Skip to content

Fix heap buffer overflow in ZSTD deep scanline decoding - #2669

Merged
cary-ilm merged 1 commit into
AcademySoftwareFoundation:mainfrom
cary-ilm:GHSA-46h4-rxjp-q3rq
Sep 23, 2026
Merged

Fix heap buffer overflow in ZSTD deep scanline decoding#2669
cary-ilm merged 1 commit into
AcademySoftwareFoundation:mainfrom
cary-ilm:GHSA-46h4-rxjp-q3rq

Conversation

@cary-ilm

@cary-ilm cary-ilm commented Sep 23, 2026

Copy link
Copy Markdown
Member

A crafted deep-scanline EXR file using ZSTD compression could make OpenEXRCore write beyond a heap allocation during decompression.

exr_undo_zstd_v1() computed split from the (separately validated) sample-count table but never checked it against uncompressed_size, which is taken directly from the file's chunk leader. exr_zstd_segment_layout() then used split as the length of the first inner segment, and that length was written into decode->scratch_buffer_1, which is allocated using only uncompressed_size. A file that keeps the sample-count table and compressed payload valid while declaring a smaller unpacked_size in the chunk leader could make the derived segment length exceed the allocation, causing an out-of-bounds heap write.

Fix by rejecting the chunk when split > uncompressed_size before deriving segment lengths, and by having
zstd_inner_read_shuffled_segment() take and enforce the destination's remaining capacity as defense in depth.

Addresses GHSA-46h4-rxjp-q3rq

Assisted-by: Copilot/Claude Sonnet 5

@cary-ilm
Fix heap buffer overflow in ZSTD deep scanline decoding
82222a4 
A crafted deep-scanline EXR file using ZSTD compression could make
OpenEXRCore write beyond a heap allocation during decompression.

exr_undo_zstd_v1() computed `split` from the (separately validated)
sample-count table but never checked it against `uncompressed_size`,
which is taken directly from the file's chunk leader. exr_zstd_segment_layout()
then used `split` as the length of the first inner segment, and that
length was written into decode->scratch_buffer_1, which is allocated
using only uncompressed_size. A file that keeps the sample-count table
and compressed payload valid while declaring a smaller unpacked_size in
the chunk leader could make the derived segment length exceed the
allocation, causing an out-of-bounds heap write.

Fix by rejecting the chunk when split > uncompressed_size before
deriving segment lengths, and by having
zstd_inner_read_shuffled_segment() take and enforce the destination's
remaining capacity as defense in depth.

Addresses GHSA-46h4-rxjp-q3rq

Assisted-by: Copilot/Claude Sonnet 5

Signed-off-by: Cary Phillips <seabeepea@gmail.com>
@vlazar-ilm

vlazar-ilm commented Sep 23, 2026

Copy link
Copy Markdown
Contributor

Looking great. Nice and simple fix.
Thanks.

@cary-ilm
cary-ilm merged commit fd2beef into AcademySoftwareFoundation:main Sep 23, 2026
56 checks passed
cary-ilm added a commit that referenced this pull request Sep 23, 2026
@cary-ilm
Fix heap buffer overflow in ZSTD deep scanline decoding (#2669)
53acb6f 
A crafted deep-scanline EXR file using ZSTD compression could make
OpenEXRCore write beyond a heap allocation during decompression.

exr_undo_zstd_v1() computed `split` from the (separately validated)
sample-count table but never checked it against `uncompressed_size`,
which is taken directly from the file's chunk leader. exr_zstd_segment_layout()
then used `split` as the length of the first inner segment, and that
length was written into decode->scratch_buffer_1, which is allocated
using only uncompressed_size. A file that keeps the sample-count table
and compressed payload valid while declaring a smaller unpacked_size in
the chunk leader could make the derived segment length exceed the
allocation, causing an out-of-bounds heap write.

Fix by rejecting the chunk when split > uncompressed_size before
deriving segment lengths, and by having
zstd_inner_read_shuffled_segment() take and enforce the destination's
remaining capacity as defense in depth.

Addresses GHSA-46h4-rxjp-q3rq

Assisted-by: Copilot/Claude Sonnet 5

Signed-off-by: Cary Phillips <seabeepea@gmail.com>
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request Sep 28, 2026
@0-wiz-0
openexr: update to 3.5.1.
c12f001 
## Version 3.5.1 (September 25, 2026)

Patch release that addresses a security vulnerability in ZSTD:
- fix heap buffer overflow in ZSTD deep scanline decoding

Also, the v3.5.0 release incorrectly identified the
`OPENEXR_VERSION_RELEASE_TYPE` and associated `OPENEXR_PACKAGE_NAME`
as `-dev`.

### Merged Pull Requests

* [2669](AcademySoftwareFoundation/openexr#2669)
  Fix heap buffer overflow in ZSTD deep scanline decoding (by @cary-ilm/Cary Phillips)

## Version 3.5.0 (September 21, 2026)

* Support for lossless compression via
  [Zstandard](https://github.com/facebook/zstd)

  - Introduces `ZSTD_COMPRESSION/EXR_COMPRESSION_ZSTD` enum
  - Features a custom data prep stage that includes ByteShuffle,
    optional Delta Encoding, and custom data reordering.
  - Universal lossless support: Works for all image types (including
    Deep) and supports all OpenEXR pixel/data types.
  - Deep image gains: Extensive testing with Deep scanlines shows a
    20–30% size reduction compared to ZIPS based on image channels
    (with the best gains on Deep Alpha and Deep ID).
  - Flat image file size: Achieves comparable compressed sizes to ZIPS.
  - Flat image speed: Delivers slightly faster compression and
    decompression speeds compared to ZIPS
  - Introduces a new dependency on the zstd library; a vendored
    version (v1.5.7) is provided as a fallback if no installed version
    is present.

* Support for lossy compression based on the High Throughput JPEG 2000
  (HTJ2K) standard.

  - The LJ2K compressor uses the same JPEG 2000 constraints and codec
    library (OpenJPH) as HTJ2K256, but with lossy coding, producing
    smaller files at the cost of distortion.

  - LJ2K should generally offer reduced file sizes and higher
    throughput compared to DWA.

  - Currently supports 16-bit HALF, 32-bit FLOAT and 32-bit UINT
    channels. Lossy coding is currently applied only to RGB channels;
    other channels are losslessly coded.

  - The amount of distortion is controlled via a quality level
    parameter that ranges from 1 to 150.

  - As with DWA, lossy RGB channels are first transformed to a
    non-linear preceptual domain before coding. The transformation is
    log-based when the sample's magnitude is greater than 1, and
    power-law otherwise.

* Improved support for the `colorInteropID` standard attribute as a
  mechanism to identify the color space of the RGB images:

  - Added support for `colorInteropID` to command-line tool `exrstdattr`.
  - Added API functions to validate color metadata in the header to both the C++ and core APIs.
  - Extended the exrinfo command-line tool to print warnings regarding header color metadata.
  - Added helper functions to convert between chromaticities and `colorInteropID`.
  - Added Python bindings for all new functions.
  - See [An ID for Color
    Interop](https://github.com/AcademySoftwareFoundation/ColorInterop/blob/main/Recommendations/03_ColorInteropID/ColorInteropID.md)
    and [Identifying the Color Space of OpenEXR
    Files](https://github.com/AcademySoftwareFoundation/ColorInterop/blob/main/Recommendations/04_OpenEXRFiles/OpenEXRFiles.md)
    for details.

* Support for a cache for a (de)compression context in the core decode pipeline.

  - This is a backwards compatible change (i.e. older versions of code
    compiled against previous headers will still work), with the
    exception that it does add the requirement that application code
    actually use the provided initializer when defining
    `exr_decode_pipeline_t` objects.

* For the OpenEXR python module:
  - Support for the `idManifest` attribute and object
  - Support for multithreaded read and write
  - Support for reading/writing from/to `BytesIO` object
  - Add `setMaxImageSize/setMaxTileSize` functions

* Other changes:

  - `AcesInputFile/AcesOutputFile` and `exr2aces` as marked as
    deprecated and will be removed in a future release.
  - Improved handling of many channels
  - All Imath headers are now included internally via `#include <Imath/...>`
  - Remove `iex_debugTrap()` function (was not used)
  - Improved `ChannelList` Iterator API
  - Fixed a bug that with DWA compression that could silently produce
    corrupted files.

* Also of note:

  - The vendored version of deflate is 1.26
  - The vendored version of OpenJPH is 0.32.0
  - The minimum required version of OpenJPH is 0.32.0

### Security

This release addresses the following security vulnerabilities:

* OSS-Fuzz [514487287](https://issues.oss-fuzz.com/issues/514487287)
  Floating-point-exception in `part_exceeds_memory_limits`
* OSS-Fuzz [514423826](https://issues.oss-fuzz.com/issues/514423826)
  Divide-by-zero in `part_exceeds_memory_limits`
* OSS-Fuzz [513282267](https://issues.oss-fuzz.com/issues/513282267)
  Timeout in `openexr_exrgaps_fuzzer`
* OSS-Fuzz [512988066](https://issues.oss-fuzz.com/issues/512988066)
  Out-of-memory in `openexr_exrgaps_fuzzer`

### Merged Pull Requests

* [2660](AcademySoftwareFoundation/openexr#2660)
  Look for version headers in `CMAKE_CURRENT_SOURCE_DIR/external`  (by @cary-ilm/Cary Phillips)
* [2656](AcademySoftwareFoundation/openexr#2656)
  Bump zstd from 1.5.7.bcr.1 to 1.5.7.bcr.2
* [2655](AcademySoftwareFoundation/openexr#2655)
  Bump rules_cc from 0.2.22 to 0.2.25
* [2654](AcademySoftwareFoundation/openexr#2654)
  Bump required OpenJPH to 0.32.0 (by @cary-ilm/Cary Phillips)
* [2650](AcademySoftwareFoundation/openexr#2650)
  Fix null pointer memcpy in BytesAttribute for zero-length data (by @x4evexnol/babayaga)
* [2648](AcademySoftwareFoundation/openexr#2648)
  Fix DWAB corrupted file (by @vlazar-ilm/Vlad Lazar)
* [2640](AcademySoftwareFoundation/openexr#2640)
  LJ2K: declare the chunk padding in a COM marker segment (by
  @osamu620/Osamu Watanabe)
* [2637](AcademySoftwareFoundation/openexr#2637)
  LJ2K: Use J2K Type 4 NLT LUT to apply the transfer function (by @palemieux/Pierre-Anthony Lemieux)
* [2633](AcademySoftwareFoundation/openexr#2633)
  LJ2K: pad lossy chunks so that wavelet folds stay on low-pass
  positions (by @osamu620/Osamu Watanabe)
* [2627](AcademySoftwareFoundation/openexr#2627)
  Reconsitute compression ctxt cache (by @kdt3rd/Kimball Thurston)
* [2626](AcademySoftwareFoundation/openexr#2626)
  Misc warning cleanup (by @kdt3rd/Kimball Thurston)
* [2625](AcademySoftwareFoundation/openexr#2625)
  Cleanup compression information routines (by @kdt3rd/Kimball Thurston)
* [2623](AcademySoftwareFoundation/openexr#2623)
  Zstd compression support (by @vlazar-ilm/Vlad Lazar)
* [2620](AcademySoftwareFoundation/openexr#2620)
  LJ2K: handle non-finite and out-of-bound samples gracefully (by @palemieux/Pierre-Anthony Lemieux)
* [2618](AcademySoftwareFoundation/openexr#2618)
  Update vendored libdeflate to 1.26 (by @cary-ilm/Cary Phillips)
* [2599](AcademySoftwareFoundation/openexr#2599)
  Add support for loss HTJ2K compressor (LJ2K) (by @palemieux/Pierre-Anthony Lemieux)
* [2581](AcademySoftwareFoundation/openexr#2581)
  Mark AcesInputFile/AcesOutputFile and exr2aces as deprecated (by @cary-ilm/Cary Phillips)
* [2577](AcademySoftwareFoundation/openexr#2577)
  Revert "Add compression context cache (#2440)" (by @cary-ilm/Cary Phillips)
* [2560](AcademySoftwareFoundation/openexr#2560)
  Refine colorInteropID support (by @doug-walker/Doug Walker)
* [2525](AcademySoftwareFoundation/openexr#2525)
  Add check to avoid overflow, add tests for reading / writing many channels (by @kthurston/Kimball Thurston)
* [2453](AcademySoftwareFoundation/openexr#2453)
  Use std::deque for IDManifest storage to keep references stable (by @mshooter-ilm/Moira Shooter)
* [2443](AcademySoftwareFoundation/openexr#2443)
  Fix Imath include on CMake reconfigure (by @cary-ilm/Cary Phillips)
* [2440](AcademySoftwareFoundation/openexr#2440)
  Add compression context cache (by @kdt3rd/Kimball Thurston)
* [2435](AcademySoftwareFoundation/openexr#2435)
  Add setMaxImageSize/setMaxTileSize to python module (by @cary-ilm/Cary Phillips)
* [2432](AcademySoftwareFoundation/openexr#2432)
  Add Python bindings for idManifest (IDManifest) header attribute (by @mshooter-ilm/Moira Shooter)
* [2429](AcademySoftwareFoundation/openexr#2429)
  Check for xSize==0 in gaps fuzzer `part_exceeds_memory_limits` (by @cary-ilm/Cary Phillips)
* [2428](AcademySoftwareFoundation/openexr#2428)
  Add required includes to website examples (by @ijayhub/Ijay)
* [2419](AcademySoftwareFoundation/openexr#2419)
  Impose memory limits in `openexr_exrgaps_fuzzer` (by @cary-ilm/Cary Phillips)
* [2418](AcademySoftwareFoundation/openexr#2418)
  Add support for multithreading in Python module (by @cary-ilm/Cary Phillips)
* [2412](AcademySoftwareFoundation/openexr#2412)
  Ability to read/write from/to BytesIO buffers in Python API (by @mshooter-ilm/Moira Shooter)
* [2401](AcademySoftwareFoundation/openexr#2401)
  test/oss-fuzz: add `openexr_exrgaps_fuzzer` (by @jortles/Anthony Hurtado)
* [2391](AcademySoftwareFoundation/openexr#2391)
  Add new fuzzing harnesses that can be consumed by OSS-Fuzz (by @DavidKorczynski)
* [2384](AcademySoftwareFoundation/openexr#2384)
  Completing ChannelList Iterator API (by @Arcmantis18/ArcMantis)
* [2376](AcademySoftwareFoundation/openexr#2376)
  Include all Imath headers via #include <Imath/...> (by @cary-ilm/Cary Phillips)
* [2369](AcademySoftwareFoundation/openexr#2369)
  Clarify #include policy and make usage consistent (by @cary-ilm/Cary Phillips)
* [2309](AcademySoftwareFoundation/openexr#2309)
  Don't hardcode the python module install dir (by @antonio-rojas/Antonio Rojas)
* [2276](AcademySoftwareFoundation/openexr#2276)
  Build oss-fuzz via oss-fuzz_build.sh (by @cary-ilm/Cary Phillips)
* [2151](AcademySoftwareFoundation/openexr#2151)
  Remove iex_debugTrap() function (by @cary-ilm/Cary Phillips)
* [2143](AcademySoftwareFoundation/openexr#2143)
  Make the release.py generic, so it works with Imath (by @cary-ilm/Cary Phillips)
* [2117](AcademySoftwareFoundation/openexr#2117)
  Bump version on main branch to 4.0.0 (by @cary-ilm/Cary Phillips)

### Documentation Pull Requests

* [2652](AcademySoftwareFoundation/openexr#2652)
  website: improve documentation code and equation formatting (by @QuantaDude/Abhirup Bhattacharyya)
* [2651](AcademySoftwareFoundation/openexr#2651)
  Set 'align: left' for tables that had central text alignment in
  TechnicalIntroduction.rst for better formatting (by @dmitryshurov/Dmitry Shurov)
* [2649](AcademySoftwareFoundation/openexr#2649)
  website: document LJ2K compression (by @QuantaDude/Abhirup Bhattacharyya)
* [2647](AcademySoftwareFoundation/openexr#2647)
  website: compile documentation examples independently (by @QuantaDude/Abhirup Bhattacharyya)
* [2638](AcademySoftwareFoundation/openexr#2638)
  Release notes for v3.5.0 (by @cary-ilm/Cary Phillips)
* [2634](AcademySoftwareFoundation/openexr#2634)
  docs: Fix SECURITY.md formatting (by @lgritz/Larry Gritz)
* [2624](AcademySoftwareFoundation/openexr#2624)
  Release notes and news for v3.4.15, v3.3.14, v3.2.12 (by @cary-ilm/Cary Phillips)
* [2580](AcademySoftwareFoundation/openexr#2580)
  Release notes and news for v3.4.14, v3.3.13, v3.2.11 (by @cary-ilm/Cary Phillips)
* [2549](AcademySoftwareFoundation/openexr#2549)
  Fix broken links identified in ASWF Health Check 2026 (by @cary-ilm/Cary Phillips)
* [2512](AcademySoftwareFoundation/openexr#2512)
  Update security policy regarding CVE requests (by @cary-ilm/Cary Phillips)
* [2501](AcademySoftwareFoundation/openexr#2501)
  Update SECURITY.md with CVE fixes from v3.4.12 and 3.4.13 (by @cary-ilm/Cary Phillips)
* [2497](AcademySoftwareFoundation/openexr#2497)
  Release notes and news for v3.4.13, v3.3.12, and v3.2.10 (by @cary-ilm/Cary Phillips)
* [2322](AcademySoftwareFoundation/openexr#2322)
  news and release notes for v3.4.8 and v3.4.7 (by @cary-ilm/Cary Phillips)
* [2280](AcademySoftwareFoundation/openexr#2280)
  release notes and news for 3.4.6, 3.3.8, and 3.2.6 (by @cary-ilm/Cary Phillips)
* [2275](AcademySoftwareFoundation/openexr#2275)
  Fix install doc to note vendored OpenJPH started with v3.4.6 (by @cary-ilm/Cary Phillips)
* [2203](AcademySoftwareFoundation/openexr#2203)
  V3.4.4 news (by @cary-ilm/Cary Phillips)
* [2195](AcademySoftwareFoundation/openexr#2195)
  Add copyright notices to website example code (by @cary-ilm/Cary Phillips)
* [2172](AcademySoftwareFoundation/openexr#2172)
  release notes and news for v3.4.3, v3.3.6, and 3.2.5 (by @cary-ilm/Cary Phillips)
* [2152](AcademySoftwareFoundation/openexr#2152)
  Release notes and news for v3.4.2 (by @cary-ilm/Cary Phillips)

### Merged Workflow Pull Requests

* [2636](AcademySoftwareFoundation/openexr#2636)
  Bump vmactions/freebsd-vm from 1.5.5 to 1.5.6
* [2635](AcademySoftwareFoundation/openexr#2635)
  Bump the codeql group with 3 updates
* [2631](AcademySoftwareFoundation/openexr#2631)
  Add Windows ARM64 Python wheel CI (by @xieofxie)
* [2630](AcademySoftwareFoundation/openexr#2630)
  Bump pypa/cibuildwheel from 4.2.0 to 4.2.1
* [2576](AcademySoftwareFoundation/openexr#2576)
  Bump pypa/cibuildwheel from 4.1.1 to 4.2.0
* [2559](AcademySoftwareFoundation/openexr#2559)
  Bump pypa/cibuildwheel from 4.1.0 to 4.1.1
* [2537](AcademySoftwareFoundation/openexr#2537)
  Bump the codeql group with 3 updates
* [2523](AcademySoftwareFoundation/openexr#2523)
  Group CodeQL GitHub Actions bumps in Dependabot. (by @cary-ilm/Cary Phillips)
* [2521](AcademySoftwareFoundation/openexr#2521)
  Bump github/codeql-action/init from 4.36.2 to 4.36.3
* [2520](AcademySoftwareFoundation/openexr#2520)
  Bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3
* [2519](AcademySoftwareFoundation/openexr#2519)
  Bump github/codeql-action/analyze from 4.36.2 to 4.36.3
* [2477](AcademySoftwareFoundation/openexr#2477)
  Drop support for Python 3.8 (by @cary-ilm/Cary Phillips)
* [2475](AcademySoftwareFoundation/openexr#2475)
  Bump pypa/cibuildwheel from 3.4.1 to 4.1.0
* [2459](AcademySoftwareFoundation/openexr#2459)
  Bump github/codeql-action from 4.36.0 to 4.36.2
* [2455](AcademySoftwareFoundation/openexr#2455)
  Bump actions/checkout from 6.0.2 to 6.0.3
* [2446](AcademySoftwareFoundation/openexr#2446)
  Bump openjph from 0.27.0 to 0.27.3.bcr.1
* [2410](AcademySoftwareFoundation/openexr#2410)
  Add missing quotes around ENV in src/test/oss-fuzz/CMakeLists.txt (by @cary-ilm/Cary Phillips)
* [2400](AcademySoftwareFoundation/openexr#2400)
  Bump openjph from 0.26.3.bcr.1 to 0.27.0
* [2386](AcademySoftwareFoundation/openexr#2386)
  Bump rules_cc from 0.2.17 to 0.2.18
* [2371](AcademySoftwareFoundation/openexr#2371)
  Bump packaging from 26.0 to 26.1
* [2348](AcademySoftwareFoundation/openexr#2348)
  Bump requests from 2.32.5 to 2.33.0 in /website
* [2347](AcademySoftwareFoundation/openexr#2347)
  Bump pygments from 2.19.2 to 2.20.0 in /website
* [2286](AcademySoftwareFoundation/openexr#2286)
  Bump github/codeql-action from 4.32.4 to 4.32.5
* [2285](AcademySoftwareFoundation/openexr#2285)
  Bump scikit-build-core from 0.11.6 to 0.12.1
* [2284](AcademySoftwareFoundation/openexr#2284)
  Bump jmertic/slack-release-notifier from 5221a45213eddc6206886797beb079e091c93406 to 6fa159048d5313ff1177d248ad84beb627571670
* [2278](AcademySoftwareFoundation/openexr#2278)
  Bump actions/download-artifact from 7.0.0 to 8.0.0
* [2277](AcademySoftwareFoundation/openexr#2277)
  Bump actions/upload-artifact from 6.0.0 to 7.0.0
* [2206](AcademySoftwareFoundation/openexr#2206)
  Bump openjph from 0.25.2 to 0.25.3
* [2179](AcademySoftwareFoundation/openexr#2179)
  Bump readthedocs/actions from 1.2 to 1.5
* [2116](AcademySoftwareFoundation/openexr#2116)
  CI fixes: (by @cary-ilm/Cary Phillips)
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request Oct 13, 2026
@0-wiz-0
openexr: update to 3.5.1.
2ffc82e 
## Version 3.5.1 (September 25, 2026)

Patch release that addresses a security vulnerability in ZSTD:
- fix heap buffer overflow in ZSTD deep scanline decoding

Also, the v3.5.0 release incorrectly identified the
`OPENEXR_VERSION_RELEASE_TYPE` and associated `OPENEXR_PACKAGE_NAME`
as `-dev`.

### Merged Pull Requests

* [2669](AcademySoftwareFoundation/openexr#2669)
  Fix heap buffer overflow in ZSTD deep scanline decoding (by @cary-ilm/Cary Phillips)

## Version 3.5.0 (September 21, 2026)

* Support for lossless compression via
  [Zstandard](https://github.com/facebook/zstd)

  - Introduces `ZSTD_COMPRESSION/EXR_COMPRESSION_ZSTD` enum
  - Features a custom data prep stage that includes ByteShuffle,
    optional Delta Encoding, and custom data reordering.
  - Universal lossless support: Works for all image types (including
    Deep) and supports all OpenEXR pixel/data types.
  - Deep image gains: Extensive testing with Deep scanlines shows a
    20–30% size reduction compared to ZIPS based on image channels
    (with the best gains on Deep Alpha and Deep ID).
  - Flat image file size: Achieves comparable compressed sizes to ZIPS.
  - Flat image speed: Delivers slightly faster compression and
    decompression speeds compared to ZIPS
  - Introduces a new dependency on the zstd library; a vendored
    version (v1.5.7) is provided as a fallback if no installed version
    is present.

* Support for lossy compression based on the High Throughput JPEG 2000
  (HTJ2K) standard.

  - The LJ2K compressor uses the same JPEG 2000 constraints and codec
    library (OpenJPH) as HTJ2K256, but with lossy coding, producing
    smaller files at the cost of distortion.

  - LJ2K should generally offer reduced file sizes and higher
    throughput compared to DWA.

  - Currently supports 16-bit HALF, 32-bit FLOAT and 32-bit UINT
    channels. Lossy coding is currently applied only to RGB channels;
    other channels are losslessly coded.

  - The amount of distortion is controlled via a quality level
    parameter that ranges from 1 to 150.

  - As with DWA, lossy RGB channels are first transformed to a
    non-linear preceptual domain before coding. The transformation is
    log-based when the sample's magnitude is greater than 1, and
    power-law otherwise.

* Improved support for the `colorInteropID` standard attribute as a
  mechanism to identify the color space of the RGB images:

  - Added support for `colorInteropID` to command-line tool `exrstdattr`.
  - Added API functions to validate color metadata in the header to both the C++ and core APIs.
  - Extended the exrinfo command-line tool to print warnings regarding header color metadata.
  - Added helper functions to convert between chromaticities and `colorInteropID`.
  - Added Python bindings for all new functions.
  - See [An ID for Color
    Interop](https://github.com/AcademySoftwareFoundation/ColorInterop/blob/main/Recommendations/03_ColorInteropID/ColorInteropID.md)
    and [Identifying the Color Space of OpenEXR
    Files](https://github.com/AcademySoftwareFoundation/ColorInterop/blob/main/Recommendations/04_OpenEXRFiles/OpenEXRFiles.md)
    for details.

* Support for a cache for a (de)compression context in the core decode pipeline.

  - This is a backwards compatible change (i.e. older versions of code
    compiled against previous headers will still work), with the
    exception that it does add the requirement that application code
    actually use the provided initializer when defining
    `exr_decode_pipeline_t` objects.

* For the OpenEXR python module:
  - Support for the `idManifest` attribute and object
  - Support for multithreaded read and write
  - Support for reading/writing from/to `BytesIO` object
  - Add `setMaxImageSize/setMaxTileSize` functions

* Other changes:

  - `AcesInputFile/AcesOutputFile` and `exr2aces` as marked as
    deprecated and will be removed in a future release.
  - Improved handling of many channels
  - All Imath headers are now included internally via `#include <Imath/...>`
  - Remove `iex_debugTrap()` function (was not used)
  - Improved `ChannelList` Iterator API
  - Fixed a bug that with DWA compression that could silently produce
    corrupted files.

* Also of note:

  - The vendored version of deflate is 1.26
  - The vendored version of OpenJPH is 0.32.0
  - The minimum required version of OpenJPH is 0.32.0

### Security

This release addresses the following security vulnerabilities:

* OSS-Fuzz [514487287](https://issues.oss-fuzz.com/issues/514487287)
  Floating-point-exception in `part_exceeds_memory_limits`
* OSS-Fuzz [514423826](https://issues.oss-fuzz.com/issues/514423826)
  Divide-by-zero in `part_exceeds_memory_limits`
* OSS-Fuzz [513282267](https://issues.oss-fuzz.com/issues/513282267)
  Timeout in `openexr_exrgaps_fuzzer`
* OSS-Fuzz [512988066](https://issues.oss-fuzz.com/issues/512988066)
  Out-of-memory in `openexr_exrgaps_fuzzer`

### Merged Pull Requests

* [2660](AcademySoftwareFoundation/openexr#2660)
  Look for version headers in `CMAKE_CURRENT_SOURCE_DIR/external`  (by @cary-ilm/Cary Phillips)
* [2656](AcademySoftwareFoundation/openexr#2656)
  Bump zstd from 1.5.7.bcr.1 to 1.5.7.bcr.2
* [2655](AcademySoftwareFoundation/openexr#2655)
  Bump rules_cc from 0.2.22 to 0.2.25
* [2654](AcademySoftwareFoundation/openexr#2654)
  Bump required OpenJPH to 0.32.0 (by @cary-ilm/Cary Phillips)
* [2650](AcademySoftwareFoundation/openexr#2650)
  Fix null pointer memcpy in BytesAttribute for zero-length data (by @x4evexnol/babayaga)
* [2648](AcademySoftwareFoundation/openexr#2648)
  Fix DWAB corrupted file (by @vlazar-ilm/Vlad Lazar)
* [2640](AcademySoftwareFoundation/openexr#2640)
  LJ2K: declare the chunk padding in a COM marker segment (by
  @osamu620/Osamu Watanabe)
* [2637](AcademySoftwareFoundation/openexr#2637)
  LJ2K: Use J2K Type 4 NLT LUT to apply the transfer function (by @palemieux/Pierre-Anthony Lemieux)
* [2633](AcademySoftwareFoundation/openexr#2633)
  LJ2K: pad lossy chunks so that wavelet folds stay on low-pass
  positions (by @osamu620/Osamu Watanabe)
* [2627](AcademySoftwareFoundation/openexr#2627)
  Reconsitute compression ctxt cache (by @kdt3rd/Kimball Thurston)
* [2626](AcademySoftwareFoundation/openexr#2626)
  Misc warning cleanup (by @kdt3rd/Kimball Thurston)
* [2625](AcademySoftwareFoundation/openexr#2625)
  Cleanup compression information routines (by @kdt3rd/Kimball Thurston)
* [2623](AcademySoftwareFoundation/openexr#2623)
  Zstd compression support (by @vlazar-ilm/Vlad Lazar)
* [2620](AcademySoftwareFoundation/openexr#2620)
  LJ2K: handle non-finite and out-of-bound samples gracefully (by @palemieux/Pierre-Anthony Lemieux)
* [2618](AcademySoftwareFoundation/openexr#2618)
  Update vendored libdeflate to 1.26 (by @cary-ilm/Cary Phillips)
* [2599](AcademySoftwareFoundation/openexr#2599)
  Add support for loss HTJ2K compressor (LJ2K) (by @palemieux/Pierre-Anthony Lemieux)
* [2581](AcademySoftwareFoundation/openexr#2581)
  Mark AcesInputFile/AcesOutputFile and exr2aces as deprecated (by @cary-ilm/Cary Phillips)
* [2577](AcademySoftwareFoundation/openexr#2577)
  Revert "Add compression context cache (#2440)" (by @cary-ilm/Cary Phillips)
* [2560](AcademySoftwareFoundation/openexr#2560)
  Refine colorInteropID support (by @doug-walker/Doug Walker)
* [2525](AcademySoftwareFoundation/openexr#2525)
  Add check to avoid overflow, add tests for reading / writing many channels (by @kthurston/Kimball Thurston)
* [2453](AcademySoftwareFoundation/openexr#2453)
  Use std::deque for IDManifest storage to keep references stable (by @mshooter-ilm/Moira Shooter)
* [2443](AcademySoftwareFoundation/openexr#2443)
  Fix Imath include on CMake reconfigure (by @cary-ilm/Cary Phillips)
* [2440](AcademySoftwareFoundation/openexr#2440)
  Add compression context cache (by @kdt3rd/Kimball Thurston)
* [2435](AcademySoftwareFoundation/openexr#2435)
  Add setMaxImageSize/setMaxTileSize to python module (by @cary-ilm/Cary Phillips)
* [2432](AcademySoftwareFoundation/openexr#2432)
  Add Python bindings for idManifest (IDManifest) header attribute (by @mshooter-ilm/Moira Shooter)
* [2429](AcademySoftwareFoundation/openexr#2429)
  Check for xSize==0 in gaps fuzzer `part_exceeds_memory_limits` (by @cary-ilm/Cary Phillips)
* [2428](AcademySoftwareFoundation/openexr#2428)
  Add required includes to website examples (by @ijayhub/Ijay)
* [2419](AcademySoftwareFoundation/openexr#2419)
  Impose memory limits in `openexr_exrgaps_fuzzer` (by @cary-ilm/Cary Phillips)
* [2418](AcademySoftwareFoundation/openexr#2418)
  Add support for multithreading in Python module (by @cary-ilm/Cary Phillips)
* [2412](AcademySoftwareFoundation/openexr#2412)
  Ability to read/write from/to BytesIO buffers in Python API (by @mshooter-ilm/Moira Shooter)
* [2401](AcademySoftwareFoundation/openexr#2401)
  test/oss-fuzz: add `openexr_exrgaps_fuzzer` (by @jortles/Anthony Hurtado)
* [2391](AcademySoftwareFoundation/openexr#2391)
  Add new fuzzing harnesses that can be consumed by OSS-Fuzz (by @DavidKorczynski)
* [2384](AcademySoftwareFoundation/openexr#2384)
  Completing ChannelList Iterator API (by @Arcmantis18/ArcMantis)
* [2376](AcademySoftwareFoundation/openexr#2376)
  Include all Imath headers via #include <Imath/...> (by @cary-ilm/Cary Phillips)
* [2369](AcademySoftwareFoundation/openexr#2369)
  Clarify #include policy and make usage consistent (by @cary-ilm/Cary Phillips)
* [2309](AcademySoftwareFoundation/openexr#2309)
  Don't hardcode the python module install dir (by @antonio-rojas/Antonio Rojas)
* [2276](AcademySoftwareFoundation/openexr#2276)
  Build oss-fuzz via oss-fuzz_build.sh (by @cary-ilm/Cary Phillips)
* [2151](AcademySoftwareFoundation/openexr#2151)
  Remove iex_debugTrap() function (by @cary-ilm/Cary Phillips)
* [2143](AcademySoftwareFoundation/openexr#2143)
  Make the release.py generic, so it works with Imath (by @cary-ilm/Cary Phillips)
* [2117](AcademySoftwareFoundation/openexr#2117)
  Bump version on main branch to 4.0.0 (by @cary-ilm/Cary Phillips)

### Documentation Pull Requests

* [2652](AcademySoftwareFoundation/openexr#2652)
  website: improve documentation code and equation formatting (by @QuantaDude/Abhirup Bhattacharyya)
* [2651](AcademySoftwareFoundation/openexr#2651)
  Set 'align: left' for tables that had central text alignment in
  TechnicalIntroduction.rst for better formatting (by @dmitryshurov/Dmitry Shurov)
* [2649](AcademySoftwareFoundation/openexr#2649)
  website: document LJ2K compression (by @QuantaDude/Abhirup Bhattacharyya)
* [2647](AcademySoftwareFoundation/openexr#2647)
  website: compile documentation examples independently (by @QuantaDude/Abhirup Bhattacharyya)
* [2638](AcademySoftwareFoundation/openexr#2638)
  Release notes for v3.5.0 (by @cary-ilm/Cary Phillips)
* [2634](AcademySoftwareFoundation/openexr#2634)
  docs: Fix SECURITY.md formatting (by @lgritz/Larry Gritz)
* [2624](AcademySoftwareFoundation/openexr#2624)
  Release notes and news for v3.4.15, v3.3.14, v3.2.12 (by @cary-ilm/Cary Phillips)
* [2580](AcademySoftwareFoundation/openexr#2580)
  Release notes and news for v3.4.14, v3.3.13, v3.2.11 (by @cary-ilm/Cary Phillips)
* [2549](AcademySoftwareFoundation/openexr#2549)
  Fix broken links identified in ASWF Health Check 2026 (by @cary-ilm/Cary Phillips)
* [2512](AcademySoftwareFoundation/openexr#2512)
  Update security policy regarding CVE requests (by @cary-ilm/Cary Phillips)
* [2501](AcademySoftwareFoundation/openexr#2501)
  Update SECURITY.md with CVE fixes from v3.4.12 and 3.4.13 (by @cary-ilm/Cary Phillips)
* [2497](AcademySoftwareFoundation/openexr#2497)
  Release notes and news for v3.4.13, v3.3.12, and v3.2.10 (by @cary-ilm/Cary Phillips)
* [2322](AcademySoftwareFoundation/openexr#2322)
  news and release notes for v3.4.8 and v3.4.7 (by @cary-ilm/Cary Phillips)
* [2280](AcademySoftwareFoundation/openexr#2280)
  release notes and news for 3.4.6, 3.3.8, and 3.2.6 (by @cary-ilm/Cary Phillips)
* [2275](AcademySoftwareFoundation/openexr#2275)
  Fix install doc to note vendored OpenJPH started with v3.4.6 (by @cary-ilm/Cary Phillips)
* [2203](AcademySoftwareFoundation/openexr#2203)
  V3.4.4 news (by @cary-ilm/Cary Phillips)
* [2195](AcademySoftwareFoundation/openexr#2195)
  Add copyright notices to website example code (by @cary-ilm/Cary Phillips)
* [2172](AcademySoftwareFoundation/openexr#2172)
  release notes and news for v3.4.3, v3.3.6, and 3.2.5 (by @cary-ilm/Cary Phillips)
* [2152](AcademySoftwareFoundation/openexr#2152)
  Release notes and news for v3.4.2 (by @cary-ilm/Cary Phillips)

### Merged Workflow Pull Requests

* [2636](AcademySoftwareFoundation/openexr#2636)
  Bump vmactions/freebsd-vm from 1.5.5 to 1.5.6
* [2635](AcademySoftwareFoundation/openexr#2635)
  Bump the codeql group with 3 updates
* [2631](AcademySoftwareFoundation/openexr#2631)
  Add Windows ARM64 Python wheel CI (by @xieofxie)
* [2630](AcademySoftwareFoundation/openexr#2630)
  Bump pypa/cibuildwheel from 4.2.0 to 4.2.1
* [2576](AcademySoftwareFoundation/openexr#2576)
  Bump pypa/cibuildwheel from 4.1.1 to 4.2.0
* [2559](AcademySoftwareFoundation/openexr#2559)
  Bump pypa/cibuildwheel from 4.1.0 to 4.1.1
* [2537](AcademySoftwareFoundation/openexr#2537)
  Bump the codeql group with 3 updates
* [2523](AcademySoftwareFoundation/openexr#2523)
  Group CodeQL GitHub Actions bumps in Dependabot. (by @cary-ilm/Cary Phillips)
* [2521](AcademySoftwareFoundation/openexr#2521)
  Bump github/codeql-action/init from 4.36.2 to 4.36.3
* [2520](AcademySoftwareFoundation/openexr#2520)
  Bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3
* [2519](AcademySoftwareFoundation/openexr#2519)
  Bump github/codeql-action/analyze from 4.36.2 to 4.36.3
* [2477](AcademySoftwareFoundation/openexr#2477)
  Drop support for Python 3.8 (by @cary-ilm/Cary Phillips)
* [2475](AcademySoftwareFoundation/openexr#2475)
  Bump pypa/cibuildwheel from 3.4.1 to 4.1.0
* [2459](AcademySoftwareFoundation/openexr#2459)
  Bump github/codeql-action from 4.36.0 to 4.36.2
* [2455](AcademySoftwareFoundation/openexr#2455)
  Bump actions/checkout from 6.0.2 to 6.0.3
* [2446](AcademySoftwareFoundation/openexr#2446)
  Bump openjph from 0.27.0 to 0.27.3.bcr.1
* [2410](AcademySoftwareFoundation/openexr#2410)
  Add missing quotes around ENV in src/test/oss-fuzz/CMakeLists.txt (by @cary-ilm/Cary Phillips)
* [2400](AcademySoftwareFoundation/openexr#2400)
  Bump openjph from 0.26.3.bcr.1 to 0.27.0
* [2386](AcademySoftwareFoundation/openexr#2386)
  Bump rules_cc from 0.2.17 to 0.2.18
* [2371](AcademySoftwareFoundation/openexr#2371)
  Bump packaging from 26.0 to 26.1
* [2348](AcademySoftwareFoundation/openexr#2348)
  Bump requests from 2.32.5 to 2.33.0 in /website
* [2347](AcademySoftwareFoundation/openexr#2347)
  Bump pygments from 2.19.2 to 2.20.0 in /website
* [2286](AcademySoftwareFoundation/openexr#2286)
  Bump github/codeql-action from 4.32.4 to 4.32.5
* [2285](AcademySoftwareFoundation/openexr#2285)
  Bump scikit-build-core from 0.11.6 to 0.12.1
* [2284](AcademySoftwareFoundation/openexr#2284)
  Bump jmertic/slack-release-notifier from 5221a45213eddc6206886797beb079e091c93406 to 6fa159048d5313ff1177d248ad84beb627571670
* [2278](AcademySoftwareFoundation/openexr#2278)
  Bump actions/download-artifact from 7.0.0 to 8.0.0
* [2277](AcademySoftwareFoundation/openexr#2277)
  Bump actions/upload-artifact from 6.0.0 to 7.0.0
* [2206](AcademySoftwareFoundation/openexr#2206)
  Bump openjph from 0.25.2 to 0.25.3
* [2179](AcademySoftwareFoundation/openexr#2179)
  Bump readthedocs/actions from 1.2 to 1.5
* [2116](AcademySoftwareFoundation/openexr#2116)
  CI fixes: (by @cary-ilm/Cary Phillips)
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request Oct 21, 2026
@0-wiz-0
openexr: update to 3.5.1.
081944a 
## Version 3.5.1 (September 25, 2026)

Patch release that addresses a security vulnerability in ZSTD:
- fix heap buffer overflow in ZSTD deep scanline decoding

Also, the v3.5.0 release incorrectly identified the
`OPENEXR_VERSION_RELEASE_TYPE` and associated `OPENEXR_PACKAGE_NAME`
as `-dev`.

### Merged Pull Requests

* [2669](AcademySoftwareFoundation/openexr#2669)
  Fix heap buffer overflow in ZSTD deep scanline decoding (by @cary-ilm/Cary Phillips)

## Version 3.5.0 (September 21, 2026)

* Support for lossless compression via
  [Zstandard](https://github.com/facebook/zstd)

  - Introduces `ZSTD_COMPRESSION/EXR_COMPRESSION_ZSTD` enum
  - Features a custom data prep stage that includes ByteShuffle,
    optional Delta Encoding, and custom data reordering.
  - Universal lossless support: Works for all image types (including
    Deep) and supports all OpenEXR pixel/data types.
  - Deep image gains: Extensive testing with Deep scanlines shows a
    20–30% size reduction compared to ZIPS based on image channels
    (with the best gains on Deep Alpha and Deep ID).
  - Flat image file size: Achieves comparable compressed sizes to ZIPS.
  - Flat image speed: Delivers slightly faster compression and
    decompression speeds compared to ZIPS
  - Introduces a new dependency on the zstd library; a vendored
    version (v1.5.7) is provided as a fallback if no installed version
    is present.

* Support for lossy compression based on the High Throughput JPEG 2000
  (HTJ2K) standard.

  - The LJ2K compressor uses the same JPEG 2000 constraints and codec
    library (OpenJPH) as HTJ2K256, but with lossy coding, producing
    smaller files at the cost of distortion.

  - LJ2K should generally offer reduced file sizes and higher
    throughput compared to DWA.

  - Currently supports 16-bit HALF, 32-bit FLOAT and 32-bit UINT
    channels. Lossy coding is currently applied only to RGB channels;
    other channels are losslessly coded.

  - The amount of distortion is controlled via a quality level
    parameter that ranges from 1 to 150.

  - As with DWA, lossy RGB channels are first transformed to a
    non-linear preceptual domain before coding. The transformation is
    log-based when the sample's magnitude is greater than 1, and
    power-law otherwise.

* Improved support for the `colorInteropID` standard attribute as a
  mechanism to identify the color space of the RGB images:

  - Added support for `colorInteropID` to command-line tool `exrstdattr`.
  - Added API functions to validate color metadata in the header to both the C++ and core APIs.
  - Extended the exrinfo command-line tool to print warnings regarding header color metadata.
  - Added helper functions to convert between chromaticities and `colorInteropID`.
  - Added Python bindings for all new functions.
  - See [An ID for Color
    Interop](https://github.com/AcademySoftwareFoundation/ColorInterop/blob/main/Recommendations/03_ColorInteropID/ColorInteropID.md)
    and [Identifying the Color Space of OpenEXR
    Files](https://github.com/AcademySoftwareFoundation/ColorInterop/blob/main/Recommendations/04_OpenEXRFiles/OpenEXRFiles.md)
    for details.

* Support for a cache for a (de)compression context in the core decode pipeline.

  - This is a backwards compatible change (i.e. older versions of code
    compiled against previous headers will still work), with the
    exception that it does add the requirement that application code
    actually use the provided initializer when defining
    `exr_decode_pipeline_t` objects.

* For the OpenEXR python module:
  - Support for the `idManifest` attribute and object
  - Support for multithreaded read and write
  - Support for reading/writing from/to `BytesIO` object
  - Add `setMaxImageSize/setMaxTileSize` functions

* Other changes:

  - `AcesInputFile/AcesOutputFile` and `exr2aces` as marked as
    deprecated and will be removed in a future release.
  - Improved handling of many channels
  - All Imath headers are now included internally via `#include <Imath/...>`
  - Remove `iex_debugTrap()` function (was not used)
  - Improved `ChannelList` Iterator API
  - Fixed a bug that with DWA compression that could silently produce
    corrupted files.

* Also of note:

  - The vendored version of deflate is 1.26
  - The vendored version of OpenJPH is 0.32.0
  - The minimum required version of OpenJPH is 0.32.0

### Security

This release addresses the following security vulnerabilities:

* OSS-Fuzz [514487287](https://issues.oss-fuzz.com/issues/514487287)
  Floating-point-exception in `part_exceeds_memory_limits`
* OSS-Fuzz [514423826](https://issues.oss-fuzz.com/issues/514423826)
  Divide-by-zero in `part_exceeds_memory_limits`
* OSS-Fuzz [513282267](https://issues.oss-fuzz.com/issues/513282267)
  Timeout in `openexr_exrgaps_fuzzer`
* OSS-Fuzz [512988066](https://issues.oss-fuzz.com/issues/512988066)
  Out-of-memory in `openexr_exrgaps_fuzzer`

### Merged Pull Requests

* [2660](AcademySoftwareFoundation/openexr#2660)
  Look for version headers in `CMAKE_CURRENT_SOURCE_DIR/external`  (by @cary-ilm/Cary Phillips)
* [2656](AcademySoftwareFoundation/openexr#2656)
  Bump zstd from 1.5.7.bcr.1 to 1.5.7.bcr.2
* [2655](AcademySoftwareFoundation/openexr#2655)
  Bump rules_cc from 0.2.22 to 0.2.25
* [2654](AcademySoftwareFoundation/openexr#2654)
  Bump required OpenJPH to 0.32.0 (by @cary-ilm/Cary Phillips)
* [2650](AcademySoftwareFoundation/openexr#2650)
  Fix null pointer memcpy in BytesAttribute for zero-length data (by @x4evexnol/babayaga)
* [2648](AcademySoftwareFoundation/openexr#2648)
  Fix DWAB corrupted file (by @vlazar-ilm/Vlad Lazar)
* [2640](AcademySoftwareFoundation/openexr#2640)
  LJ2K: declare the chunk padding in a COM marker segment (by
  @osamu620/Osamu Watanabe)
* [2637](AcademySoftwareFoundation/openexr#2637)
  LJ2K: Use J2K Type 4 NLT LUT to apply the transfer function (by @palemieux/Pierre-Anthony Lemieux)
* [2633](AcademySoftwareFoundation/openexr#2633)
  LJ2K: pad lossy chunks so that wavelet folds stay on low-pass
  positions (by @osamu620/Osamu Watanabe)
* [2627](AcademySoftwareFoundation/openexr#2627)
  Reconsitute compression ctxt cache (by @kdt3rd/Kimball Thurston)
* [2626](AcademySoftwareFoundation/openexr#2626)
  Misc warning cleanup (by @kdt3rd/Kimball Thurston)
* [2625](AcademySoftwareFoundation/openexr#2625)
  Cleanup compression information routines (by @kdt3rd/Kimball Thurston)
* [2623](AcademySoftwareFoundation/openexr#2623)
  Zstd compression support (by @vlazar-ilm/Vlad Lazar)
* [2620](AcademySoftwareFoundation/openexr#2620)
  LJ2K: handle non-finite and out-of-bound samples gracefully (by @palemieux/Pierre-Anthony Lemieux)
* [2618](AcademySoftwareFoundation/openexr#2618)
  Update vendored libdeflate to 1.26 (by @cary-ilm/Cary Phillips)
* [2599](AcademySoftwareFoundation/openexr#2599)
  Add support for loss HTJ2K compressor (LJ2K) (by @palemieux/Pierre-Anthony Lemieux)
* [2581](AcademySoftwareFoundation/openexr#2581)
  Mark AcesInputFile/AcesOutputFile and exr2aces as deprecated (by @cary-ilm/Cary Phillips)
* [2577](AcademySoftwareFoundation/openexr#2577)
  Revert "Add compression context cache (#2440)" (by @cary-ilm/Cary Phillips)
* [2560](AcademySoftwareFoundation/openexr#2560)
  Refine colorInteropID support (by @doug-walker/Doug Walker)
* [2525](AcademySoftwareFoundation/openexr#2525)
  Add check to avoid overflow, add tests for reading / writing many channels (by @kthurston/Kimball Thurston)
* [2453](AcademySoftwareFoundation/openexr#2453)
  Use std::deque for IDManifest storage to keep references stable (by @mshooter-ilm/Moira Shooter)
* [2443](AcademySoftwareFoundation/openexr#2443)
  Fix Imath include on CMake reconfigure (by @cary-ilm/Cary Phillips)
* [2440](AcademySoftwareFoundation/openexr#2440)
  Add compression context cache (by @kdt3rd/Kimball Thurston)
* [2435](AcademySoftwareFoundation/openexr#2435)
  Add setMaxImageSize/setMaxTileSize to python module (by @cary-ilm/Cary Phillips)
* [2432](AcademySoftwareFoundation/openexr#2432)
  Add Python bindings for idManifest (IDManifest) header attribute (by @mshooter-ilm/Moira Shooter)
* [2429](AcademySoftwareFoundation/openexr#2429)
  Check for xSize==0 in gaps fuzzer `part_exceeds_memory_limits` (by @cary-ilm/Cary Phillips)
* [2428](AcademySoftwareFoundation/openexr#2428)
  Add required includes to website examples (by @ijayhub/Ijay)
* [2419](AcademySoftwareFoundation/openexr#2419)
  Impose memory limits in `openexr_exrgaps_fuzzer` (by @cary-ilm/Cary Phillips)
* [2418](AcademySoftwareFoundation/openexr#2418)
  Add support for multithreading in Python module (by @cary-ilm/Cary Phillips)
* [2412](AcademySoftwareFoundation/openexr#2412)
  Ability to read/write from/to BytesIO buffers in Python API (by @mshooter-ilm/Moira Shooter)
* [2401](AcademySoftwareFoundation/openexr#2401)
  test/oss-fuzz: add `openexr_exrgaps_fuzzer` (by @jortles/Anthony Hurtado)
* [2391](AcademySoftwareFoundation/openexr#2391)
  Add new fuzzing harnesses that can be consumed by OSS-Fuzz (by @DavidKorczynski)
* [2384](AcademySoftwareFoundation/openexr#2384)
  Completing ChannelList Iterator API (by @Arcmantis18/ArcMantis)
* [2376](AcademySoftwareFoundation/openexr#2376)
  Include all Imath headers via #include <Imath/...> (by @cary-ilm/Cary Phillips)
* [2369](AcademySoftwareFoundation/openexr#2369)
  Clarify #include policy and make usage consistent (by @cary-ilm/Cary Phillips)
* [2309](AcademySoftwareFoundation/openexr#2309)
  Don't hardcode the python module install dir (by @antonio-rojas/Antonio Rojas)
* [2276](AcademySoftwareFoundation/openexr#2276)
  Build oss-fuzz via oss-fuzz_build.sh (by @cary-ilm/Cary Phillips)
* [2151](AcademySoftwareFoundation/openexr#2151)
  Remove iex_debugTrap() function (by @cary-ilm/Cary Phillips)
* [2143](AcademySoftwareFoundation/openexr#2143)
  Make the release.py generic, so it works with Imath (by @cary-ilm/Cary Phillips)
* [2117](AcademySoftwareFoundation/openexr#2117)
  Bump version on main branch to 4.0.0 (by @cary-ilm/Cary Phillips)

### Documentation Pull Requests

* [2652](AcademySoftwareFoundation/openexr#2652)
  website: improve documentation code and equation formatting (by @QuantaDude/Abhirup Bhattacharyya)
* [2651](AcademySoftwareFoundation/openexr#2651)
  Set 'align: left' for tables that had central text alignment in
  TechnicalIntroduction.rst for better formatting (by @dmitryshurov/Dmitry Shurov)
* [2649](AcademySoftwareFoundation/openexr#2649)
  website: document LJ2K compression (by @QuantaDude/Abhirup Bhattacharyya)
* [2647](AcademySoftwareFoundation/openexr#2647)
  website: compile documentation examples independently (by @QuantaDude/Abhirup Bhattacharyya)
* [2638](AcademySoftwareFoundation/openexr#2638)
  Release notes for v3.5.0 (by @cary-ilm/Cary Phillips)
* [2634](AcademySoftwareFoundation/openexr#2634)
  docs: Fix SECURITY.md formatting (by @lgritz/Larry Gritz)
* [2624](AcademySoftwareFoundation/openexr#2624)
  Release notes and news for v3.4.15, v3.3.14, v3.2.12 (by @cary-ilm/Cary Phillips)
* [2580](AcademySoftwareFoundation/openexr#2580)
  Release notes and news for v3.4.14, v3.3.13, v3.2.11 (by @cary-ilm/Cary Phillips)
* [2549](AcademySoftwareFoundation/openexr#2549)
  Fix broken links identified in ASWF Health Check 2026 (by @cary-ilm/Cary Phillips)
* [2512](AcademySoftwareFoundation/openexr#2512)
  Update security policy regarding CVE requests (by @cary-ilm/Cary Phillips)
* [2501](AcademySoftwareFoundation/openexr#2501)
  Update SECURITY.md with CVE fixes from v3.4.12 and 3.4.13 (by @cary-ilm/Cary Phillips)
* [2497](AcademySoftwareFoundation/openexr#2497)
  Release notes and news for v3.4.13, v3.3.12, and v3.2.10 (by @cary-ilm/Cary Phillips)
* [2322](AcademySoftwareFoundation/openexr#2322)
  news and release notes for v3.4.8 and v3.4.7 (by @cary-ilm/Cary Phillips)
* [2280](AcademySoftwareFoundation/openexr#2280)
  release notes and news for 3.4.6, 3.3.8, and 3.2.6 (by @cary-ilm/Cary Phillips)
* [2275](AcademySoftwareFoundation/openexr#2275)
  Fix install doc to note vendored OpenJPH started with v3.4.6 (by @cary-ilm/Cary Phillips)
* [2203](AcademySoftwareFoundation/openexr#2203)
  V3.4.4 news (by @cary-ilm/Cary Phillips)
* [2195](AcademySoftwareFoundation/openexr#2195)
  Add copyright notices to website example code (by @cary-ilm/Cary Phillips)
* [2172](AcademySoftwareFoundation/openexr#2172)
  release notes and news for v3.4.3, v3.3.6, and 3.2.5 (by @cary-ilm/Cary Phillips)
* [2152](AcademySoftwareFoundation/openexr#2152)
  Release notes and news for v3.4.2 (by @cary-ilm/Cary Phillips)

### Merged Workflow Pull Requests

* [2636](AcademySoftwareFoundation/openexr#2636)
  Bump vmactions/freebsd-vm from 1.5.5 to 1.5.6
* [2635](AcademySoftwareFoundation/openexr#2635)
  Bump the codeql group with 3 updates
* [2631](AcademySoftwareFoundation/openexr#2631)
  Add Windows ARM64 Python wheel CI (by @xieofxie)
* [2630](AcademySoftwareFoundation/openexr#2630)
  Bump pypa/cibuildwheel from 4.2.0 to 4.2.1
* [2576](AcademySoftwareFoundation/openexr#2576)
  Bump pypa/cibuildwheel from 4.1.1 to 4.2.0
* [2559](AcademySoftwareFoundation/openexr#2559)
  Bump pypa/cibuildwheel from 4.1.0 to 4.1.1
* [2537](AcademySoftwareFoundation/openexr#2537)
  Bump the codeql group with 3 updates
* [2523](AcademySoftwareFoundation/openexr#2523)
  Group CodeQL GitHub Actions bumps in Dependabot. (by @cary-ilm/Cary Phillips)
* [2521](AcademySoftwareFoundation/openexr#2521)
  Bump github/codeql-action/init from 4.36.2 to 4.36.3
* [2520](AcademySoftwareFoundation/openexr#2520)
  Bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3
* [2519](AcademySoftwareFoundation/openexr#2519)
  Bump github/codeql-action/analyze from 4.36.2 to 4.36.3
* [2477](AcademySoftwareFoundation/openexr#2477)
  Drop support for Python 3.8 (by @cary-ilm/Cary Phillips)
* [2475](AcademySoftwareFoundation/openexr#2475)
  Bump pypa/cibuildwheel from 3.4.1 to 4.1.0
* [2459](AcademySoftwareFoundation/openexr#2459)
  Bump github/codeql-action from 4.36.0 to 4.36.2
* [2455](AcademySoftwareFoundation/openexr#2455)
  Bump actions/checkout from 6.0.2 to 6.0.3
* [2446](AcademySoftwareFoundation/openexr#2446)
  Bump openjph from 0.27.0 to 0.27.3.bcr.1
* [2410](AcademySoftwareFoundation/openexr#2410)
  Add missing quotes around ENV in src/test/oss-fuzz/CMakeLists.txt (by @cary-ilm/Cary Phillips)
* [2400](AcademySoftwareFoundation/openexr#2400)
  Bump openjph from 0.26.3.bcr.1 to 0.27.0
* [2386](AcademySoftwareFoundation/openexr#2386)
  Bump rules_cc from 0.2.17 to 0.2.18
* [2371](AcademySoftwareFoundation/openexr#2371)
  Bump packaging from 26.0 to 26.1
* [2348](AcademySoftwareFoundation/openexr#2348)
  Bump requests from 2.32.5 to 2.33.0 in /website
* [2347](AcademySoftwareFoundation/openexr#2347)
  Bump pygments from 2.19.2 to 2.20.0 in /website
* [2286](AcademySoftwareFoundation/openexr#2286)
  Bump github/codeql-action from 4.32.4 to 4.32.5
* [2285](AcademySoftwareFoundation/openexr#2285)
  Bump scikit-build-core from 0.11.6 to 0.12.1
* [2284](AcademySoftwareFoundation/openexr#2284)
  Bump jmertic/slack-release-notifier from 5221a45213eddc6206886797beb079e091c93406 to 6fa159048d5313ff1177d248ad84beb627571670
* [2278](AcademySoftwareFoundation/openexr#2278)
  Bump actions/download-artifact from 7.0.0 to 8.0.0
* [2277](AcademySoftwareFoundation/openexr#2277)
  Bump actions/upload-artifact from 6.0.0 to 7.0.0
* [2206](AcademySoftwareFoundation/openexr#2206)
  Bump openjph from 0.25.2 to 0.25.3
* [2179](AcademySoftwareFoundation/openexr#2179)
  Bump readthedocs/actions from 1.2 to 1.5
* [2116](AcademySoftwareFoundation/openexr#2116)
  CI fixes: (by @cary-ilm/Cary Phillips)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

v3.5.1

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@cary-ilm @vlazar-ilm