v3.1.17.0

Release 3.1.17.0 (Sep 1, 2026) -- compared to 3.1.16.0

• raw: Add raw:thumbnail_index and raw:thumbnail_sort hints to select a specific embedded thumbnail, plus assorted thumbnail fixes and unit tests. #5334 (by @antond-weta / Anton Dukhovnikov)
• raw: Allow vector types in multi-value hints (white balance as a float4, cropbox/greybox as int2 boxes). #5386 (by @antond-weta / Anton Dukhovnikov)
• raw: Fix undebayered flip mapping, buffer bounds, and overflow issues. #5415
• exr: Convert mixed-native-integer-depth channels through proper rescaling instead of reinterpreting bytes when writing OpenEXR (also fixes copy_image and iconvert native fast paths). #5340 (by @lgritz / Larry Gritz)
• oiiotool: More robust handling of failed reads: preserve the reader's specific error message instead of a generic "file not found", don't dereference specs of a failed read, and safer error message marshalling. #5380 #5377 #5401 (by @lgritz / Larry Gritz)
• IBA: Detect iterator read errors in orientation functions (flip, flop, rotate90/180/270, transpose). #5355 (by @luna-y-kim / Luna Kim)
• writers: Don't write thumbnail_* metadata to formats that can't hold a thumbnail. #5357 (by @jinhgkim / Jinnie Kim)
• readers: Use check_open() and check_compression_ratio() in all readers that lacked them, guarding against decompression bombs and implausible header dimensions. #5342 (by @lgritz / Larry Gritz)
• bmp: Decompression-bomb guard, UB-safe height negation, and scanline bounds checks. #5371 (by @lgritz / Larry Gritz)
• exif: Harden the shared Exif decoder against malformed input (affects all formats that embed Exif). #5399 (by @lgritz / Larry Gritz)
• ffmpeg: Fix heap bounds, bad packet handling, add checks at open, and other fixes. #5406 (by @lgritz / Larry Gritz)
• fits: Validate the NAXIS count against the permitted 0-999 range. #5370 (by @lgritz / Larry Gritz)
• gif: Reject a short graphics-control extension block. #5366 (by @lgritz / Larry Gritz)
• icc: Fix out-of-bounds pointer formation, use alignment-safe reads, and 64-bit tag bounds in the shared ICC profile decoder (jpeg, png, tiff, webp, jpeg2000, psd). #5417 (by @lgritz / Larry Gritz)
• jpeg: More detection of corrupt files. #5376 (by @lgritz / Larry Gritz)
• jpegxl: Harden against corrupt input. #5378 (by @lgritz / Larry Gritz)
• pnm: Use 64-bit scanline math to avoid integer overflow. #5344 (by @lgritz / Larry Gritz)
• psd: Harden reader against oversized/bomb headers and ZIP-layer buffer overflow. #5348 (by @lgritz / Larry Gritz)
• ptex: Guard null face-data returns; add malformed-header tests. #5365 (by @lgritz / Larry Gritz)
• rla: Terminate the subimage chain and bounds-check the offset table. #5403 (by @lgritz / Larry Gritz)
• tiff: Hardening: prevent OOB read on failed raw-strip reads, 64-bit overflow protection. #5336 (by @lgritz / Larry Gritz)
• xmp: Fix encode_xmp() for aliased metadata names such as IPTC:Rating / xmp:Rating. #5108 (by @Qi-fly)
• zfile: Check gzread returns for truncated or corrupt input. #5372
• fix: When reading xmp, bound decode recursion and growth, escape encoder output. #5405 (by @lgritz / Larry Gritz)
• fix: Fix ImageBuf error message with too few format arguments aborting. #5343
• fix: OpenColorIO exception safety improvements. #5428
• fix: Improve ImageSpec::default_channel_names nchannels safety. #5368
• simd.h: Fix NEON vfloat4::load(values,n) reading past the end of the buffer. #5404
• simd.h: Fill in missing NEON paths in simd.h. #5412
• simd.h: Treat Windows ARM64EC builds as ARM so the NEON path is taken. #5369 (by @wayne-arnold-adsk / Wayne Arnold)
• filesystem.h: Use 64-bit file offsets on Windows. #5354 (by @Maxi741cv / Mixie)
• threads.h: Annotate spin_mutex and spin_rw_mutex for ThreadSanitizer. #5429 (by @NathanGray-ChurchillNavigation / Nathan Gray)
• build: Fix declaration mismatch for unity builds on Windows. #5360
• build: Guard libtiff's missing Deflate target. #5313 (by @zachlewis / Zach Lewis)
• build: Fix CLANG_FORMAT_INCLUDES targets. #5373 (by @jinhgkim / Jinnie Kim)
• deps: Raise LibRaw recommended minimum to 0.21.3 (hard minimum still 0.20.0). #5383
• ci: Update all GHA actions to the latest versions. #5381
• docs: Correct Doxygen style comments in IOProxy. #5347
• Contributors: First-time contributors to this release: Mixie, Nathan Gray, Qi-fly.