openexr#2521)
  Bump github/codeql-action/init from 4.36.2 to 4.36.3
* [2520](AcademySoftwareFoundation/openexr#2520)
  Bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3
* [2519](AcademySoftwareFoundation/openexr#2519)
  Bump github/codeql-action/analyze from 4.36.2 to 4.36.3
* [2477](AcademySoftwareFoundation/openexr#2477)
  Drop support for Python 3.8 (by @cary-ilm/Cary Phillips)
* [2475](AcademySoftwareFoundation/openexr#2475)
  Bump pypa/cibuildwheel from 3.4.1 to 4.1.0
* [2459](AcademySoftwareFoundation/openexr#2459)
  Bump github/codeql-action from 4.36.0 to 4.36.2
* [2455](AcademySoftwareFoundation/openexr#2455)
  Bump actions/checkout from 6.0.2 to 6.0.3
* [2446](AcademySoftwareFoundation/openexr#2446)
  Bump openjph from 0.27.0 to 0.27.3.bcr.1
* [2410](AcademySoftwareFoundation/openexr#2410)
  Add missing quotes around ENV in src/test/oss-fuzz/CMakeLists.txt (by @cary-ilm/Cary Phillips)
* [2400](AcademySoftwareFoundation/openexr#2400)
  Bump openjph from 0.26.3.bcr.1 to 0.27.0
* [2386](AcademySoftwareFoundation/openexr#2386)
  Bump rules_cc from 0.2.17 to 0.2.18
* [2371](AcademySoftwareFoundation/openexr#2371)
  Bump packaging from 26.0 to 26.1
* [2348](AcademySoftwareFoundation/openexr#2348)
  Bump requests from 2.32.5 to 2.33.0 in /website
* [2347](AcademySoftwareFoundation/openexr#2347)
  Bump pygments from 2.19.2 to 2.20.0 in /website
* [2286](AcademySoftwareFoundation/openexr#2286)
  Bump github/codeql-action from 4.32.4 to 4.32.5
* [2285](AcademySoftwareFoundation/openexr#2285)
  Bump scikit-build-core from 0.11.6 to 0.12.1
* [2284](AcademySoftwareFoundation/openexr#2284)
  Bump jmertic/slack-release-notifier from 5221a45213eddc6206886797beb079e091c93406 to 6fa159048d5313ff1177d248ad84beb627571670
* [2278](AcademySoftwareFoundation/openexr#2278)
  Bump actions/download-artifact from 7.0.0 to 8.0.0
* [2277](AcademySoftwareFoundation/openexr#2277)
  Bump actions/upload-artifact from 6.0.0 to 7.0.0
* [2206](AcademySoftwareFoundation/openexr#2206)
  Bump openjph from 0.25.2 to 0.25.3
* [2179](AcademySoftwareFoundation/openexr#2179)
  Bump readthedocs/actions from 1.2 to 1.5
* [2116](AcademySoftwareFoundation/openexr#2116)
  CI fixes: (by @cary-ilm/Cary Phillips)
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request Oct 13, 2026
@0-wiz-0
openexr: update to 3.5.1.
2ffc82e 
## Version 3.5.1 (September 25, 2026)

Patch release that addresses a security vulnerability in ZSTD:
- fix heap buffer overflow in ZSTD deep scanline decoding

Also, the v3.5.0 release incorrectly identified the
`OPENEXR_VERSION_RELEASE_TYPE` and associated `OPENEXR_PACKAGE_NAME`
as `-dev`.

### Merged Pull Requests

* [2669](AcademySoftwareFoundation/openexr#2669)
  Fix heap buffer overflow in ZSTD deep scanline decoding (by @cary-ilm/Cary Phillips)

## Version 3.5.0 (September 21, 2026)

* Support for lossless compression via
  [Zstandard](https://github.com/facebook/zstd)

  - Introduces `ZSTD_COMPRESSION/EXR_COMPRESSION_ZSTD` enum
  - Features a custom data prep stage that includes ByteShuffle,
    optional Delta Encoding, and custom data reordering.
  - Universal lossless support: Works for all image types (including
    Deep) and supports all OpenEXR pixel/data types.
  - Deep image gains: Extensive testing with Deep scanlines shows a
    20–30% size reduction compared to ZIPS based on image channels
    (with the best gains on Deep Alpha and Deep ID).
  - Flat image file size: Achieves comparable compressed sizes to ZIPS.
  - Flat image speed: Delivers slightly faster compression and
    decompression speeds compared to ZIPS
  - Introduces a new dependency on the zstd library; a vendored
    version (v1.5.7) is provided as a fallback if no installed version
    is present.

* Support for lossy compression based on the High Throughput JPEG 2000
  (HTJ2K) standard.

  - The LJ2K compressor uses the same JPEG 2000 constraints and codec
    library (OpenJPH) as HTJ2K256, but with lossy coding, producing
    smaller files at the cost of distortion.

  - LJ2K should generally offer reduced file sizes and higher
    throughput compared to DWA.

  - Currently supports 16-bit HALF, 32-bit FLOAT and 32-bit UINT
    channels. Lossy coding is currently applied only to RGB channels;
    other channels are losslessly coded.

  - The amount of distortion is controlled via a quality level
    parameter that ranges from 1 to 150.

  - As with DWA, lossy RGB channels are first transformed to a
    non-linear preceptual domain before coding. The transformation is
    log-based when the sample's magnitude is greater than 1, and
    power-law otherwise.

* Improved support for the `colorInteropID` standard attribute as a
  mechanism to identify the color space of the RGB images:

  - Added support for `colorInteropID` to command-line tool `exrstdattr`.
  - Added API functions to validate color metadata in the header to both the C++ and core APIs.
  - Extended the exrinfo command-line tool to print warnings regarding header color metadata.
  - Added helper functions to convert between chromaticities and `colorInteropID`.
  - Added Python bindings for all new functions.
  - See [An ID for Color
    Interop](https://github.com/AcademySoftwareFoundation/ColorInterop/blob/main/Recommendations/03_ColorInteropID/ColorInteropID.md)
    and [Identifying the Color Space of OpenEXR
    Files](https://github.com/AcademySoftwareFoundation/ColorInterop/blob/main/Recommendations/04_OpenEXRFiles/OpenEXRFiles.md)
    for details.

* Support for a cache for a (de)compression context in the core decode pipeline.

  - This is a backwards compatible change (i.e. older versions of code
    compiled against previous headers will still work), with the
    exception that it does add the requirement that application code
    actually use the provided initializer when defining
    `exr_decode_pipeline_t` objects.

* For the OpenEXR python module:
  - Support for the `idManifest` attribute and object
  - Support for multithreaded read and write
  - Support for reading/writing from/to `BytesIO` object
  - Add `setMaxImageSize/setMaxTileSize` functions

* Other changes:

  - `AcesInputFile/AcesOutputFile` and `exr2aces` as marked as
    deprecated and will be removed in a future release.
  - Improved handling of many channels
  - All Imath headers are now included internally via `#include <Imath/...>`
  - Remove `iex_debugTrap()` function (was not used)
  - Improved `ChannelList` Iterator API
  - Fixed a bug that with DWA compression that could silently produce
    corrupted files.

* Also of note:

  - The vendored version of deflate is 1.26
  - The vendored version of OpenJPH is 0.32.0
  - The minimum required version of OpenJPH is 0.32.0

### Security

This release addresses the following security vulnerabilities:

* OSS-Fuzz [514487287](https://issues.oss-fuzz.com/issues/514487287)
  Floating-point-exception in `part_exceeds_memory_limits`
* OSS-Fuzz [514423826](https://issues.oss-fuzz.com/issues/514423826)
  Divide-by-zero in `part_exceeds_memory_limits`
* OSS-Fuzz [513282267](https://issues.oss-fuzz.com/issues/513282267)
  Timeout in `openexr_exrgaps_fuzzer`
* OSS-Fuzz [512988066](https://issues.oss-fuzz.com/issues/512988066)
  Out-of-memory in `openexr_exrgaps_fuzzer`

### Merged Pull Requests

* [2660](AcademySoftwareFoundation/openexr#2660)
  Look for version headers in `CMAKE_CURRENT_SOURCE_DIR/external`  (by @cary-ilm/Cary Phillips)
* [2656](AcademySoftwareFoundation/openexr#2656)
  Bump zstd from 1.5.7.bcr.1 to 1.5.7.bcr.2
* [2655](AcademySoftwareFoundation/openexr#2655)
  Bump rules_cc from 0.2.22 to 0.2.25
* [2654](AcademySoftwareFoundation/openexr#2654)
  Bump required OpenJPH to 0.32.0 (by @cary-ilm/Cary Phillips)
* [2650](AcademySoftwareFoundation/openexr#2650)
  Fix null pointer memcpy in BytesAttribute for zero-length data (by @x4evexnol/babayaga)
* [2648](AcademySoftwareFoundation/openexr#2648)
  Fix DWAB corrupted file (by @vlazar-ilm/Vlad Lazar)
* [2640](AcademySoftwareFoundation/openexr#2640)
  LJ2K: declare the chunk padding in a COM marker segment (by
  @osamu620/Osamu Watanabe)
* [2637](AcademySoftwareFoundation/openexr#2637)
  LJ2K: Use J2K Type 4 NLT LUT to apply the transfer function (by @palemieux/Pierre-Anthony Lemieux)
* [2633](AcademySoftwareFoundation/openexr#2633)
  LJ2K: pad lossy chunks so that wavelet folds stay on low-pass
  positions (by @osamu620/Osamu Watanabe)
* [2627](AcademySoftwareFoundation/openexr#2627)
  Reconsitute compression ctxt cache (by @kdt3rd/Kimball Thurston)
* [2626](AcademySoftwareFoundation/openexr#2626)
  Misc warning cleanup (by @kdt3rd/Kimball Thurston)
* [2625](AcademySoftwareFoundation/openexr#2625)
  Cleanup compression information routines (by @kdt3rd/Kimball Thurston)
* [2623](AcademySoftwareFoundation/openexr#2623)
  Zstd compression support (by @vlazar-ilm/Vlad Lazar)
* [2620](AcademySoftwareFoundation/openexr#2620)
  LJ2K: handle non-finite and out-of-bound samples gracefully (by @palemieux/Pierre-Anthony Lemieux)
* [2618](AcademySoftwareFoundation/openexr#2618)
  Update vendored libdeflate to 1.26 (by @cary-ilm/Cary Phillips)
* [2599](AcademySoftwareFoundation/openexr#2599)
  Add support for loss HTJ2K compressor (LJ2K) (by @palemieux/Pierre-Anthony Lemieux)
* [2581](AcademySoftwareFoundation/openexr#2581)
  Mark AcesInputFile/AcesOutputFile and exr2aces as deprecated (by @cary-ilm/Cary Phillips)
* [2577](AcademySoftwareFoundation/openexr#2577)
  Revert "Add compression context cache (#2440)" (by @cary-ilm/Cary Phillips)
* [2560](AcademySoftwareFoundation/openexr#2560)
  Refine colorInteropID support (by @doug-walker/Doug Walker)
* [2525](AcademySoftwareFoundation/openexr#2525)
  Add check to avoid overflow, add tests for reading / writing many channels (by @kthurston/Kimball Thurston)
* [2453](AcademySoftwareFoundation/openexr#2453)
  Use std::deque for IDManifest storage to keep references stable (by @mshooter-ilm/Moira Shooter)
* [2443](AcademySoftwareFoundation/openexr#2443)
  Fix Imath include on CMake reconfigure (by @cary-ilm/Cary Phillips)
* [2440](AcademySoftwareFoundation/openexr#2440)
  Add compression context cache (by @kdt3rd/Kimball Thurston)
* [2435](AcademySoftwareFoundation/openexr#2435)
  Add setMaxImageSize/setMaxTileSize to python module (by @cary-ilm/Cary Phillips)
* [2432](AcademySoftwareFoundation/openexr#2432)
  Add Python bindings for idManifest (IDManifest) header attribute (by @mshooter-ilm/Moira Shooter)
* [2429](AcademySoftwareFoundation/openexr#2429)
  Check for xSize==0 in gaps fuzzer `part_exceeds_memory_limits` (by @cary-ilm/Cary Phillips)
* [2428](AcademySoftwareFoundation/openexr#2428)
  Add required includes to website examples (by @ijayhub/Ijay)
* [2419](AcademySoftwareFoundation/openexr#2419)
  Impose memory limits in `openexr_exrgaps_fuzzer` (by @cary-ilm/Cary Phillips)
* [2418](AcademySoftwareFoundation/openexr#2418)
  Add support for multithreading in Python module (by @cary-ilm/Cary Phillips)
* [2412](AcademySoftwareFoundation/openexr#2412)
  Ability to read/write from/to BytesIO buffers in Python API (by @mshooter-ilm/Moira Shooter)
* [2401](AcademySoftwareFoundation/openexr#2401)
  test/oss-fuzz: add `openexr_exrgaps_fuzzer` (by @jortles/Anthony Hurtado)
* [2391](AcademySoftwareFoundation/openexr#2391)
  Add new fuzzing harnesses that can be consumed by OSS-Fuzz (by @DavidKorczynski)
* [2384](AcademySoftwareFoundation/openexr#2384)
  Completing ChannelList Iterator API (by @Arcmantis18/ArcMantis)
* [2376](AcademySoftwareFoundation/openexr#2376)
  Include all Imath headers via #include <Imath/...> (by @cary-ilm/Cary Phillips)
* [2369](AcademySoftwareFoundation/openexr#2369)
  Clarify #include policy and make usage consistent (by @cary-ilm/Cary Phillips)
* [2309](AcademySoftwareFoundation/openexr#2309)
  Don't hardcode the python module install dir (by @antonio-rojas/Antonio Rojas)
* [2276](AcademySoftwareFoundation/openexr#2276)
  Build oss-fuzz via oss-fuzz_build.sh (by @cary-ilm/Cary Phillips)
* [2151](AcademySoftwareFoundation/openexr#2151)
  Remove iex_debugTrap() function (by @cary-ilm/Cary Phillips)
* [2143](AcademySoftwareFoundation/openexr#2143)
  Make the release.py generic, so it works with Imath (by @cary-ilm/Cary Phillips)
* [2117](AcademySoftwareFoundation/openexr#2117)
  Bump version on main branch to 4.0.0 (by @cary-ilm/Cary Phillips)

### Documentation Pull Requests

* [2652](AcademySoftwareFoundation/openexr#2652)
  website: improve documentation code and equation formatting (by @QuantaDude/Abhirup Bhattacharyya)
* [2651](AcademySoftwareFoundation/openexr#2651)
  Set 'align: left' for tables that had central text alignment in
  TechnicalIntroduction.rst for better formatting (by @dmitryshurov/Dmitry Shurov)
* [2649](AcademySoftwareFoundation/openexr#2649)
  website: document LJ2K compression (by @QuantaDude/Abhirup Bhattacharyya)
* [2647](AcademySoftwareFoundation/openexr#2647)
  website: compile documentation examples independently (by @QuantaDude/Abhirup Bhattacharyya)
* [2638](AcademySoftwareFoundation/openexr#2638)
  Release notes for v3.5.0 (by @cary-ilm/Cary Phillips)
* [2634](AcademySoftwareFoundation/openexr#2634)
  docs: Fix SECURITY.md formatting (by @lgritz/Larry Gritz)
* [2624](AcademySoftwareFoundation/openexr#2624)
  Release notes and news for v3.4.15, v3.3.14, v3.2.12 (by @cary-ilm/Cary Phillips)
* [2580](AcademySoftwareFoundation/openexr#2580)
  Release notes and news for v3.4.14, v3.3.13, v3.2.11 (by @cary-ilm/Cary Phillips)
* [2549](AcademySoftwareFoundation/openexr#2549)
  Fix broken links identified in ASWF Health Check 2026 (by @cary-ilm/Cary Phillips)
* [2512](AcademySoftwareFoundation/openexr#2512)
  Update security policy regarding CVE requests (by @cary-ilm/Cary Phillips)
* [2501](AcademySoftwareFoundation/openexr#2501)
  Update SECURITY.md with CVE fixes from v3.4.12 and 3.4.13 (by @cary-ilm/Cary Phillips)
* [2497](AcademySoftwareFoundation/openexr#2497)
  Release notes and news for v3.4.13, v3.3.12, and v3.2.10 (by @cary-ilm/Cary Phillips)
* [2322](AcademySoftwareFoundation/openexr#2322)
  news and release notes for v3.4.8 and v3.4.7 (by @cary-ilm/Cary Phillips)
* [2280](AcademySoftwareFoundation/openexr#2280)
  release notes and news for 3.4.6, 3.3.8, and 3.2.6 (by @cary-ilm/Cary Phillips)
* [2275](AcademySoftwareFoundation/openexr#2275)
  Fix install doc to note vendored OpenJPH started with v3.4.6 (by @cary-ilm/Cary Phillips)
* [2203](AcademySoftwareFoundation/openexr#2203)
  V3.4.4 news (by @cary-ilm/Cary Phillips)
* [2195](AcademySoftwareFoundation/openexr#2195)
  Add copyright notices to website example code (by @cary-ilm/Cary Phillips)
* [2172](AcademySoftwareFoundation/openexr#2172)
  release notes and news for v3.4.3, v3.3.6, and 3.2.5 (by @cary-ilm/Cary Phillips)
* [2152](AcademySoftwareFoundation/openexr#2152)
  Release notes and news for v3.4.2 (by @cary-ilm/Cary Phillips)

### Merged Workflow Pull Requests

* [2636](AcademySoftwareFoundation/openexr#2636)
  Bump vmactions/freebsd-vm from 1.5.5 to 1.5.6
* [2635](AcademySoftwareFoundation/openexr#2635)
  Bump the codeql group with 3 updates
* [2631](AcademySoftwareFoundation/openexr#2631)
  Add Windows ARM64 Python wheel CI (by @xieofxie)
* [2630](AcademySoftwareFoundation/openexr#2630)
  Bump pypa/cibuildwheel from 4.2.0 to 4.2.1
* [2576](AcademySoftwareFoundation/openexr#2576)
  Bump pypa/cibuildwheel from 4.1.1 to 4.2.0
* [2559](AcademySoftwareFoundation/openexr#2559)
  Bump pypa/cibuildwheel from 4.1.0 to 4.1.1
* [2537](AcademySoftwareFoundation/openexr#2537)
  Bump the codeql group with 3 updates
* [2523](AcademySoftwareFoundation/openexr#2523)
  Group CodeQL GitHub Actions bumps in Dependabot. (by @cary-ilm/Cary Phillips)
* [2521](AcademySoftwareFoundation/openexr#2521)
  Bump github/codeql-action/init from 4.36.2 to 4.36.3
* [2520](AcademySoftwareFoundation/openexr#2520)
  Bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3
* [2519](AcademySoftwareFoundation/openexr#2519)
  Bump github/codeql-action/analyze from 4.36.2 to 4.36.3
* [2477](AcademySoftwareFoundation/openexr#2477)
  Drop support for Python 3.8 (by @cary-ilm/Cary Phillips)
* [2475](AcademySoftwareFoundation/openexr#2475)
  Bump pypa/cibuildwheel from 3.4.1 to 4.1.0
* [2459](AcademySoftwareFoundation/openexr#2459)
  Bump github/codeql-action from 4.36.0 to 4.36.2
* [2455](AcademySoftwareFoundation/openexr#2455)
  Bump actions/checkout from 6.0.2 to 6.0.3
* [2446](AcademySoftwareFoundation/openexr#2446)
  Bump openjph from 0.27.0 to 0.27.3.bcr.1
* [2410](AcademySoftwareFoundation/openexr#2410)
  Add missing quotes around ENV in src/test/oss-fuzz/CMakeLists.txt (by @cary-ilm/Cary Phillips)
* [2400](AcademySoftwareFoundation/openexr#2400)
  Bump openjph from 0.26.3.bcr.1 to 0.27.0
* [2386](AcademySoftwareFoundation/openexr#2386)
  Bump rules_cc from 0.2.17 to 0.2.18
* [2371](AcademySoftwareFoundation/openexr#2371)
  Bump packaging from 26.0 to 26.1
* [2348](AcademySoftwareFoundation/openexr#2348)
  Bump requests from 2.32.5 to 2.33.0 in /website
* [2347](AcademySoftwareFoundation/openexr#2347)
  Bump pygments from 2.19.2 to 2.20.0 in /website
* [2286](AcademySoftwareFoundation/openexr#2286)
  Bump github/codeql-action from 4.32.4 to 4.32.5
* [2285](AcademySoftwareFoundation/openexr#2285)
  Bump scikit-build-core from 0.11.6 to 0.12.1
* [2284](AcademySoftwareFoundation/openexr#2284)
  Bump jmertic/slack-release-notifier from 5221a45213eddc6206886797beb079e091c93406 to 6fa159048d5313ff1177d248ad84beb627571670
* [2278](AcademySoftwareFoundation/openexr#2278)
  Bump actions/download-artifact from 7.0.0 to 8.0.0
* [2277](AcademySoftwareFoundation/openexr#2277)
  Bump actions/upload-artifact from 6.0.0 to 7.0.0
* [2206](AcademySoftwareFoundation/openexr#2206)
  Bump openjph from 0.25.2 to 0.25.3
* [2179](AcademySoftwareFoundation/openexr#2179)
  Bump readthedocs/actions from 1.2 to 1.5
* [2116](AcademySoftwareFoundation/openexr#2116)
  CI fixes: (by @cary-ilm/Cary Phillips)
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request Oct 21, 2026
@0-wiz-0
openexr: update to 3.5.1.
081944a 
## Version 3.5.1 (September 25, 2026)

Patch release that addresses a security vulnerability in ZSTD:
- fix heap buffer overflow in ZSTD deep scanline decoding

Also, the v3.5.0 release incorrectly identified the
`OPENEXR_VERSION_RELEASE_TYPE` and associated `OPENEXR_PACKAGE_NAME`
as `-dev`.

### Merged Pull Requests

* [2669](AcademySoftwareFoundation/openexr#2669)
  Fix heap buffer overflow in ZSTD deep scanline decoding (by @cary-ilm/Cary Phillips)

## Version 3.5.0 (September 21, 2026)

* Support for lossless compression via
  [Zstandard](https://github.com/facebook/zstd)

  - Introduces `ZSTD_COMPRESSION/EXR_COMPRESSION_ZSTD` enum
  - Features a custom data prep stage that includes ByteShuffle,
    optional Delta Encoding, and custom data reordering.
  - Universal lossless support: Works for all image types (including
    Deep) and supports all OpenEXR pixel/data types.
  - Deep image gains: Extensive testing with Deep scanlines shows a
    20–30% size reduction compared to ZIPS based on image channels
    (with the best gains on Deep Alpha and Deep ID).
  - Flat image file size: Achieves comparable compressed sizes to ZIPS.
  - Flat image speed: Delivers slightly faster compression and
    decompression speeds compared to ZIPS
  - Introduces a new dependency on the zstd library; a vendored
    version (v1.5.7) is provided as a fallback if no installed version
    is present.

* Support for lossy compression based on the High Throughput JPEG 2000
  (HTJ2K) standard.

  - The LJ2K compressor uses the same JPEG 2000 constraints and codec
    library (OpenJPH) as HTJ2K256, but with lossy coding, producing
    smaller files at the cost of distortion.

  - LJ2K should generally offer reduced file sizes and higher
    throughput compared to DWA.

  - Currently supports 16-bit HALF, 32-bit FLOAT and 32-bit UINT
    channels. Lossy coding is currently applied only to RGB channels;
    other channels are losslessly coded.

  - The amount of distortion is controlled via a quality level
    parameter that ranges from 1 to 150.

  - As with DWA, lossy RGB channels are first transformed to a
    non-linear preceptual domain before coding. The transformation is
    log-based when the sample's magnitude is greater than 1, and
    power-law otherwise.

* Improved support for the `colorInteropID` standard attribute as a
  mechanism to identify the color space of the RGB images:

  - Added support for `colorInteropID` to command-line tool `exrstdattr`.
  - Added API functions to validate color metadata in the header to both the C++ and core APIs.
  - Extended the exrinfo command-line tool to print warnings regarding header color metadata.
  - Added helper functions to convert between chromaticities and `colorInteropID`.
  - Added Python bindings for all new functions.
  - See [An ID for Color
    Interop](https://github.com/AcademySoftwareFoundation/ColorInterop/blob/main/Recommendations/03_ColorInteropID/ColorInteropID.md)
    and [Identifying the Color Space of OpenEXR
    Files](https://github.com/AcademySoftwareFoundation/ColorInterop/blob/main/Recommendations/04_OpenEXRFiles/OpenEXRFiles.md)
    for details.

* Support for a cache for a (de)compression context in the core decode pipeline.

  - This is a backwards compatible change (i.e. older versions of code
    compiled against previous headers will still work), with the
    exception that it does add the requirement that application code
    actually use the provided initializer when defining
    `exr_decode_pipeline_t` objects.

* For the OpenEXR python module:
  - Support for the `idManifest` attribute and object
  - Support for multithreaded read and write
  - Support for reading/writing from/to `BytesIO` object
  - Add `setMaxImageSize/setMaxTileSize` functions

* Other changes:

  - `AcesInputFile/AcesOutputFile` and `exr2aces` as marked as
    deprecated and will be removed in a future release.
  - Improved handling of many channels
  - All Imath headers are now included internally via `#include <Imath/...>`
  - Remove `iex_debugTrap()` function (was not used)
  - Improved `ChannelList` Iterator API
  - Fixed a bug that with DWA compression that could silently produce
    corrupted files.

* Also of note:

  - The vendored version of deflate is 1.26
  - The vendored version of OpenJPH is 0.32.0
  - The minimum required version of OpenJPH is 0.32.0

### Security

This release addresses the following security vulnerabilities:

* OSS-Fuzz [514487287](https://issues.oss-fuzz.com/issues/514487287)
  Floating-point-exception in `part_exceeds_memory_limits`
* OSS-Fuzz [514423826](https://issues.oss-fuzz.com/issues/514423826)
  Divide-by-zero in `part_exceeds_memory_limits`
* OSS-Fuzz [513282267](https://issues.oss-fuzz.com/issues/513282267)
  Timeout in `openexr_exrgaps_fuzzer`
* OSS-Fuzz [512988066](https://issues.oss-fuzz.com/issues/512988066)
  Out-of-memory in `openexr_exrgaps_fuzzer`

### Merged Pull Requests

* [2660](AcademySoftwareFoundation/openexr#2660)
  Look for version headers in `CMAKE_CURRENT_SOURCE_DIR/external`  (by @cary-ilm/Cary Phillips)
* [2656](AcademySoftwareFoundation/openexr#2656)
  Bump zstd from 1.5.7.bcr.1 to 1.5.7.bcr.2
* [2655](AcademySoftwareFoundation/openexr#2655)
  Bump rules_cc from 0.2.22 to 0.2.25
* [2654](AcademySoftwareFoundation/openexr#2654)
  Bump required OpenJPH to 0.32.0 (by @cary-ilm/Cary Phillips)
* [2650](AcademySoftwareFoundation/openexr#2650)
  Fix null pointer memcpy in BytesAttribute for zero-length data (by @x4evexnol/babayaga)
* [2648](AcademySoftwareFoundation/openexr#2648)
  Fix DWAB corrupted file (by @vlazar-ilm/Vlad Lazar)
* [2640](AcademySoftwareFoundation/openexr#2640)
  LJ2K: declare the chunk padding in a COM marker segment (by
  @osamu620/Osamu Watanabe)
* [2637](AcademySoftwareFoundation/openexr#2637)
  LJ2K: Use J2K Type 4 NLT LUT to apply the transfer function (by @palemieux/Pierre-Anthony Lemieux)
* [2633](AcademySoftwareFoundation/openexr#2633)
  LJ2K: pad lossy chunks so that wavelet folds stay on low-pass
  positions (by @osamu620/Osamu Watanabe)
* [2627](AcademySoftwareFoundation/openexr#2627)
  Reconsitute compression ctxt cache (by @kdt3rd/Kimball Thurston)
* [2626](AcademySoftwareFoundation/openexr#2626)
  Misc warning cleanup (by @kdt3rd/Kimball Thurston)
* [2625](AcademySoftwareFoundation/openexr#2625)
  Cleanup compression information routines (by @kdt3rd/Kimball Thurston)
* [2623](AcademySoftwareFoundation/openexr#2623)
  Zstd compression support (by @vlazar-ilm/Vlad Lazar)
* [2620](AcademySoftwareFoundation/openexr#2620)
  LJ2K: handle non-finite and out-of-bound samples gracefully (by @palemieux/Pierre-Anthony Lemieux)
* [2618](AcademySoftwareFoundation/openexr#2618)
  Update vendored libdeflate to 1.26 (by @cary-ilm/Cary Phillips)
* [2599](AcademySoftwareFoundation/openexr#2599)
  Add support for loss HTJ2K compressor (LJ2K) (by @palemieux/Pierre-Anthony Lemieux)
* [2581](AcademySoftwareFoundation/openexr#2581)
  Mark AcesInputFile/AcesOutputFile and exr2aces as deprecated (by @cary-ilm/Cary Phillips)
* [2577](AcademySoftwareFoundation/openexr#2577)
  Revert "Add compression context cache (#2440)" (by @cary-ilm/Cary Phillips)
* [2560](AcademySoftwareFoundation/openexr#2560)
  Refine colorInteropID support (by @doug-walker/Doug Walker)
* [2525](AcademySoftwareFoundation/openexr#2525)
  Add check to avoid overflow, add tests for reading / writing many channels (by @kthurston/Kimball Thurston)
* [2453](AcademySoftwareFoundation/openexr#2453)
  Use std::deque for IDManifest storage to keep references stable (by @mshooter-ilm/Moira Shooter)
* [2443](AcademySoftwareFoundation/openexr#2443)
  Fix Imath include on CMake reconfigure (by @cary-ilm/Cary Phillips)
* [2440](AcademySoftwareFoundation/openexr#2440)
  Add compression context cache (by @kdt3rd/Kimball Thurston)
* [2435](AcademySoftwareFoundation/openexr#2435)
  Add setMaxImageSize/setMaxTileSize to python module (by @cary-ilm/Cary Phillips)
* [2432](AcademySoftwareFoundation/openexr#2432)
  Add Python bindings for idManifest (IDManifest) header attribute (by @mshooter-ilm/Moira Shooter)
* [2429](AcademySoftwareFoundation/openexr#2429)
  Check for xSize==0 in gaps fuzzer `part_exceeds_memory_limits` (by @cary-ilm/Cary Phillips)
* [2428](AcademySoftwareFoundation/openexr#2428)
  Add required includes to website examples (by @ijayhub/Ijay)
* [2419](AcademySoftwareFoundation/openexr#2419)
  Impose memory limits in `openexr_exrgaps_fuzzer` (by @cary-ilm/Cary Phillips)
* [2418](AcademySoftwareFoundation/openexr#2418)
  Add support for multithreading in Python module (by @cary-ilm/Cary Phillips)
* [2412](AcademySoftwareFoundation/openexr#2412)
  Ability to read/write from/to BytesIO buffers in Python API (by @mshooter-ilm/Moira Shooter)
* [2401](AcademySoftwareFoundation/openexr#2401)
  test/oss-fuzz: add `openexr_exrgaps_fuzzer` (by @jortles/Anthony Hurtado)
* [2391](AcademySoftwareFoundation/openexr#2391)
  Add new fuzzing harnesses that can be consumed by OSS-Fuzz (by @DavidKorczynski)
* [2384](AcademySoftwareFoundation/openexr#2384)
  Completing ChannelList Iterator API (by @Arcmantis18/ArcMantis)
* [2376](AcademySoftwareFoundation/openexr#2376)
  Include all Imath headers via #include <Imath/...> (by @cary-ilm/Cary Phillips)
* [2369](AcademySoftwareFoundation/openexr#2369)
  Clarify #include policy and make usage consistent (by @cary-ilm/Cary Phillips)
* [2309](AcademySoftwareFoundation/openexr#2309)
  Don't hardcode the python module install dir (by @antonio-rojas/Antonio Rojas)
* [2276](AcademySoftwareFoundation/openexr#2276)
  Build oss-fuzz via oss-fuzz_build.sh (by @cary-ilm/Cary Phillips)
* [2151](AcademySoftwareFoundation/openexr#2151)
  Remove iex_debugTrap() function (by @cary-ilm/Cary Phillips)
* [2143](AcademySoftwareFoundation/openexr#2143)
  Make the release.py generic, so it works with Imath (by @cary-ilm/Cary Phillips)
* [2117](AcademySoftwareFoundation/openexr#2117)
  Bump version on main branch to 4.0.0 (by @cary-ilm/Cary Phillips)

### Documentation Pull Requests

* [2652](AcademySoftwareFoundation/openexr#2652)
  website: improve documentation code and equation formatting (by @QuantaDude/Abhirup Bhattacharyya)
* [2651](AcademySoftwareFoundation/openexr#2651)
  Set 'align: left' for tables that had central text alignment in
  TechnicalIntroduction.rst for better formatting (by @dmitryshurov/Dmitry Shurov)
* [2649](AcademySoftwareFoundation/openexr#2649)
  website: document LJ2K compression (by @QuantaDude/Abhirup Bhattacharyya)
* [2647](AcademySoftwareFoundation/openexr#2647)
  website: compile documentation examples independently (by @QuantaDude/Abhirup Bhattacharyya)
* [2638](AcademySoftwareFoundation/openexr#2638)
  Release notes for v3.5.0 (by @cary-ilm/Cary Phillips)
* [2634](AcademySoftwareFoundation/openexr#2634)
  docs: Fix SECURITY.md formatting (by @lgritz/Larry Gritz)
* [2624](AcademySoftwareFoundation/openexr#2624)
  Release notes and news for v3.4.15, v3.3.14, v3.2.12 (by @cary-ilm/Cary Phillips)
* [2580](AcademySoftwareFoundation/openexr#2580)
  Release notes and news for v3.4.14, v3.3.13, v3.2.11 (by @cary-ilm/Cary Phillips)
* [2549](AcademySoftwareFoundation/openexr#2549)
  Fix broken links identified in ASWF Health Check 2026 (by @cary-ilm/Cary Phillips)
* [2512](AcademySoftwareFoundation/openexr#2512)
  Update security policy regarding CVE requests (by @cary-ilm/Cary Phillips)
* [2501](AcademySoftwareFoundation/openexr#2501)
  Update SECURITY.md with CVE fixes from v3.4.12 and 3.4.13 (by @cary-ilm/Cary Phillips)
* [2497](AcademySoftwareFoundation/openexr#2497)
  Release notes and news for v3.4.13, v3.3.12, and v3.2.10 (by @cary-ilm/Cary Phillips)
* [2322](AcademySoftwareFoundation/openexr#2322)
  news and release notes for v3.4.8 and v3.4.7 (by @cary-ilm/Cary Phillips)
* [2280](AcademySoftwareFoundation/openexr#2280)
  release notes and news for 3.4.6, 3.3.8, and 3.2.6 (by @cary-ilm/Cary Phillips)
* [2275](AcademySoftwareFoundation/openexr#2275)
  Fix install doc to note vendored OpenJPH started with v3.4.6 (by @cary-ilm/Cary Phillips)
* [2203](AcademySoftwareFoundation/openexr#2203)
  V3.4.4 news (by @cary-ilm/Cary Phillips)
* [2195](AcademySoftwareFoundation/openexr#2195)
  Add copyright notices to website example code (by @cary-ilm/Cary Phillips)
* [2172](AcademySoftwareFoundation/openexr#2172)
  release notes and news for v3.4.3, v3.3.6, and 3.2.5 (by @cary-ilm/Cary Phillips)
* [2152](AcademySoftwareFoundation/openexr#2152)
  Release notes and news for v3.4.2 (by @cary-ilm/Cary Phillips)

### Merged Workflow Pull Requests

* [2636](AcademySoftwareFoundation/openexr#2636)
  Bump vmactions/freebsd-vm from 1.5.5 to 1.5.6
* [2635](AcademySoftwareFoundation/openexr#2635)
  Bump the codeql group with 3 updates
* [2631](AcademySoftwareFoundation/openexr#2631)
  Add Windows ARM64 Python wheel CI (by @xieofxie)
* [2630](AcademySoftwareFoundation/openexr#2630)
  Bump pypa/cibuildwheel from 4.2.0 to 4.2.1
* [2576](AcademySoftwareFoundation/openexr#2576)
  Bump pypa/cibuildwheel from 4.1.1 to 4.2.0
* [2559](AcademySoftwareFoundation/openexr#2559)
  Bump pypa/cibuildwheel from 4.1.0 to 4.1.1
* [2537](AcademySoftwareFoundation/openexr#2537)
  Bump the codeql group with 3 updates
* [2523](AcademySoftwareFoundation/openexr#2523)
  Group CodeQL GitHub Actions bumps in Dependabot. (by @cary-ilm/Cary Phillips)
* [2521](AcademySoftwareFoundation/openexr#2521)
  Bump github/codeql-action/init from 4.36.2 to 4.36.3
* [2520](AcademySoftwareFoundation/openexr#2520)
  Bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3
* [2519](AcademySoftwareFoundation/openexr#2519)
  Bump github/codeql-action/analyze from 4.36.2 to 4.36.3
* [2477](AcademySoftwareFoundation/openexr#2477)
  Drop support for Python 3.8 (by @cary-ilm/Cary Phillips)
* [2475](AcademySoftwareFoundation/openexr#2475)
  Bump pypa/cibuildwheel from 3.4.1 to 4.1.0
* [2459](AcademySoftwareFoundation/openexr#2459)
  Bump github/codeql-action from 4.36.0 to 4.36.2
* [2455](AcademySoftwareFoundation/openexr#2455)
  Bump actions/checkout from 6.0.2 to 6.0.3
* [2446](AcademySoftwareFoundation/openexr#2446)
  Bump openjph from 0.27.0 to 0.27.3.bcr.1
* [2410](AcademySoftwareFoundation/openexr#2410)
  Add missing quotes around ENV in src/test/oss-fuzz/CMakeLists.txt (by @cary-ilm/Cary Phillips)
* [2400](AcademySoftwareFoundation/openexr#2400)
  Bump openjph from 0.26.3.bcr.1 to 0.27.0
* [2386](AcademySoftwareFoundation/openexr#2386)
  Bump rules_cc from 0.2.17 to 0.2.18
* [2371](AcademySoftwareFoundation/openexr#2371)
  Bump packaging from 26.0 to 26.1
* [2348](AcademySoftwareFoundation/openexr#2348)
  Bump requests from 2.32.5 to 2.33.0 in /website
* [2347](AcademySoftwareFoundation/openexr#2347)
  Bump pygments from 2.19.2 to 2.20.0 in /website
* [2286](AcademySoftwareFoundation/openexr#2286)
  Bump github/codeql-action from 4.32.4 to 4.32.5
* [2285](AcademySoftwareFoundation/openexr#2285)
  Bump scikit-build-core from 0.11.6 to 0.12.1
* [2284](AcademySoftwareFoundation/openexr#2284)
  Bump jmertic/slack-release-notifier from 5221a45213eddc6206886797beb079e091c93406 to 6fa159048d5313ff1177d248ad84beb627571670
* [2278](AcademySoftwareFoundation/openexr#2278)
  Bump actions/download-artifact from 7.0.0 to 8.0.0
* [2277](AcademySoftwareFoundation/openexr#2277)
  Bump actions/upload-artifact from 6.0.0 to 7.0.0
* [2206](AcademySoftwareFoundation/openexr#2206)
  Bump openjph from 0.25.2 to 0.25.3
* [2179](AcademySoftwareFoundation/openexr#2179)
  Bump readthedocs/actions from 1.2 to 1.5
* [2116](AcademySoftwareFoundation/openexr#2116)
  CI fixes: (by @cary-ilm/Cary Phillips)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cary-ilm cary-ilm cary-ilm approved these changes
+1 more reviewer
@Vertexwahn Vertexwahn Vertexwahn approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

bazel Pull requests that update bazel code dependencies Pull requests that update a dependency file v3.5.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Vertexwahn @cary-ilm