Skip to content

v3.2.0.3-beta1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@lgritz lgritz released this 02 Sep 18:30
· 0 commits to main since this release
v3.2.0.3-beta1
This tag was signed with the committer’s verified signature.
lgritz Larry Gritz
GPG key ID: 31C50BB2E9C76BEA
Verified
Learn about vigilant mode.
45414c1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This is a pre-release beta of the 3.2 family. We are aiming to be out of beta and consider this the new supported release family for the next yer, beginning on Oct 1.

Release 3.2 (target: Oct 1, 2026) -- compared to 3.1

  • Beta 1 (3.2.0.3-beta1): Sep 1, 2026

Executive Summary / Highlights

  • JPEG support for writing Ultra-HDR images.
  • FLIP perceptual image comparison via ImageBufAlgo::flip_diff() and
    oiiotool --flipdiff.
  • Many color management improvements: use of Color Interop Forum (CIF)
    staandardized names throughout, support for CICF codes in file formats
    that allow them, better ICC profile R/W support.
  • Improved "thumbnail image" support by several image file formats, and via
    new oiiotool commands for adding and extracting thumbnails.
  • Dozens and dozens of security/bug improvements to harden the various file
    format readers against corrupted or malicious image file input.
  • Switch Python bindings to nanobind
    by defalt.
  • New ABI version namespacing scheme makes 3.2 fully API, ABI, and link
    compatible with OpenImageIO 3.1.

ABI backwards-compatibility -- NO CHANGE

Unlike previous yearly releases. OpenImageIO 3.2 is 100% backward compatible
with 3.1 releases in its API and also ABI / link compatibility. There may be
new functionality added, but any API call supported by 3.1 still exists and is
link compatible.

This means, for example, that if you are making a large appication that
currently embeds OpenImageIO 3.1 and exposes its APIs to user-written dynamic
plugins/modules (so that they can make calls to the built-in OIIO), your app
can upgrade to OpenImageIO 3.2 without losing compatibility with those plugins
-- all the link symbols that existed before continue to exist with the same
call signatures.

New minimum dependencies and compatibility changes:

  • The deprecated icc compiler is no longer supported. (3.2.0.0)
  • CMake: Minimum 3.18 -> 3.23. #5394 (3.2.0.3)
  • fmt: Minimum 7.0 -> 9.0.
  • libjpeg: Minimum 8 -> 9. Note that libjpeg-turbo 2.1+ still satisfies this. #5432 (3.2.0.3)
  • LibRaw: Minimum 0.20.0 -> 0.21.0
  • libtiff: Minimum 4.0 -> 4.1. #5414 (3.2.0.3)
  • DCMTK (optional, DICOM support): Minimum 3.6.1 -> 3.6.2. #5438 (3.2.0.3)
  • SIMD baseline: Builds targeting x86-64 now default to an SSE4.2 instruction baseline (USE_SIMD=sse4.2) instead of inheriting the compiler default (often plain SSE2), so OIIO's SSE4 fast paths are used out of the box. Every x86-64 CPU since 2008 has SSE4.2. Use USE_SIMD=0 to disable SIMD or USE_SIMD=sse2 for the old behavior. USE_SIMD is also now architecture-aware, so x86 tokens no longer leak into ARM builds. #5411 (3.2.0.3)
  • Python bindings: The default binding backend is now nanobind rather than pybind11; configure with -DOIIO_PYTHON_BINDINGS_BACKEND=pybind11 to keep the old backend. #5430 (3.2.0.3)

⛰️ New features and public API changes:

  • New image file format support:
    • jpeg: Support writing Ultra HDR images (previously only reading was supported). #5335 (by @mugulmd / Loïc Vital)
  • oiiotool new features and major improvements:
    • --flipdiff computes the FLIP perceptual difference between two images,
      prints statistics, and leaves the error map on the image stack for further
      processing or saving. #5154 #5171 (by @lgritz / Larry Gritz) (3.2.0.1)
    • --nchannels specifies the number of output channels, for parity with maketx. #5198 (by @grdanny / Danny Greenstein) (3.2.0.3, 3.1.14.0)
    • oiiotool commands taking offsets or geometry arguments now accept commas as alternative separators (e.g., X,Y or WxH,X,Y in addition to the X11-style +X+Y form). This affects --create, --crop, --cut, --fit, --fullsize, --origin, --originoffset, --paste, --pattern, --printstats, --resize. #5209 (3.2.0.3, 3.1.14.0)
    • --experimental enables opt-in trial features not yet part of the stable API, signaling that such behaviors may change between releases. #5147 (3.2.0.1, 3.1.13.0)
  • Command line utilities:
    • iv: Flip, rotate and save image #5003 (by @vangeliq / Valery Angelique) (3.2.0.0, 3.1.11.0)
    • iconvert: Allow -o outfile for output file designation, for parity with oiiotool syntax. #5173 (3.2.0.3, 3.1.14.0)
  • ImageBuf/ImageBufAlgo:
    • ImageBufAlgo::FLIP_diff() computes the FLIP (perceptual Image
      difference Predictor) metric between two LDR or HDR images. The result is
      a single-channel float image with per-pixel FLIP error in [0,1]. A
      FLIPResults struct returns mean error, max error, and location. The
      optional colormap kwarg applies a false-color map to the result.
      FLIP_ppd() helper computes pixels-per-degree for a given display setup.
      Python bindings and oiiotool --flipdiff are also provided.
      #5154 #5171 #5331 (3.2.0.1)
    • ImageBuf::localpixels_as_[writable_]byte_image_span #5011 (3.2.0.0, 3.1.10.0)
  • ImageCache/TextureSystem:
    • texture: Experimental GPU texture system prototype, implemented as a standalone testsuite executable that doesn't modify the core library. It validates a proposed host/device architecture end to end -- request-driven texture lookup, residency updates, retry flow, filtering, and output generation -- to inform eventual promotion of pieces into library code. See README.md/SPEC.md in the testsuite entry for design details. #5228 (by @aconty / Alejandro Conty) (3.2.0.3, 3.1.16.0)
  • New global attribute queries via OIIO::getattribute():
    • limits:resolution (default: 1048576) caps the maximum number of pixels along any single image dimension. ImageInput::check_open rejects files exceeding it. This complements limits:imagesize_MB to catch corrupt headers that are tiny in one dimension but absurdly large in another, which can defeat the total-pixel-memory check. #5297 (3.2.0.3, 3.1.16.0)
  • Miscellaneous API changes:
    • api: Versioned namespace to preserve ABI compatibility between minor releases #4869 (3.2.0.0)
    • ColorConfig: New isData() API method to query if a color space is a data space; fix Python isColorSpaceLinear(). #5191 (3.2.0.3, 3.1.14.0)
    • api: ImageSpec::size_t_safe() and ImageSpec::valid_tile_range() are now annotated OIIO_NODISCARD to warn callers not to ignore their return values. #5218 (by @zoomhunter2010 / Hunter) (3.2.0.3)
    • deepdata: Widen merge_deep_pixels()'s srcpixel parameter to int64_t, change its return type, and add OIIO_NODISCARD_ERROR. #5252 #5253 (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.15.0)
    • python: Add nanobind python bindings and use them as the new default. #5084 (by @soswow / Aleksandr Motsjonov) (3.2.0.1) #5254 (by @soswow / Aleksandr Motsjonov) (3.2.0.3) #5310 (by @soswow / Aleksandr Motsjonov) (3.2.0.3) #5346 #5430 (3.2.0.3)
  • Color management improvements:
    • Fix some legacy 'Linear' color references, use CIF names exclusively #4959 (3.2.0.0)
    • Auto convert between oiio:ColorSpace and CICP attributes in I/O #4964 (by @brechtvl / Brecht Van Lommel) (3.0.14.0, 3.2.0.0)
    • openexr: Write OpenEXR colorInteropID metadata based on oiio:ColorSpace #4967 (by @brechtvl / Brecht Van Lommel) (3.0.14.0, 3.2.0.0)
    • For OCIO built-in configs, replace the default file rules with more sensible ones that avoid spurious matches (e.g., no longer assumes all .exr files use ACES2065-1 primaries). #5194 (3.2.0.3, 3.1.14.0)
    • Add g24_rec709_scene interop ID (from the CIF texture color space recommendation 1.1) to PNG write, TGA, and RLA for consistency with PNG read and DPX; also fix TGA/RLA writing g22_rec709/g18_rec709 without the _scene suffix. #5391 (by @brechtvl / Brecht Van Lommel)
    • Include inactive color spaces (e.g. the display spaces in older ACES configs bundled with OCIO 2.3) when looking up or converting to a named color space; add ColorConfig::isColorSpaceActive() to test activity. Inactive spaces remain hidden from iv's UI. #5387 (by @brechtvl / Brecht Van Lommel)
    • srgb_rec709_display is now a built-in color space alongside srgb_rec709_scene, so ite's available even with an OCIO config that doesn't define it; the built-in sRGB name remains an alias of srgb_rec709_scene. #5396 (by @brechtvl / Brecht Van Lommel)
    • Refactor color-space metadata writing to share logic across formats: new ImageSpec helpers is_colorspace_srgb(), get_colorspace_rec709_gamma(), get_colorspace_icc_profile(), and get_colorspace_cicp() replace logic each writer previously open-coded, and writing gamma metadata from an interop ID now works for display interop IDs too, not just scene ones. #5390 (by @brechtvl / Brecht Van Lommel) (3.2.0.3)
    • Make color interop IDs work with older OpenColorIO ACES configs by adding legacy aliases matching those in the OCIO ACES configs back to 1.0.0; previously only OCIO 2.5+ builds would correctly write color metadata in cases such as oiiotool --ociodisplay to an HDR or wide-gamut display space. #4971 (by @brechtvl / Brecht Van Lommel) (3.2.0.3)
  • Improved thubnail support:
    • --thumbnail-get (and -i:get_thumbnail=1) and --thumbnail-set commands to extract and attach embedded thumbnails (for those formats that support them). #5236 (by @jinhgkim / Jinnie Kim) (3.2.0.3, 3.1.16.0)
    • openexr: Read support for the OpenEXR preview attribute (thumbnail) per subimage, exposing a latent ImageRec bug since EXR was the first multi-subimage format to support thumbnails. #5374 (by @jinhgkim / Jinnie Kim)

🚀 Performance improvements

  • perf: ImageBufAlgo::resample and oiiotool --resample improvements to speed up 20x or more #4993 (3.2.0.0, 3.1.10.0)
  • perf: Reduce redundant file re-opening attempts when a file fails to open. #5267 (3.2.0.3)
  • perf: ImageBufAlgo::resample() and oiiotool --resample precompute the destination-to-source pixel mapping into per-axis tables instead of recomputing it per pixel, roughly 2-3x faster for the common in-memory cases (nearest and bilinear). Also fixes nearest-mode resample incorrectly routing through the always-bilinear Highway path. #5395 #5393 (by @wingfiring / Jackson Sun) (3.2.0.3)
  • perf: On ARM, speed up some SIMD operations. #5412 (3.2.0.3, 3.1.17.0)

🐛 Fixes and feature enhancements

  • deepdata: Correct the Zback channel in sort(); change int pixel to int64_t. #5241 (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.15.0)
  • iinfo: Better error handling and propagation, especially from --hash; fix return code when a file could not be read #5168 (3.2.0.1, 3.1.13.0)
  • ImageBuf: Fix set_pixels bug, didn't consider roi = All #4949 (3.2.0.1)
  • ImageBuf: Copy ctor of an ImageCache-backed ImageBuf zeroed the bufspan strides. #5244 (3.2.0.3, 3.1.15.0)
  • ImageBuf: Fix a crash/abort when an error message format string was passed too few arguments. #5343 (3.2.0.3, 3.1.17.0)
  • ImageBuf: Fix a data race that could corrupt multithreaded reads: m_pixels_valid (and m_spec_valid) were set true as soon as the buffer/spec were allocated, before being fully populated, so a lock-free reader on another thread could observe the flag true and read stale or empty data. The flags (and m_pixels_read) are now set only once their data is fully populated, and made atomic so lock-free readers get a proper memory barrier. #5325 (3.2.0.3, 3.1.16.0)
  • ImageBuf: Remove redundant and dead code found while investigating an IBA::reorient() bug: a stray flag reset that immediately undid m_badfile = true, a redundant validate_spec() call in orientation() (already called by spec()), and an unreachable condition in copy(). #5353 (by @luna-y-kim / Luna Kim) (3.2.0.3)
  • ImageBufAlgo: compare_Yee() accessed the wrong channel #4976 (by @pmady / Pavan Madduri) (3.2.0.0)
  • ImageBufAlgo: Handle offset data windows in fillholes_pushpull() #5105 (3.2.0.1, 3.1.12.0, 3.0.17.0)
  • ImageBufAlgo: Detect ImageBuf::ConstIterator read errors in the orientation functions (flip, flop, rotate90/180/270, transpose), previously silently ignored. #5355 (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.17.0)
  • ImageBufAlgo: reorient() had orientations 5 and 7 swapped (transverse and transpose). #5350 (by @luna-y-kim / Luna Kim)
  • ImageBufAlgo: ImageBufAlgo::make_texture() now honors "maketx:threads" hint #5014 (3.2.0.0, 3.1.10.0)
  • ImageInput: check_open fixes and new checks #5087 (3.2.0.1, 3.1.12.0, 3.0.17.0)
  • ImageInput: Guarantee that a plugin left in a fresh, never-opened state (as if close() were called) when open() fails, clarifying and enforcing a previously ambiguous contract. #5398
  • ImageInput/ImageOutput: Fix a subtle per-instance error-message leak. #5276 (3.2.0.3)
  • ImageInput: Ignore invalid RowsPerStrip chunking. #5300 (by @br0nzu / Dongju Lee) (3.2.0.3)
  • ImageInput: Consolidate the decompression-bomb guard (previously TIFF-specific) into ImageInput::check_compression_ratio() so it can be reused uniformly by other format readers. #5328 (3.2.0.3, 3.1.16.0)
  • ImageInput: Apply check_open() and check_compression_ratio() consistently across the format readers that previously lacked them (cineon, dds, dpx, fits, gif, hdr, heif, ico, iff, jpeg, null, openexr, png, pnm, rla, sgi, softimage, webp, zfile), so a small malformed file can't drive a large pixel allocation before any pixel data is read; also add a check_open() validity test for non-negative, non-oversized tile sizes, and a batch of new decompression-bomb/extent regression tests and fuzz corpora. #5342 (3.2.0.3, 3.1.17.0)
  • ImageOutput: Don't write thumbnail_* metadata to formats that can't hold a thumbnail; iconvert was leaking these attributes from a thumbnail-capable source into the output spec even when the destination format doesn't support thumbnails (oiiotool already stripped them). The stripping now lives in ImageOutput::check_open(). #5357 (by @jinhgkim / Jinnie Kim) (3.2.0.3, 3.1.17.0)
  • ImageSpec: ImageSpec::default_channel_names() now validates nchannels before the reserve()-driven allocation it performs. #5368 (3.2.0.3, 3.1.17.0)
  • ImageSpec: metadata_val improved safety #5096 (3.2.0.1, 3.1.12.0, 3.0.17.0)
  • ImageSpec: get_string_attribute() now correctly converts non-string attributes to string (previously it only found attributes already stored as strings) #5161 (3.2.0.1, 3.1.13.0, 3.0.18.0)
  • oiiotool: --buildinfo misreported platform on MSVS #5027 (3.2.0.0, 3.1.11.0)
  • oiiotool: Fix expression BOTTOM when there are exactly two images #5046 (3.2.0.0, 3.1.11.0)
  • oiiotool: -d SUBIMAGENAME.* didn't work properly #5048 (3.2.0.0, 3.1.11.0)
  • oiiotool: Make sure oiiotool --compression does expression substitution #5055 (3.2.0.0, 3.1.11.0)
  • oiiotool: Better type understanding with -i:ch= and other related cleanup #5056 (3.2.0.1, 3.1.12.0)
  • oiiotool: Be more cautious about implicit promotion to float when --autocc is used alongside explicit color space names. #5192 (3.2.0.3, 3.1.14.0)
  • oiiotool: Don't dereference the ImageSpec of a failed read. #5377 (3.2.0.3, 3.1.17.0)
  • oiiotool: A failed read (no reader could open the file) reported a generic "file not found" even when the format reader had a more specific error; now surfaces the reader's actual message, matching what iinfo already reported. #5380 (3.2.0.3, 3.1.17.0)
  • oiiotool: Minor safety fix: don't pass a plain string through Strutil::format(). #5401 (3.2.0.3, 3.1.17.0)
  • texture: Fix texture overblur with st-blur parameters #5071 #5080 (by @lecocqp / Pascal Lecocq) (3.2.0.1, 3.1.12.0, 3.0.17.0)
  • exif: Support EXIF 3.0 tags (for all formats) #4961 (3.2.0.1)
  • exif: Beef up corrupted Exif block error detection: used for the JPEG, PNG, WebP, and Heif readers, not just silently skipped. #5322 (3.2.0.3, 3.1.16.0) #5399 (3.2.0.3, 3.1.17.0)
  • icc: Audit of the shared ICC-profile decoder (used by jpeg, png, tiff, webp, jpeg2000, psd): fix out-of-bounds pointer formation from file-controlled offsets (check the range in 64-bit first, then form the pointer), and replace every misaligned scalar field load with memcpy. #5417 (3.2.0.3, 3.1.17.0)
  • xmp: Correctly parse XMP with self-closing <rdf:Description ... /> elements (previously only </rdf:Description> end tags were recognized) #5106 (3.2.0.1, 3.1.13.0, 3.0.18.0)
  • xmp: Audit of XMP decode/encode (input is file-controlled via jpeg, png, tiff, psd, heif): cap decode recursion depth at 64, budget the attribute count and total payload size to stop a crafted file burning CPU/memory, and escape encoder output so an attribute value from an untrusted file cannot forge XML. #5405 (3.2.0.3, 3.1.17.0)
  • xmp: Fix encode_xmp() for aliased metadata names such as IPTC:Rating / xmp:Rating, which were silently dropped from the XMP write path. #5108 (by @Qi-fly) (3.2.0.2, 3.1.17.0)
  • bmp: Detect corrupt files where palette doesn't match bpp #5030 (3.2.0.0, 3.1.11.0)
  • bmp: Use check_open to guard against corrupt resolutions #5086 (3.2.0.1, 3.1.12.0, 3.0.17.0)
  • bmp: Correctly handle the combination of greyscale + RLE compression #5163 (3.2.0.1, 3.1.13.0, 3.0.18.0)
  • bmp: Validate scanline file position before reading, to catch corrupt files. #5274 (3.2.0.3)
  • bmp: check_compression_ratio() rejects a tiny file with implausibly high resolutions; negate the height field in 64-bit to avoid signed-overflow UB when the attacker-controlled height is INT32_MIN. #5371 (3.2.0.3, 3.1.17.0)
  • cineon: More robust to invalid numbers of channels and bit depths; also fixes a channel-naming counter bug and a memory leak in init(). CVE-2026-59181 #5250 (3.2.0.3, 3.1.15.0, 3.0.20.0)
  • cineon: Validate bit depth against libcineon's supported set. #5283 (3.2.0.3)
  • dds: Corruption protection: validate resolution and guard against integer overflow #5131 (3.2.0.1, 3.1.13.0, 3.0.18.0)
  • dds: Reject corrupt bytes-per-pixel values before they force a huge allocation. #5286 (3.2.0.3)
  • dds: Clamp pixel memcpy to sizeof(uint32_t) to prevent a stack overflow. #5287 (3.2.0.3)
  • dds: Check the return values of readimg_scanlines()/readimg_tiles(), previously ignored, so a failed or short decode is no longer copied out of the buffer as if it had succeeded. #5402
  • dicom: Enforce reasonable resolution limits to guard against corrupt files. #5167 (3.2.0.3, 3.1.14.0, 3.0.19.0)
  • dicom: Null-check DicomImage::getInterData()/getOutputData(), which can return null when a corrupt frame fails to decode. #5364
  • dpx: Detect corrupt userbuf size with an overflow guard. #5271 (3.2.0.3)
  • dpx: Fix a heap overflow in the 1-channel 10-bit filled scanline swap when less than a full group of 3 packed samples remained in bounds. #5298 (3.2.0.3, 3.1.16.0)
  • ffmpeg: 10 bit video had wrong green channel #4935 (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.7.0)
  • ffmpeg: Align swscale output buffers. #5301 (by @br0nzu / Dongju Lee) (3.2.0.3)
  • ffmpeg: Audit fixes: grayscale movies read past the end of the scanline buffer (nchannels left at 3 for a 1-plane gray frame), which also makes 16-bit gray files readable for the first time; refuse a mid-stream frame whose size or pixel format differs from the ImageSpec; add check_open()/check_compression_ratio() at open so a tiny file can't declare a gigabyte frame; and stop feeding an uninitialized AVPacket to av_read_frame() and looping forever on a bad stream. #5406 (3.2.0.3, 3.1.17.0)
  • fits: Fix recursion stack overflow from too many header blocks on corrupt files; convert to an iterative loop with a safety limit. CVE-2026-59156 #5248 (3.2.0.3, 3.1.15.0, 3.0.20.0)
  • fits: Reject a NAXIS value outside the FITS-permitted 0-999 range before using it to size internal arrays, and fail cleanly on an unsupported BITPIX rather than proceeding with a zero-sized pixel type. #5370 (3.2.0.3, 3.1.17.0)
  • fits: Fix the guessed layout for 3D color images: FITS has no formal notion of color channels, and OIIO's assumption (NAXIS1 = nchannels, interleaved) doesn't match any real-world FITS software; switch to the universal convention (NAXIS3 = nchannels, one full-resolution plane per channel). #5385
  • gif: Preserve RGB values of transparent-indexed pixels (previously only alpha was set, zeroing the RGB channels). #5188 (by @adskWangl / Lumina Wang) (3.2.0.3, 3.1.14.0)
  • gif: Handle empty error string from gif_lib. #5269 (3.2.0.3)
  • gif: Hardening against corruptions: bad resolutions and integer overflow #5257 (3.2.0.3), int32 overflow in palette-split pixel-count math.#5292 (3.2.0.3), canvas index overflow. #5299 (by @br0nzu / Dongju Lee) (3.2.0.3), graphics-control extension block that declares fewer than the 4 bytes a well-formed block carries. #5366 (3.2.0.3, 3.1.17.0)
  • hdr: Hardening: tolerate CR characters in the ASCII header.#5261 (3.2.0.3, 3.1.15.0), validate resolution to detect corrupted files #5256 (3.2.0.3).
  • hdr: Resolve a format-detection conflict between the HDR and RAW readers for .hdr files: the rare Hasselblad raw extension collides with Radiance HDR, and with EMBEDPLUGINS=0 giving the raw reader first crack at .hdr files, older libraw versions would crash trying to open a Radiance file. Remove the rarely-used .hdr extension from the RAW reader's extension list; the HDR reader tries first and fails safely, then the raw reader still gets a chance via try_all_readers. #5339 (3.2.0.3, 3.1.16.0)
  • heif: Add IOProxy support for both input and output #5017 (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.10.0)
  • heif: Fix: Could not output AVIF when libheif has no HEVC support #5013 (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.10.0)
  • heif: Fix error saving multiple images with different bit depths #5018 (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.10.0)
  • heif: Monochrome channel read and write support, fix crash #5043 (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.11.0)
  • heif: Fix invalid read writing 8-bit images with dimensions not a multiple of 64 #5095 (by @brechtvl / Brecht Van Lommel) (3.2.0.1, 3.1.12.0)
  • heif: Fix incorrect tracking of current subimage (the current_subimage() method was never properly overridden, always returning 0) #5166 (3.2.0.1, 3.1.13.0, 3.0.18.0)
  • ico: Various validity checks and error handling for corruptions #5088 (3.2.0.1, 3.1.12.0, 3.0.17.0)
  • ico: Better error checking for PNG-in-ICO files. #5264 (3.2.0.3)
  • ico,png: Avoid leaking an error string across a png_chunk_error longjmp. #5289 (3.2.0.3)
  • iff: Handle non-zero origin, protect against buffer overflows #4925 (3.2.0.0, 3.1.7.0)
  • iff: Fix allocation bug when reading 16 bit RGBA + float z (buffer size didn't account for the z channel). CVE-2026-59956 #5251 (3.2.0.3, 3.1.15.0, 3.0.20.0)
  • iff: Detect corrupt chunk sizes, flags, and channel configurations. #5268 (3.2.0.3)
  • iff: Reject implausible image dimensions #5284 (3.2.0.3), #5285 (3.2.0.3)
  • jpeg: Fix wrong pointers/crashing when decoding CMYK jpeg files #4963 (3.2.0.0)
  • jpeg: Improved safety and error reporting for jpeg and iptc #5081 (3.2.0.1, 3.1.12.0)
  • jpeg: More correctly handle bounds checks for malformed APP1 Exif and APP2 ICC metadata markers. #5174 (by @ssh4net / Vlad Erium) (3.2.0.3, 3.1.14.0)
  • jpeg: Be more flexible with corrupt IPTC blocks; use "imageinput:strict" mode to control whether a bad IPTC block is skipped silently or fails the whole file #5140 (3.2.0.1, 3.1.13.0)
  • jpeg: Move check_open()/check_compression_ratio() to run before jpeg_start_decompress()/jpeg_read_coefficients(), which is too late to catch a decompression bomb for progressive JPEGs. #5376 (3.2.0.3, 3.1.17.0)
  • jpeg: Add thumbnail read support (get_thumbnail()) to the JPEG reader. #5333 (by @antond-weta / Anton Dukhovnikov) (3.2.0.3)
  • jpeg2000: Type warning in assertion in jpeg2000output.cpp #4952 (3.2.0.1)
  • jpeg2000: Guard against integer overflow in buffer size computation #5143 (3.2.0.1, 3.1.13.0, 3.0.18.0)
  • jpeg2000: Reject corrupt component geometry and subsampling that could inflate the derived image size past the actual decoded component buffer (a heap-buffer-overflow in copy_scanline on a fuzzed file), and add pre-decode guards against oversized and decompression-bomb headers so a malicious file can't force a large allocation and lengthy decode before OIIO's own checks get a chance to reject it. #5270 #5327 (3.2.0.3, 3.1.16.0)
  • jpeg2000: Extend the decompression-bomb and error-handling guards to the HTJ2K reader codepath, which previously read width/height straight from the header and allocated the whole image before any check; also stop several decode loops using never-filled data after a failed read, reject zero-component files, and close the file on the ICC strict-mode error path. #5407 (3.2.0.3)
  • jpeg2000: Re-enable ICC-profile writing (disabled since #1452 over an OpenJPEG assertion, fixed upstream in OpenJPEG 2.5.4); the write path is compiled only when building against OpenJPEG >= 2.5.4. #5419 (by @luna-y-kim / Luna Kim) (3.2.0.3)
  • jpeg-xl: Correctly set Quality for JPEG XL #4933 (3.2.0.0, 3.1.7.0)
  • jpeg-xl: Add the ability to read and write ICC profiles #4905 (by @shanesmith-dwa / Shane Smith) (3.2.0.0), and CICP #4968 (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.9.0) #5054 (by @shanesmith-dwa / Shane Smith) (3.2.0.0, 3.1.11.0)
  • jpeg-xl: Enforce format resolution and memory limits for better detection of corrupt or invalid files. #5202 (by @hkgulka / Hannah Gulka) (3.2.0.3, 3.1.14.0) #5203 (by @maxwelliverson / Maxwell Iverson) (3.2.0.3, 3.1.14.0, 3.0.19.0) #5305 (3.2.0.3)
  • jpeg-xl: Overflow protection for various operations, better eror detection #5378 (3.2.0.3, 3.1.17.0)
  • openexr: Support for idManifest and deepImageState (experimental) #4877 (3.2.0.0, 3.1.7.0)
  • openexr: ACES Container hint for exr outputs #4907 (by @Glowies / Oktay Comu) (3.2.0.0, 3.1.7.0)
  • openexr: Write OpenEXR colorInteropID metadata based on oiio:ColorSpace #4967 (by @brechtvl / Brecht Van Lommel) (3.0.14.0, 3.2.0.0)
  • openexr: Improve attribute translation rules #4946 (3.2.0.0)
  • openexr: ACES container writes colorInteropId instead of colorInteropID #4966 (by @brechtvl / Brecht Van Lommel) (3.2.0.0)
  • openexr: Add check_open to exrinput_c. #5280 (3.2.0.3)
  • openexr: Fix an out-of-bounds write when reading partial edge tiles of a tiled EXR whose dimensions aren't a multiple of the tile size. CVE-2026-63422 #5295 (3.2.0.3, 3.1.16.0, 3.0.21.0)
  • openexr: Fix writing an image whose channels have differing native integer depths. #5340 (3.2.0.3, 3.1.17.0)
  • openvdb: Audit fixes: add a check_open() extent check from the grid bbox metadata, move dense-window math to 64-bit, null-check gridPtrCast<> and readGrid(), guard the OpenVDB tree walk and clamp exception-message text built from file data, and reset reader state on open failure and re-open. #5416 (3.2.0.3)
  • png: We were not correctly suppressing hint metadata #4983 (3.2.0.0)
  • pnm: Prevent reader from loading or allocating memory for arbitrarily large non-image files. #5203 (by @maxwelliverson / Maxwell Iverson) (3.2.0.3, 3.1.14.0, 3.0.19.0)
  • pnm: Use 64-bit scanline math to avoid an integer overflow; hoist an invariant bytes-per-scanline computation out of the read loop. #5344 (3.2.0.3, 3.1.17.0)
  • psd: Fixes against corrupt files with better validation #5089 (3.2.0.1, 3.1.12.0, 3.0.17.0)
  • psd: Fix indexed transparency. #5177 (by @ssh4net / Vlad Erium) (3.2.0.3, 3.1.14.0)
  • psd: Validate color_mode before the RawColor early return. #5282 (3.2.0.3)
  • psd: Guard row interleave bounds on corrupt data, failing gracefully with an error instead of risking out-of-bounds access when interleaving scanlines from malformed files. CVE-2026-63420 #5307 (3.2.0.3, 3.1.16.0, 3.0.21.0)
  • psd: Hardening / corrupt image handling: Detect implausibly large ICC, Exif, and XMP blocks before allocating. #5288 (3.2.0.3), corruptions of layer resolutions and EOF in strings. #5259 (3.2.0.3), avoid signed overflow computing layer/mask extents #5306 (3.2.0.3, 3.1.16.0), check reasonable resolution limits and plausible compression ratio #5348 (3.2.0.3, 3.1.17.0).
  • ptex: More comprehensive and faster valid_file() and header validation. #5265 (3.2.0.3, 3.1.16.0)
  • ptex: Null-check PtexTexture::getData()/PtexFaceData::getTile(), which can return null when the reader hits an error. #5365 (3.2.0.3, 3.1.17.0)
  • raw: Apply the LibRaw memory cap before unpack to prevent OOM. #5275 (3.2.0.3)
  • raw: Reject decompression-bomb / corrupt headers before unpack. #5312 (3.2.0.3, 3.1.16.0)
  • raw: Pass a new raw:bad_pixels hint (a filename of bad-pixel data) through to LibRaw. #5323 (by @antond-weta / Anton Dukhovnikov) (3.2.0.3, 3.1.16.0)
  • raw: Fixes to the undebayered (raw:Demosaic=none) path: flip codes 1/2/4/7 fell through the mapping and returned the caller's buffer uninitialized (a heap disclosure), flip 3 disagreed with the debayered path, raw_image was indexed from header geometry in 32-bit; the flip mapping is now bitwise and the index is 64-bit and bounded against LibRaw's actual allocation. Also handle raw_bps of 0 (some Phase One headers) defeating the bomb guard. #5415 (3.2.0.3, 3.1.17.0)
  • raw: Fixes and improvements to thumbnail functionality in the raw reader, including new raw:thumbnail_index and raw:thumbnail_sort hints to select a specific thumbnail when a file has more than one. #5334 (by @antond-weta / Anton Dukhovnikov) (3.2.0.3, 3.1.17.0)
  • raw: Allow vector types in multi-value hints: white-balance multipliers can now be given as a single float4 in addition to four floats, and cropbox/greybox as int2 box in addition to four ints. #5386 (by @antond-weta / Anton Dukhovnikov) (3.2.0.3, 3.1.17.0)
  • rla: Lots of additional validity checking and safety #5094 (3.2.0.1, 3.1.12.0, 3.0.17.0), #5153, #5172 (3.2.0.1, 3.1.13.0, 3.0.18.0), #5337 #5258 (3.2.0.3, 3.1.16.0)
  • rla: RLA subimages are concatenated via each header's NextOffset; nothing previously required it to advance, so a file pointing it at itself or backwards supplied subimages endlessly. Require NextOffset to point past the current header. #5403 (3.2.0.3, 3.1.17.0)
  • sgi: Implement RLE encoding support for output #4990 (by @jessey-git / Jesse Yurkovich) (3.2.0.0)
  • sgi: Better detection of corrupt RLE info that could overflow #5141 (3.2.0.1, 3.1.13.0, 3.0.18.0)
  • sgi: Size RLE offset tables by spec dimensions to prevent out-of-bounds access on corrupt headers. #5279 (3.2.0.3)
  • sgi: Prevent an oversized-allocation crash from a bogus RLE length/offset table. #5303 (3.2.0.3)
  • sgi: Deal with corrupt 16-bit RLE runs that have odd byte counts. #5321 (3.2.0.3, 3.1.16.0)
  • softimage: Multiple hardening fixes against corrupted input: prevent RLE buffer overruns #5142, general hardening #5155, fix malformed channel packets #5156 (3.2.0.1, 3.1.13.0, 3.0.18.0), small allocation leak in RLE decoder #5182 (3.2.0.3, 3.1.14.0).
  • softimage: Support channel packets with differing bit depths (e.g. 16-bit R mixed with 8-bit G in one file), which previously wrote past the end of the scanline buffer. The reader now always exposes one uniform pixel format -- the widest depth among the file's packets -- and promotes narrower channels to it on read via exact bit replication. #5309 (3.2.0.3, 3.1.16.0)
  • targa: Corruption protection against mis-sized palette; fix misunderstanding of non-zero palette start index #5165 (3.2.0.1, 3.1.13.0, 3.0.18.0), reject implausible image dimensions before allocating. #5293 (3.2.0.3)
  • tiff: Fix TIFF output crash for multi-count Exif metadata #5035 (3.2.0.0, 3.1.11.0)
  • tiff: Correctly read TIFF EXIF fields for ExifVersion and FlashPixVersion #5045 (3.2.0.0, 3.1.11.0)
  • tiff: Support for GPS metadata fields (latitude, longitude, altitude, timestamp, and related EXIF GPS fields) when using libTIFF 4.2+. #5050 (3.2.0.1, 3.1.12.0)
  • tiff: The "tiff:half" hint was only applying to the first MIP level. #5240 (3.2.0.3, 3.1.15.0)
  • tiff: Hardinging / various corruption detection: non-matching tag/metadata types #5036 (3.2.0.0, 3.1.11.0), Fix buffer overrun and improve error reporting #5082, fix wrong number of values passed to invert_photometric #5083, check for invalid bit depth in palette images #5091 (3.2.0.1, 3.1.12.0), care with missing rowsperstrip (assume whole image is one strip per spec) #5160; guard against corrupt XMP blocks with TIFF-related tag names #5162 (3.2.0.1, 3.1.13.0, 3.0.18.0),aAvoid use-after-scope in multithreaded scanline reads #5294 (3.2.0.3), heap overflow when unpacking sub-8-bit contiguous CMYK samples. #5296 (3.2.0.3), int32 overflows fixes and guard against decompression bombs #5319 (3.2.0.3, 3.1.16.0), negative strip size #5336 (3.2.0.3, 3.1.17.0).
  • webp: Allow out-of-order scanlines when writing webp #4973 (by @pmady / Pavan Madduri) (3.2.0.0)
  • webp: Use correct resolution limits for WebpOutput::open #5016 (by @jessey-git / Jesse Yurkovich) (3.2.0.0, 3.1.10.0)
  • webp: Fix missing oiio:UnassociatedAlpha on input #5020 (by @brechtvl / Brecht Van Lommel) (3.2.0.0, 3.1.10.0)
  • webp: Fix bounds handling for WebP EXIF metadata chunks. #5175 (by @ssh4net / Vlad Erium) (3.2.0.3, 3.1.14.0)
  • webp: Enforce format resolution limits for better detection of corrupt or invalid files. #5202 (by @hkgulka / Hannah Gulka) (3.2.0.3, 3.1.14.0)
  • webp: valid_file() now checks the file header for magic words for more reliable format detection. #5266 (3.2.0.3)
  • zfile: Check gzread()'s return value when reading the header and each scanline; a truncated or corrupt gzip file was previously processed with whatever happened to be in the buffer. #5372 (3.2.0.3, 3.1.17.0)

🔧 Internals and developer goodies

  • fix: Several bug fixes related to internal use of image_span #5004 (3.2.0.0, 3.1.10.0)
  • int: Conform certain attrib names "exif:" to our "Exif:" convention #5025 (3.2.0.0)
  • int: Remove left over tile emulation code for various formats that really only support scanline I/O. This hasn't worked properly for a long time, so we aren't really taking away any functionality that anybody could have been using. #5029 (by @jessey-git / Jesse Yurkovich) (3.2.0.0)
  • dassert.h: OIIO_CONTRACT_ASSERT and other hardening improvements #5006 (3.2.0.0)
  • filesystem.h: Speedup to detect the existence of files on Windows #4977 (by @wingfiring / JacksonSun-adsk) (3.2.0.0)
  • filesystem.h: Overflow-safe bounds check in IOMemReader::pread. #5262 (3.2.0.3)
  • filesystem.h: Use 64-bit file offsets (_fseeki64/_ftelli64) on all Windows builds, including MinGW, which previously fell back to fseeko/ftello with 32-bit offsets. #5354 (by @Maxi741cv / Mixie) (3.2.0.3, 3.1.17.0)
  • filesystem.h: Speedup various file system operations on Windows using native APIs. #5199 (by @adskWangl / Lumina Wang) (3.2.0.3, 3.1.14.0)
  • fmath.h: Address fmath.h warning with ispow2 #5033 (3.2.0.0)
  • fmath.h: Fix typo in convert_type default argument, min() should have been max(). #5227 (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.15.0)
  • fmath.h: degrees() and radians() are now constexpr. #5151 (3.2.0.1, 3.1.13.0)
  • platform.h: OIIO_NODISCARD_ERROR_ENABLE is now always on when building OIIO itself, enforcing that all annotated return values are checked #5145 (3.2.0.1, 3.1.13.0)
  • platform.h: Additional contract-safety hardening: OIIO_NODISCARD on fmath.h integer and float helpers #5221 (by @luna-y-kim / Luna Kim), extra contract asserts for span and string_view #5224. (3.2.0.3)
  • simd.h: Fix a NEON vfloat4::load(values,n) heap-buffer-overflow: the branch loaded all 4 lanes with vld1q_f32 and then zeroed the unwanted ones, reading up to 12 bytes past the caller's buffer for n<4. Switch on n before loading, matching the (correct) SSE branch. #5404 (3.2.0.3, 3.1.17.0)
  • simd.h: Fill in NEON vector paths that previously fell through to scalar code on aarch64: exp()/log() (2.5x faster), narrow-integer vector loads, ceil/floor/round/ifloor, transpose, vreduce_add, and matrix44 * vfloat4. #5412 (3.2.0.3, 3.1.17.0)
  • simd.h: Treat Windows ARM64EC builds as ARM so the NEON code path is taken. #5369 (by @wayne-arnold-adsk / Wayne Arnold) (3.2.0.3, 3.1.17.0)
  • threads.h: Annotate spin_mutex and spin_rw_mutex for ThreadSanitizer. #5429 (by @NathanGray-ChurchillNavigation / Nathan Gray) (3.2.0.3, 3.1.17.0)
  • typedesc.h: New TypeURational type definition is like TypeRational, but with unsigned components. #5036 #5057 (3.2.0.0, 3.1.11.0)
  • ustring.h: Allow freeing the ustring table via OIIO::attribute("ustring:cleanup", 1) or env var OIIO_USTRING_CLEANUP=1, useful for suppressing false positives in memory leak detection tools. #5213 (3.2.0.3, 3.1.14.0)
  • cleanup: Remove some old files that had no remaining use. #5234 (3.2.0.3)
  • int: OpenColorIO exception-safety: catch std::exception rather than only OCIO::Exception, so an exception thrown by a system library beneath OCIO (not an OCIO::Exception) is still caught. #5428 (3.2.0.3, 3.1.17.0)
  • int: Minor libraw-related cleanup: rename the internal thumbnail error helper to thumb_errorfmt, and drop obsolete reference outputs for unsupported old LibRaw versions. #5425 (3.2.0.3)

🏗 Build/test/CI and platform ports

  • OIIO's CMake build system and scripts:
    • build: Allow auto-build of just required packages by setting OpenImageIO_BUILD_MISSING_DEPS to required. #4927 (3.2.0.0, 3.1.7.0)
    • build: Make dependency report more clear about what was required #4929 (3.2.0.0, 3.1.7.0)
    • build: Fix HARDENING build options #4996 (3.2.0.0)
    • build: Fully disable tests when their required dependencies are missing #5005 (3.2.0.0, 3.1.10.0)
    • build: Raise fmt auto-build version to 12.1, handle Windows flags #5039 (3.2.0.0, 3.1.11.0)
    • build: Self-builder logic fixes for deep vs shallow clones #5034 (3.2.0.0, 3.1.11.0)
    • build: Remove support for deprecated Intel icc compiler #5040 (3.2.0.0)
    • build: Use quote to avoid error if variable is empty #5053 (3.2.0.0, 3.1.11.0)
    • build: Improve security by pinning auto-build dependencies by hash #5076 (3.2.0.1, 3.1.12.0)
    • build: Include idiff in the python wheels we build #5104 (3.2.0.1, 3.1.12.0, 3.0.17.0)
    • build: Makefile wrapper fix to properly quote test regex #5146 (3.2.0.1, 3.1.13.0, 3.0.18.0); minor debugging fixes to dependency_utils #5128 (3.2.0.1, 3.1.13.0)
    • build: Remove -Wno-unused-result from gcc compile options, surfacing more potential warnings. #5214 (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.14.0)
    • build: Add support for gcc-16 #5225 and C++26 #5230, each tested in CI. (3.2.0.3, 3.1.15.0)
    • build: Option to use a compiled fmt library instead of the header-only variant. #5231 (by @ssh4net / Vlad Erium) (3.2.0.3)
    • build: Suppress warnings from the fmt library when building on Mac. #5237 (by @antond-weta / Anton Dukhovnikov) (3.2.0.3, 3.1.15.0, 3.0.20.0)
    • build: OpenJPH auto-build and better exception handling. #5247 (3.2.0.3)
    • build: Fix certain clang varieties warning about giflib headers. #5263 (3.2.0.3)
    • build: Support building for WebAssembly (wasm). #5304 (by @nickdademo / Nick D'Ademo) (3.2.0.3)
    • build: FORTIFY and sanitizer/debug builds are not compatible; don't allow enabling both together. #5318 (3.2.0.3)
    • build: Fix EMBEDPLUGINS=0, which had been broken for a long time without being caught because the CI variant meant to test it wasn't actually doing so (it tried to set it via environment variable, which didn't work until this patch). Also convert several build options from option() to our set_option(), allowing them to be overridden by environment variables of the same name, handy for CI variants. #5272 (3.2.0.3, 3.1.16.0)
    • cmake: Guard against a previously auto-built static libtiff package whose exported TIFF::tiff target references Deflate::Deflate without importing or defining that target, which broke configuration. #5313 (by @zachlewis / Zach Lewis) (3.2.0.3, 3.1.17.0)
    • cmake: Fix CLANG_FORMAT_INCLUDES targets, which had silently formatted only headers and skipped every .cpp file and testsuite/ (CI wasn't affected since it runs a separate script). #5373 (by @jinhgkim / Jinnie Kim) (3.2.0.3, 3.1.17.0)
    • build: Fix a Windows unity-build declaration mismatch: exrinput.cpp's forward declaration lacked OIIO_EXPORT, which the definition in exrinput_c.cpp has, causing an MSVC error when the two are combined into one translation unit. #5360 (3.2.0.3, 3.1.17.0)
    • build: Dependency auto-build reliability fixes: clear stale find-package cache entries before the post-build re-find so a rejected too-old system package can't leak into the build #5410; check sub-build exit codes and save/print the real compiler output (deps/<pkg>-build.log) instead of failing silently much later, and fix a never-working local-dependency include path #5423; and use NO_FP_RANGE_CHECK for nanobind so its strict exported config stops rejecting a valid version range #5436. (3.2.0.3)
    • build: Raised the project's clang-format standard from clang-format 17 to clang-format 22 (done just before the 3.2 branch, as every few years, so main and the release family stay in sync), reformatting the code and bringing a few previously-excluded headers (filesystem.h, imagebufalgo.h, string_view.h, thread.h) under clang-format. #5421 #5426 (3.2.0.3)
  • Dependency and platform support:
    • deps: Several minimum dependency versions were raised: CMake 3.23 (was 3.18) #5394, fmt 9.0 (was 7.0) #5041, libjpeg 9 (was 8; libjpeg-turbo 2.1+ still satisfies this) #5432, libtiff 4.1 (was 4.0) #5414, LibRaw 0.21.0 (was 0.20.0) #5389, PugiXML 1.11 (was 1.8) #5246, DCMTK 3.6.2 (was 3.6.1; optional, DICOM support) #5438, R3D SDK to 9.2.0 #5148 (by @1div0 / Peter Kovář) (3.2.0.1, 3.1.13.0). For their security fixes, libtiff 4.5+ #5277 and LibRaw 0.21.3+ #5383 are recommended. (3.2.0.0-3.2.0.3)
    • deps: Support / testing for new dependency and toolchain versions: libraw 0.21.5 #4988 (3.2.0.0, 3.1.9.0), Libheif 1.21, 1.22 #4992 #5031 (3.2.0.0, 3.1.11.0) #5212 (3.2.0.3, 3.1.14.0, 3.1.10.0), clang 22.1 #5067 (3.2.0.1, 3.1.12.0, 3.0.19.0)
    • deps: New dependency auto-build abilities added for the GIF library #4921 (by @vangeliq / Valery Angelique) and OpenJPEG #4911 (by @grdanny / Danny Greenstein) (3.2.0.0-3.2.0.3)
    • deps: Dependency auto-build default versions were raised for OpenColorIO (2.5.1) #5022 (by @zachlewis / Zach Lewis), pystring (1.2.0) #5235, PugiXML's vendored copy #5246 (3.2.0.0-3.2.0.3), libuhdr to 1.5.1 and preferring a static build when found. #5418 (3.2.0.3)
    • *deps: Support OpenCV 5 by locating it via its exported CMake config, and add a standalone header smoke test for the imagebufalgo_opencv.h interop, which previously had no test coverage at all. #5326 (3.2.0.3, 3.1.16.0, 3.0.21.0)
    • build/platforms: Fix building on OpenBSD #5001 (by @brad0 / Brad Smith) (3.2.0.0, 3.1.10.0)
    • deps: Disable LERC in libTIFF local build script #4957 (by @lji-ilm / LI JI) (3.2.0.0, 3.1.8.0)
    • build/deps: Use libheif exported config if available #5012 (3.2.0.0, 3.1.10.0)
    • deps: Address new pybind11 float/int auto-conversion behavior #5058 (3.2.0.1, 3.1.12.0)
    • build/win: Embed manifest in OIIO executables to enable long path handling #5066 (by @nrusch / Nathan Rusch) (3.2.0.1, 3.1.12.0)
  • Testing and Continuous integration (CI) systems:
    • tests: Image_span_test reduce benchmark load for debug and CI renders #4951 (3.2.0.0, 3.1.8.0)
    • tests: Add new ref image for jpeg test #5007 (3.2.0.0, 3.1.10.0)
    • tests: Adjust test comparision thresholds for Mac ARM #5026 (3.2.0.0, 3.1.11.0)
    • tests: Imageinout_test: add benchmark of read and write speed vs tile size #5037 (3.2.0.0, 3.1.11.0)
    • tests: New ref outputs for tiff-misc, heif no-avif, and ffmpeg 8.1 cases #5075 #5079 #5099 #5112 (3.2.0.1)
    • test: Improve Python test coverage. #5260 (by @soswow / Aleksandr Motsjonov) (3.2.0.3)
    • test: Update the getattribute one-arg test for the unified Python bindings (a default type argument added by #5254 changed the one-arg call's behavior). #5308 (3.2.0.3)
    • ci: Python wheel building improvements: use ccache #4924 (by @lgritz / Larry Gritz), unbreak wheel release + other enhancements pt 1 #4937 (by @zachlewis / Zach Lewis) (3.2.0.0, 3.1.7.0)
    • ci: Try python 3.13 to fix Mac breakage on CI #4970 (3.2.0.0)
    • ci: Don't run non-wheel workflows when only pyproject.toml changes #4997 (3.2.0.0, 3.1.10.0)
    • ci: Windows runners switched which python version they had #5010 (3.2.0.0, 3.1.10.0)
    • ci: Simplify ci workflow by using build-steps for old aswf containers, too #4932 (3.2.0.0, 3.1.7.0)
    • ci: We were not correctly setting fmt version from job options #4939 (3.2.0.0, 3.1.7.0)
    • ci: Emergency fix change deprecated sonarqube action #4969 (3.2.0.0)
    • ci: Speed up macos15 intel variant by not installing Qt #4998 (3.2.0.0, 3.1.10.0)
    • ci: Test against libraw 0.22 for 'latest' test variants #5009 (3.2.0.0, 3.1.10.0)
    • ci: Lock bleeding edge to pybind11 latest version #5024 (3.2.0.0, 3.1.10.0)
    • ci: Don't install OpenCV on Mac Intel job variant #5032 (3.2.0.0, 3.1.11.0)
    • ci: Turn off nightly workflows for user forks #5042 (3.2.0.0, 3.1.12.0)
    • ci: Temporarily disable python stub checking #5061 (3.2.0.0, 3.1.11.0)
    • ci: Add MacOS 26 (ARM) to the CI lineup #5059 (3.2.0.0, 3.1.11.0)
    • ci: Add CI test for MSVS 2026 #5060 (3.2.0.1, 3.1.12.0, 3.0.17.0)
    • ci: On Mac Intel CI variant, don't install openvdb, for speed #5065 (3.2.0.1, 3.1.12.0, 3.0.17.0)
    • ci: For security, replace workflow substitutions with safer env substitutions #5070 (3.2.0.1, 3.1.12.0)
    • ci: Speed up slow benchmarks for debug and sanitizer CI tests #5077 (3.2.0.1, 3.1.12.0)
    • ci: Bump GitHub Actions to latest versions #5078 #5110 #5119 (3.2.0.1)
    • ci: Fix broken Mac CI and wheel building by specifying full compiler paths #5100 #5101 (3.2.0.1, 3.1.12.0, 3.0.17.0)
    • ci: Fix CI breakages: fmtlib renamed branch 'master' to 'main' #5127, Mac CI was missing jpeg-xl install #5139 (3.2.0.1, 3.1.13.0, 3.0.18.0)
    • ci: Try to reduce costs and timeouts for expensive tests in debug mode #5150 (3.2.0.1, 3.1.13.0)
    • ci: Ubuntu libheif CI fixes: add ref output for libheif 1.17 #5179, temporarily make libheif optional while package repository is unreliable #5180 (3.2.0.1)
    • ci: Fix broken CI by locking down aswf container for 2023 #5200; remove deprecated windows-2025 runner #5189 (3.2.0.3, 3.1.14.0, 3.0.19.0)
    • ci: Fixes to build_opencolorio.bash script #5219; upgrade 'latest' CI tests to OpenEXR v3.4.14, fmt 12.2, PugiXML v1.16 #5245. (3.2.0.3, 3.1.15.0)
    • ci: Add vfx2027 container tests. #5302 (3.2.0.3)
    • testing: New libFuzzer-based fuzzing infrastructure and nightly CI matrix for image format readers -- see the "Other notable new feature" entry above for details. #5314 (3.2.0.3, 3.1.16.0)
    • ci: Test against and document the latest dependency versions. #5330 (3.2.0.3, 3.1.16.0)
    • ci: Bump the "latest releases" CI test versions (libpng 1.6.58, FreeType 2.14.3, OpenJPH 0.31.0); no change to minimum requirements. #5434 (3.2.0.3)
    • ci: Update all GHA actions to the latest versions. #5381 (3.2.0.3, 3.1.17.0)
    • tests: Change fuzz corpus seeding to gather a broader, less-biased sample per format instead of just the 5 smallest files, which favored degenerate inputs (decompression bombs, truncated headers) over larger valid files as mutation seeds. #5338
    • tests: Fix brittle behavior of tests that build their own executable (e.g. cmake-consumer, imagebufalgo-opencv, openexr-partialtile) and need find_package(OpenImageIO); this only worked in CI by accident via OpenImageIO_ROOT. #5359

📚 Notable documentation changes

  • docs: Update/correct explanation of "openexr:core" attribute, and typo fixes #4943 (3.2.0.0, 3.1.7.0)
  • docs: Remove outdated/wrong description in INSTALL.md #5008 (3.2.0.0)
  • docs: Update description for dwaCompressionLevel #5074 (by @Aamir-Raza / Aamir Raza) (3.2.0.1, 3.1.12.0)
  • docs: Fix formatting examples for version macros #5073 (3.2.0.1, 3.1.12.0)
  • docs: Keep TextureSystem docs in sync with ImageCache #5085 (3.2.0.1, 3.1.12.0, 3.0.17.0)
  • docs: Assorted typo fixes in code comments and documentation. #5093 #5255 #5222 #5238 (by @luna-y-kim / Luna Kim) #5349 (by @jinhgkim / Jinnie Kim) (3.2.0.3)
  • docs: Fix misstatement about oiiotool --if #5102 (3.2.0.1, 3.1.12.0, 3.0.17.0)
  • docs: Clarify plugin.h explanations by noting their Unix-like equivalents. #5226 (3.2.0.3, 3.1.15.0)
  • docs: Update the ImageCache docs now that IC is fully de-virtualized, remove leftover docs for the old ImageBufAlgo header API, and fix minor typos found along the way. #5352 (by @luna-y-kim / Luna Kim) (3.2.0.3, 3.1.16.0)
  • docs: Fix vcpkg install command syntax in INSTALL.md (vcpkg install openimageio[tools], no space). #5332 (by @BrianHanke / Brian R Hanke) (3.2.0.3, 3.1.16.0)
  • docs: Convert the ImageCache chapter's doc example from hardcoded text into compiling C++ and Python tests, referenced from the docs via literalinclude. #5341 (by @FaisalXL / Faisal)
  • docs: Update color-space, display, and view names left over from older SPI/ACES configs to use the current color interop IDs and views. #5388 (by @brechtvl / Brecht Van Lommel)
  • docs: Correct Doxygen-style comments in IOProxy. #5347 (3.2.0.3, 3.1.17.0)
  • docs: OIIO_DEPRECATED_EXTERNAL's alias had never actually been defined. #5345

🏢 Project Administration

  • admin: Refinements to the issue and PR templates #4982 #4995 (3.2.0.0)
  • admin: Policy on use of AI coding assistants #5072 #5116 (3.2.0.1, 3.1.12.0, 3.0.17.0)
  • admin: Updates to SECURITY.md policies and vulnerability reports #5149 (3.2.0.1, 3.1.13.0, 3.0.18.0) #5216 (3.2.0.3, 3.1.14.0) #5232 (3.2.0.3, 3.1.14.1, 3.0.19.1) #5320 #5329 (3.2.0.3, 3.1.16.0, 3.0.21.0)
  • admin: Misc administrative docs fixups. #5233 (3.2.0.3, 3.1.14.1)

🤝 Contributors

During the course of development of 3.2 (since splitting from the 3.1 branch),
OpenImageIO has had 46 unique contributors, of which 21 (indicated by an
asterisk) made their first contribution to the project after the 3.1 release
(v3.1.6.1). Some of their patches also appear in 3.1.x or 3.0.x releases
because they were backported from main.
Aamir Raza (*) Alejandro Conty Aleksandr Motsjonov
Alex Fuller Anton Dukhovnikov Asish Kumar (*)
Brad Smith Brecht Van Lommel Brian R Hanke (*)
Carine Touraille Connie Chang Danny Greenstein
Dongju Lee (*) Faisal (*) Hannah Gulka (*)
Hunter (*) Jackson Sun (*) Jesse Yurkovich
Jinnie Kim (*) Jonathan Brown Larry Gritz
Li Ji Loïc Vital Lumina Wang (*)
Luna Kim (*) Marta Feriani (*) Matt Van Horn (*)
Maxwell Iverson (*) Mixie (*) Nathan Gray (*)
Nathan Rusch Nick D'Ademo (*) Oktay Comu
omcaif Pascal Lecocq Pavan Madduri (*)
Peter Kovář Qi-fly (*) rose413 (*)
Shane Smith Todica Ionut Valery Angelique (*)
Vanessa Valderrama Vlad (Kuzmin) Erium Wayne Arnold
Zach Lewis

Contributors

soswow, aconty, and 33 other contributors
Assets 4
Loading