[BrewTestBot]

Created by brew bump

---

Created with brew bump-formula-pr.

Details

release notes

Release 3.2 (Oct 1, 2026) -- compared to 3.1
-------------------------------------------------------
- Beta 1 (3.2.0.3-beta1): Sep 1, 2026
- Beta 2 (3.2.0.4-beta2): Sep 15, 2026
- Release Candidate 1 (3.2.0.5-RC1): Sep 27, 2026
- v3.2.1.0 supported release: Oct 1, 2026
Executive Summary / Highlights

JPEG support for writing Ultra-HDR images.
FLIP perceptual image comparison via ImageBufAlgo::flip_diff() and

oiiotool --flipdiff.
Many color management improvements: use of Color Interop Forum (CIF)

staandardized names throughout, support for CICF codes in file formats

that allow them, better ICC profile R/W support.
Improved "thumbnail image" support by several image file formats, and via

new oiiotool commands for adding and extracting thumbnails.
Dozens and dozens of security/bug improvements to harden the various file

format readers against corrupted or malicious image file input.
Switch Python bindings to nanobind

by defalt.
New ABI version namespacing scheme makes 3.2 fully API, ABI, and link

compatible with OpenImageIO 3.1.

ABI backwards-compatibility -- NO CHANGE
Unlike previous yearly releases. OpenImageIO 3.2 is 100% backward compatible

with 3.1 releases in its API and also ABI / link compatibility. There may be

new functionality added, but any API call supported by 3.1 still exists and is

link compatible.
This means, for example, that if you are making a large appication that

currently embeds OpenImageIO 3.1 and exposes its APIs to user-written dynamic

plugins/modules (so that they can make calls to the built-in OIIO), your app

can upgrade to OpenImageIO 3.2 without losing compatibility with those plugins

-- all the link symbols that existed before continue to exist with the same

call signatures.
New minimum dependencies and compatibility changes:

The deprecated icc compiler is no longer supported. (3.2.0.0)
CMake: Minimum 3.18 -> 3.23. #5394 (3.2.0.3)
fmt: Minimum 7.0 -> 9.0.
libjpeg: Minimum 8 -> 9. Note that libjpeg-turbo 2.1+ still satisfies this. #5432 (3.2.0.3)
LibRaw: Minimum 0.20.0 -> 0.21.0
libtiff: Minimum 4.0 -> 4.1. #5414 (3.2.0.3)
DCMTK (optional, DICOM support): Minimum 3.6.1 -> 3.6.2. #5438 (3.2.0.3)
SIMD baseline: Builds targeting x86-64 now default to an SSE4.2 instruction baseline (USE_SIMD=sse4.2) instead of inheriting the compiler default (often plain SSE2), so OIIO's SSE4 fast paths are used out of the box. Every x86-64 CPU since 2008 has SSE4.2. Use USE_SIMD=0 to disable SIMD or USE_SIMD=sse2 for the old behavior. USE_SIMD is also now architecture-aware, so x86 tokens no longer leak into ARM builds. #5411 (3.2.0.3)
Python bindings: The default binding backend is now nanobind rather than pybind11; configure with -DOIIO_PYTHON_BINDINGS_BACKEND=pybind11 to keep the old backend. #5430 (3.2.0.3)

⛰️  New features and public API changes:

New image file format support:

jpeg: Support writing Ultra HDR images (previously only reading was supported). #5335 (by @mugulmd / Loïc Vital)
openexr: Add support for the lj2k (lossy, JPEG2000-based) and zstd OpenEXR compression modes, when OIIO is built with OpenEXR 3.5 or later. #5495 (by @QuantaDude / Abhirup Bhattacharyya) (3.2.0.5) #5520 (3.2.1.0)


oiiotool new features and major improvements:

--flipdiff computes the FLIP perceptual difference between two images,

prints statistics, and leaves the error map on the image stack for further

processing or saving. #5154 #5171 (by @lgritz / Larry Gritz) (3.2.0.1)
--nchannels specifies the number of output channels, for parity with maketx. #5198 (by @grdanny / Danny Greenstein) (3.2.0.3, 3.1.14.0)
oiiotool commands taking offsets or geometry arguments now accept commas as alternative separators (e.g., X,Y or WxH,X,Y in addition to the X11-style +X+Y form). This affects --create, --crop, --cut, --fit, --fullsize, --origin, --originoffset, --paste, --pattern, --printstats, --resize. #5209 (3.2.0.3, 3.1.14.0)
oiiotool --decorrstretch applies a decorrelation stretch (see the explanation of IBA::decorr_stretch()). #5478 (3.2.0.5) (@lgritz / Larry Gritz)
--experimental enables opt-in trial features not yet part of the stable API, signaling that such behaviors may change between releases. #5147 (3.2.0.1, 3.1.13.0)
Expressions gain a string-formatting operator: format('{}...', val, ...) applies standard std::format/Python-style replacement fields (e.g. {}, {:+}, {:04d}, {:.2f}) to the values that follow, so e.g. format('{:+}{:+}', 3, -4) returns "+3-4". #5481 (by @nafisab / Nafisa Baker) #5486 (3.2.0.5)


Command line utilities:

iv: Flip, rotate and save image #5003 (by @vangeliq / Valery Angelique) (3.2.0.0, 3.1.11.0)
iv: Image wipe compare, to interactively reveal one image over another. Use the w hotkey! #5480 (by @nshelton / Nick Shelton) (3.2.0.5)
iv: Tolerate partially-written EXR files -- display, with a note about missing data on the status line. iv --missing-pixels {tolerate,strict} selects the behavior from the command line. #5463 (by @linsen458-spec / Ethan Lin) (3.2.0.5)
iv: "Save window" now saves only the visible region instead of the whole image. #5479 (by @orelsin / Aurele Boquet) (3.2.0.5)
iconvert: Allow -o outfile for output file designation, for parity with oiiotool syntax. #5173 (3.2.0.3, 3.1.14.0)


ImageBuf/ImageBufAlgo:

ImageBufAlgo::FLIP_diff() computes the FLIP (perceptual Image

difference Predictor) metric between two LDR or HDR images. The result is

a single-channel float image with per-pixel FLIP error in [0,1]. A

FLIPResults struct returns mean error, max error, and location. The

optional colormap kwarg applies a false-color map to the result.

FLIP_ppd() helper computes pixels-per-degree for a given display setup.

Python bindings and oiiotool --flipdiff are also provided.

#5154 #5171 #5331 (3.2.0.1)
ImageBuf::localpixels_as_[writable_]byte_image_span #5011 (3.2.0.0, 3.1.10.0)
IBA::decorr_stretch() applies a decorrelation stretch, which exaggerates subtle color variation in images whose channels are highly correlated (hazy aerial photographs, rock faces, faded pigments), with optional percentile-based contrast stretch and a choice of covariance or correlation matrix mode. #5478 (3.2.0.5) (@lgritz / Larry Gritz)


ImageCache/TextureSystem:

texture: Experimental GPU texture system prototype, implemented as a standalone testsuite executable that doesn't modify the core library. It validates a proposed host/device architecture end to end -- request-driven texture lookup, residency updates, retry flow, filtering, and output generation -- to inform eventual promotion of pieces into library code. See README.md/SPEC.md in the testsuite entry for design details. #5228 (by @aconty / Alejandro Conty) (3.2.0.3, 3.1.16.0)


New global attribute queries via OIIO::getattribute():

limits:resolution (default: 1048576) caps the maximum number of pixels along any single image dimension. ImageInput::check_open rejects files exceeding it. This complements limits:imagesize_MB to catch corrupt headers that are tiny in one dimension but absurdly large in another, which can defeat the total-pixel-memory check. #5297 (3.2.0.3, 3.1.16.0)


Miscellaneous API changes:

api: Versioned namespace to preserve ABI compatibility between minor releases #4869 (3.2.0.0)
ColorConfig: New isData() API method to query if a color space is a data space; fix Python isColorSpaceLinear(). #5191 (3.2.0.3, 3.1.14.0)
api: ImageSpec::size_t_safe() and ImageSpec::valid_tile_range() are now annotated OIIO_NODISCARD to warn callers not to ignore their return values. #5218 (by @zoomhunter2010 / Hunter) (3.2.0.3)
deepdata: Widen merge_deep_pixels()'s srcpixel parameter to int64_t, change its return type, and add OIIO_NODISCARD_ERROR. #5252 #5253 (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.15.0)
python: Add nanobind python bindings and use them as the new default. #5084 (by @soswow / Aleksandr Motsjonov) (3.2.0.1) #5254 (by @soswow / Aleksandr Motsjonov) (3.2.0.3) #5310 (by @soswow / Aleksandr Motsjonov) (3.2.0.3)  #5346 #5430 (3.2.0.3)


Color management improvements:

Fix some legacy 'Linear' color references, use CIF names exclusively #4959 (3.2.0.0)
Auto convert between oiio:ColorSpace and CICP attributes in I/O #4964 (by @brechtvl / Brecht Van Lommel) (3.0.14.0, 3.2.0.0)
openexr: Write OpenEXR colorInteropID metadata based on oiio:ColorSpace #4967 (by @brechtvl / Brecht Van Lommel) (3.0.14.0, 3.2.0.0)
For OCIO built-in configs, replace the default file rules with more sensible ones that avoid spurious matches (e.g., no longer assumes all .exr files use ACES2065-1 primaries). #5194 (3.2.0.3, 3.1.14.0)
Add g24_rec709_scene interop ID (from the CIF texture color space recommendation 1.1) to PNG write, TGA, and RLA for consistency with PNG read and DPX; also fix TGA/RLA writing g22_rec709/g18_rec709 without the _scene suffix. #5391 (by @brechtvl / Brecht Van Lommel)
Include inactive color spaces (e.g. the display spaces in older ACES configs bundled with OCIO 2.3) when looking up or converting to a named color space; add ColorConfig::isColorSpaceActive() to test activity. Inactive spaces remain hidden from iv's UI. #5387 (by @brechtvl / Brecht Van Lommel)
srgb_rec709_display is now a built-in color space alongside srgb_rec709_scene, so ite's available even with an OCIO config that doesn't define it; the built-in sRGB name remains an alias of srgb_rec709_scene. #5396 (by @brechtvl / Brecht Van Lommel)
Refactor color-space metadata writing to share logic across formats: new ImageSpec helpers is_colorspace_srgb(), get_colorspace_rec709_gamma(), get_colorspace_icc_profile(), and get_colorspace_cicp() replace logic each writer previously open-coded, and writing gamma metadata from an interop ID now works for display interop IDs too, not just scene ones. #5390 (by @brechtvl / Brecht Van Lommel) (3.2.0.3)
Make color interop IDs work with older OpenColorIO ACES configs by adding legacy aliases matching those in the OCIO ACES configs back to 1.0.0; previously only OCIO 2.5+ builds would correctly write color metadata in cases such as oiiotool --ociodisplay to an HDR or wide-gamut display space. #4971 (by @brechtvl / Brecht Van Lommel) (3.2.0.3)


Improved thubnail support:

oiiotool: --thumbnail-get (and -i:get_thumbnail=1) and --thumbnail-set commands to extract and attach embedded thumbnails (for those formats that support them). #5236 (by @jinhgkim / Jinnie Kim) (3.2.0.3, 3.1.16.0)
openexr: Read support for the OpenEXR preview attribute (thumbnail) per subimage, exposing a latent ImageRec bug since EXR was the first multi-subimage format to support thumbnails. #5374 (by @jinhgkim / Jinnie Kim)



🚀  Performance improvements

perf: ImageBufAlgo::resample and oiiotool --resample improvements to speed up 20x or more #4993 (3.2.0.0, 3.1.10.0)
perf: Reduce redundant file re-opening attempts when a file fails to open. #5267 (3.2.0.3)
perf: ImageBufAlgo::resample() and oiiotool --resample precompute the destination-to-source pixel mapping into per-axis tables instead of recomputing it per pixel, roughly 2-3x faster for the common in-memory cases (nearest and bilinear). Also fixes nearest-mode resample incorrectly routing through the always-bilinear Highway path. #5395 #5393 (by @wingfiring / Jackson Sun) (3.2.0.3)
perf: On ARM, speed up some SIMD operations. #5412 (3.2.0.3, 3.1.17.0)

🐛  Fixes and feature enhancements

deepdata: Correct the Zback channel in sort(); change int pixel to int64_t. #5241 (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.15.0)
iinfo: Better error handling and propagation, especially from --hash; fix return code when a file could not be read #5168 (3.2.0.1, 3.1.13.0)
ImageBuf: Fix set_pixels bug, didn't consider roi = All #4949 (3.2.0.1)
ImageBuf: Copy ctor of an ImageCache-backed ImageBuf zeroed the bufspan strides. #5244 (3.2.0.3, 3.1.15.0)
ImageBuf: Fix a crash/abort when an error message format string was passed too few arguments. #5343 (3.2.0.3, 3.1.17.0)
ImageBuf: Fix a data race that could corrupt multithreaded reads: m_pixels_valid (and m_spec_valid) were set true as soon as the buffer/spec were allocated, before being fully populated, so a lock-free reader on another thread could observe the flag true and read stale or empty data. The flags (and m_pixels_read) are now set only once their data is fully populated, and made atomic so lock-free readers get a proper memory barrier. #5325 (3.2.0.3, 3.1.16.0)
ImageBuf: Remove redundant and dead code found while investigating an IBA::reorient() bug: a stray flag reset that immediately undid m_badfile = true, a redundant validate_spec() call in orientation() (already called by spec()), and an unreachable condition in copy(). #5353 (by @luna-y-kim / Luna Kim) (3.2.0.3)
ImageBufAlgo: compare_Yee() accessed the wrong channel #4976 (by @pmady / Pavan Madduri) (3.2.0.0)
ImageBufAlgo: Handle offset data windows in fillholes_pushpull() #5105 (3.2.0.1, 3.1.12.0, 3.0.17.0)
ImageBufAlgo: Detect ImageBuf::ConstIterator read errors in the orientation functions (flip, flop, rotate90/180/270, transpose), previously silently ignored. #5355 (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.17.0)
ImageBufAlgo: reorient() had orientations 5 and 7 swapped (transverse and transpose). #5350 (by @luna-y-kim / Luna Kim)
ImageBufAlgo: ImageBufAlgo::make_texture() now honors "maketx:threads" hint #5014 (3.2.0.0, 3.1.10.0)
ImageInput: check_open fixes and new checks #5087 (3.2.0.1, 3.1.12.0, 3.0.17.0)
ImageInput: Guarantee that a plugin left in a fresh, never-opened state (as if close() were called) when open() fails, clarifying and enforcing a previously ambiguous contract. #5398
ImageInput/ImageOutput: Fix a subtle per-instance error-message leak. #5276 (3.2.0.3)
ImageInput: Ignore invalid RowsPerStrip chunking. #5300 (by @br0nzu / Dongju Lee) (3.2.0.3)
ImageInput: Consolidate the decompression-bomb guard (previously TIFF-specific) into ImageInput::check_compression_ratio() so it can be reused uniformly by other format readers. #5328 (3.2.0.3, 3.1.16.0)
ImageInput: Apply check_open() and check_compression_ratio() consistently across the format readers that previously lacked them (cineon, dds, dpx, fits, gif, hdr, heif, ico, iff, jpeg, null, openexr, png, pnm, rla, sgi, softimage, webp, zfile), so a small malformed file can't drive a large pixel allocation before any pixel data is read; also add a check_open() validity test for non-negative, non-oversized tile sizes, and a batch of new decompression-bomb/extent regression tests and fuzz corpora. #5342 (3.2.0.3, 3.1.17.0)
ImageInput: Fix: Across all readers, care that a rejected subimage doesn't leave the reader in an internally inconsistent state. #5470 (3.2.0.5)
ImageOutput: Don't write thumbnail_* metadata to formats that can't hold a thumbnail; iconvert was leaking these attributes from a thumbnail-capable source into the output spec even when the destination format doesn't support thumbnails (oiiotool already stripped them). The stripping now lives in ImageOutput::check_open(). #5357 (by @jinhgkim / Jinnie Kim) (3.2.0.3, 3.1.17.0)
ImageSpec: ImageSpec::default_channel_names() now validates nchannels before the reserve()-driven allocation it performs. #5368 (3.2.0.3, 3.1.17.0)
ImageSpec: metadata_val improved safety #5096 (3.2.0.1, 3.1.12.0, 3.0.17.0)
ImageSpec: get_string_attribute() now correctly converts non-string attributes to string (previously it only found attributes already stored as strings) #5161 (3.2.0.1, 3.1.13.0, 3.0.18.0)
oiiotool: --buildinfo misreported platform on MSVS #5027 (3.2.0.0, 3.1.11.0)
oiiotool: Fix expression BOTTOM when there are exactly two images #5046 (3.2.0.0, 3.1.11.0)
oiiotool: -d SUBIMAGENAME.* didn't work properly #5048 (3.2.0.0, 3.1.11.0)
oiiotool: Make sure oiiotool --compression does expression substitution #5055 (3.2.0.0, 3.1.11.0)
oiiotool: Better type understanding with -i:ch= and other related cleanup #5056 (3.2.0.1, 3.1.12.0)
oiiotool: Be more cautious about implicit promotion to float when --autocc is used alongside explicit color space names. #5192 (3.2.0.3, 3.1.14.0)
oiiotool: Don't dereference the ImageSpec of a failed read. #5377 (3.2.0.3, 3.1.17.0)
oiiotool: A failed read (no reader could open the file) reported a generic "file not found" even when the format reader had a more specific error; now surfaces the reader's actual message, matching what iinfo already reported. #5380 (3.2.0.3, 3.1.17.0)
oiiotool: Minor safety fix: don't pass a plain string through Strutil::format(). #5401 (3.2.0.3, 3.1.17.0)
idiff: Fail on pixel read errors instead of silently comparing garbage. #5503 (3.2.0.5)
texture: Fix texture overblur with st-blur parameters #5071 #5080 (by @lecocqp / Pascal Lecocq) (3.2.0.1, 3.1.12.0, 3.0.17.0)
exif: Support EXIF 3.0 tags (for all formats) #4961 (3.2.0.1)
exif: Beef up corrupted Exif block error detection: used for the JPEG, PNG, WebP, and Heif readers, not just silently skipped. #5322 (3.2.0.3, 3.1.16.0) #5399 (3.2.0.3, 3.1.17.0)
icc: Audit of the shared ICC-profile decoder (used by jpeg, png, tiff, webp, jpeg2000, psd): fix out-of-bounds pointer formation from file-controlled offsets (check the range in 64-bit first, then form the pointer), and replace every misaligned scalar field load with memcpy. #5417 (3.2.0.3, 3.1.17.0)
xmp: Correctly parse XMP with self-closing <rdf:Description ... /> elements (previously only </rdf:Description> end tags were recognized) #5106 (3.2.0.1, 3.1.13.0, 3.0.18.0)
xmp: Audit of XMP decode/encode (input is file-controlled via jpeg, png, tiff, psd, heif): cap decode recursion depth at 64, budget the attribute count and total payload size to stop a crafted file burning CPU/memory, and escape encoder output so an attribute value from an untrusted file cannot forge XML. #5405 (3.2.0.3, 3.1.17.0)
xmp: Fix encode_xmp() for aliased metadata names such as IPTC:Rating / xmp:Rating, which were silently dropped from the XMP write path. #5108 (by @Qi-fly) (3.2.0.2, 3.1.17.0)
bmp: Detect corrupt files where palette doesn't match bpp #5030 (3.2.0.0, 3.1.11.0)
bmp: Use check_open to guard against corrupt resolutions #5086 (3.2.0.1, 3.1.12.0, 3.0.17.0)
bmp: Correctly handle the combination of greyscale + RLE compression #5163 (3.2.0.1, 3.1.13.0, 3.0.18.0)
bmp: Validate scanline file position before reading, to catch corrupt files. #5274 (3.2.0.3)
bmp: check_compression_ratio() rejects a tiny file with implausibly high resolutions; negate the height field in 64-bit to avoid signed-overflow UB when the attacker-controlled height is INT32_MIN. #5371 (3.2.0.3, 3.1.17.0)
cineon: More robust to invalid numbers of channels and bit depths; also fixes a channel-naming counter bug and a memory leak in init(). CVE-2026-59181 #5250 (3.2.0.3, 3.1.15.0, 3.0.20.0)
cineon: Validate bit depth against libcineon's supported set. #5283 (3.2.0.3)
dds: Corruption protection: validate resolution and guard against integer overflow #5131 (3.2.0.1, 3.1.13.0, 3.0.18.0)
dds: Reject corrupt bytes-per-pixel values before they force a huge allocation. #5286 (3.2.0.3)
dds: Clamp pixel memcpy to sizeof(uint32_t) to prevent a stack overflow. #5287 (3.2.0.3)
dds: Check the return values of readimg_scanlines()/readimg_tiles(), previously ignored, so a failed or short decode is no longer copied out of the buffer as if it had succeeded. #5402
dicom: Enforce reasonable resolution limits to guard against corrupt files. #5167 (3.2.0.3, 3.1.14.0, 3.0.19.0)
dicom: Null-check DicomImage::getInterData()/getOutputData(), which can return null when a corrupt frame fails to decode. #5364
dpx: Detect corrupt userbuf size with an overflow guard. #5271 (3.2.0.3)
dpx: Fix a heap overflow in the 1-channel 10-bit filled scanline swap when less than a full group of 3 packed samples remained in bounds. #5298 (3.2.0.3, 3.1.16.0)
dpx: Don't add userdata that failed to read to the metadata. #5467 (3.2.0.5)
dpx: Ignore end-of-line padding when writing. #5472 (3.2.0.5)
ffmpeg: 10 bit video had wrong green channel #4935 (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.7.0)
ffmpeg: Align swscale output buffers. #5301 (by @br0nzu / Dongju Lee) (3.2.0.3)
ffmpeg: Fixes: grayscale movies read past the end of the scanline buffer (nchannels left at 3 for a 1-plane gray frame), which also makes 16-bit gray files readable for the first time; refuse a mid-stream frame whose size or pixel format differs from the ImageSpec; add check_open()/check_compression_ratio() at open so a tiny file can't declare a gigabyte frame; and stop feeding an uninitialized AVPacket to av_read_frame() and looping forever on a bad stream. #5406 (3.2.0.3, 3.1.17.0)
fits: Fix recursion stack overflow from too many header blocks on corrupt files; convert to an iterative loop with a safety limit. CVE-2026-59156 #5248 (3.2.0.3, 3.1.15.0, 3.0.20.0)
fits: Reject a NAXIS value outside the FITS-permitted 0-999 range before using it to size internal arrays, and fail cleanly on an unsupported BITPIX rather than proceeding with a zero-sized pixel type. #5370 (3.2.0.3, 3.1.17.0)
fits: Fix the guessed layout for 3D color images: FITS has no formal notion of color channels, and OIIO's assumption (NAXIS1 = nchannels, interleaved) doesn't match any real-world FITS software; switch to the universal convention (NAXIS3 = nchannels, one full-resolution plane per channel). #5385
fits: Avoid an out-of-range float-to-int conversion (UB) when storing a header value that doesn't fit in an int. #5497 (3.2.0.5)
gif: Preserve RGB values of transparent-indexed pixels (previously only alpha was set, zeroing the RGB channels). #5188 (by @adskWangl / Lumina Wang) (3.2.0.3, 3.1.14.0)
gif: Handle empty error string from gif_lib. #5269 (3.2.0.3)
gif: Hardening against corruptions: bad resolutions and integer overflow #5257 (3.2.0.3), int32 overflow in palette-split pixel-count math.#5292 (3.2.0.3), canvas index overflow. #5299 (by @br0nzu / Dongju Lee) (3.2.0.3), graphics-control extension block that declares fewer than the 4 bytes a well-formed block carries. #5366 (3.2.0.3, 3.1.17.0)
hdr: Hardening: tolerate CR characters in the ASCII header.#5261 (3.2.0.3, 3.1.15.0), validate resolution to detect corrupted files #5256 (3.2.0.3).
hdr: Resolve a format-detection conflict between the HDR and RAW readers for .hdr files: the rare Hasselblad raw extension collides with Radiance HDR, and with EMBEDPLUGINS=0 giving the raw reader first crack at .hdr files, older libraw versions would crash trying to open a Radiance file. Remove the rarely-used .hdr ext...

View the full release notes at https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.2.1.0.

---

[github-actions]

🤖 An automated task has requested bottles to be published to this PR.

Caution

Please do not push to this PR branch before the bottle commits have been pushed, as this results in a state that is difficult to recover from. If you need to resolve a merge conflict, please use a merge commit. Do not force-push to this PR branch.