Bump openexr from 3.3.5 to 3.4.4

[dependabot]

Bumps openexr from 3.3.5 to 3.4.4.

Release notes

Sourced from openexr's releases.

v3.4.4

Patch release with an optimization to reduce the size of the library.

B44 and DWA compression tables are now initialized at first use rather than being hard-coded in the source code and compiled binary. This reduces the library size at a slight performance cost. Initialization takes under a millisecond, but the size of libOpenEXRCore.so is reduced from around 1Mb to less than half that.

This also fixes a build issue with ILMTHREAD_THREADING_ENABLED which inadvertently enabled threading when it should have been disabled.

This also fixes a bug where importing the python module from a parent directory would fail.

Full changelog: v3.4.3..v3.4.4

v3.4.3

Patch release that addresses several bugs, primarily involving properly rejecting corrupt input data.

Specifically:

• Buffer overflow in PyOpenEXR_old's channels() and channel() in legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
• Use after free in PyObject_StealAttrString in legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
• Use of Uninitialized Memory in openexr, reported by Aldo Ristori (GitHub: Kaldreic).
• Heap-based Buffer Overflow Remote Code Execution Vulnerability, reported by Trend Micro Zero Day Initiative.

Also:

• OSS-fuzz 456158449 Heap-buffer-overflow in generic_unpack
• OSS-fuzz 447429458 Heap-buffer-overflow in DwaCompressor_uncompress
• OSS-fuzz 439237843 Heap-buffer-overflow in internal_exr_undo_ht
• OSS-fuzz 436037111 Heap-buffer-overflow in generic_unpack
• OSS-fuzz 435779241 Heap-buffer-overflow in generic_unpack
• OSS-fuzz 420744464 Abrt in __cxxabiv1::failed_throw

Other fixes:

• Fix a bug with re-reading a scanline file with a different set of channels.
• Only populate CMAKE_DEBUG_POSTFIX with _d if it is undefined, which makes it possible to set CMAKE_DEBUG_POSTFIX="".

This version also bumps the auto-fetched version of OpenJPH to 0.24.5. OpenJPH 0.24.5 addresses these OSS-Fuzz issues:

• OSS-fuzz 456837230 Crash in ojph::local::param_cod::~param_cod
• OSS-fuzz 456248580 Null-dereference READ in ojph::local::param_cod::~param_cod
• OSS-fuzz 455374208 Floating-point-exception in ojph::local::tile::pre_alloc
• OSS-fuzz 444963190 Index-out-of-bounds in ojph::local::param_qcd::read_qcc
• OSS-fuzz 444889300 Heap-buffer-overflow in ojph::mem_infile::read
• OSS-fuzz 444878558 Segv on unknown address in ojph::local::param_qcd::~param_qcd
• OSS-fuzz 444878557 Null-dereference READ in ojph::local::param_qcd::~param_qcd

Full changelog: v3.4.2..v3.4.3

v3.4.2

Patch release that fixes a Windows build issue introduced in v3.4.1.

This version also bumps the auto-fetched Imath version to v3.2.2, which resolves a build problem with newer versions of cmake, involving duplicate library aliases.

... (truncated)

Changelog

Sourced from openexr's changelog.

Version 3.4.4 (November 19, 2025)

Patch release with an optimization to reduce the size of the library.

B44 and DWA compression tables are now initialized at first use rather than being hard-coded in the source code and compiled binary. This reduces the library size at a slight performance cost. Initialization takes under a millisecond, but the size of libOpenEXRCore.so is reduced from 890K to 360K.

This also fixes a build issue with ILMTHREAD_THREADING_ENABLED which inadvertently enabled threading when it should have been disabed.

This also fixes a bug where importing the python module from a parent directory would fail.

Merged Pull Requests:

• 2199 OpenEXRCore: fix ILMTHREAD_THREADING_ENABLED checks
• 2198 OpenEXRCore: avoid direct dependency on imath
• 2196 Bump github/codeql-action from 4.31.2 to 4.31.3
• 2194 Add missing copywrite comments
• 2192 Bump pypa/cibuildwheel from 3.2 to 3.3
• 2190 Bump github/codeql-action from 3.27.9 to 4.31.2
• 2189 Bump msys2/setup-msys2 from 2.27.0 to 2.29.0
• 2188 Bump actions/download-artifact from 4.1.8 to 6.0.0
• 2187 Bump ossf/scorecard-action from 2.4.0 to 2.4.3
• 2186 Bump pypa/cibuildwheel from 2.23 to 3.2
• 2185 Bump actions/cache from 4.2.0 to 4.3.0
• 2184 Bump actions/upload-artifact from 4 to 5
• 2183 Bump actions/checkout from 2.7.0 to 5.0.0
• 2182 Add recent CVEs to SECURITY.md
• 2181 Bump sigstore/gh-action-sigstore-python from 3.0.0 to 3.1.0
• 2180 Bump actions/setup-python from 5.3.0 to 6.0.0

... (truncated)

Commits

• 741ecb8 Add 2198 and 2199 to release notes
• 0c86675 OpenEXRCore: fix ILMTHREAD_THREADING_ENABLED checks (#2199)
• 9eabc20 OpenEXRCore: avoid direct dependency on imath (#2198)
• 575005b release notes for v3.4.4
• 8916693 pin bazel openjph to 24.5
• c85b9c0 bump version of v3.4.4
• 2c891ce Bump github/codeql-action from 4.31.2 to 4.31.3 (#2196)
• 487d074 Add missing copywrite comments (#2194)
• 27c1fc6 Imporve Bazel support (#2176)
• 3e2d780 DWA: initialize linear/nonlinear tables at runtime (#2174)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)