Skip to content

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Apr 22, 2025

Bumps openexr from 1.3.2 to 3.2.3.

Release notes

Sourced from openexr's releases.

v3.2.3

Patch release with various build/bug/documentation fixes:

  • Fix bswap on NetBSD
  • Fix issue with decompressing fp32 dwa files
  • Support cmake config for libdeflate
  • updated security policy
  • miscelleneous website improvements

This release also addresses:

OSS-fuzz 66676 Null-dereference in Imf_3_3::realloc_deepdata OSS-fuzz 66612 Null-dereference in Imf_3_3::realloc_deepdata

This release also formally adopts the process of publishing openexr python wheels to pypi.org.

This release also introduces the process of signing release artifacts via sigstore.

v3.2.2

Patch release that addresses CVE-2023-5841.

Note that this bug is present in the C++ API (since v3.1.0), although it is in a routine that is predominantly used for development and testing. It is not likely to appear in production code.

v3.2.1

Patch release with miscellaneous build fixes:

  • Fix for linking statically against an external libdeflate
  • Fix a compile error with OPENEXR_VERSION_HEX
  • Fix various compiler warnings
  • Pkg-config generation is now on by default for all systems, including Windows

See CHANGES.md for details.

v3.2.0

Minor release with several additions, changes and improvements:

  • Zip compression via libdeflate

    As of OpenEXR release v3.2, OpenEXR depends on libdeflate for DEFLATE-based compression. Previous OpenEXR releases relied on zlib. Builds of OpenEXR can choose either an libdeflate installation, or CMake can auto-fetch the source and build it internally. The internal build is linked statically, so no extra shared object is produced.

    See https://github.com/AcademySoftwareFoundation/OpenEXR/blob/HEAD/website/install.rst for more details.

  • New camdkit/camdkit-enabled standard attributes

    These changes bring to OpenEXR new standard optional attributes that were discussed in the SMPTE Rapid Industry Solutions On-Set Virtual Production Initiative). Additionally, some useful attributes from the SMPTE ACES Container File Layout standard, SMPTE ST 2065-4:2023, have been included as well. The new attributes are:

    Support automated editorial workflow:

... (truncated)

Changelog

Sourced from openexr's changelog.

Version 3.2.3 (March 6, 2024)

Patch release with various build/bug/documentation fixes:

  • Fix bswap on NetBSD
  • Fix issue with decompressing fp32 dwa files
  • Support cmake config for libdeflate
  • updated security policy
  • miscelleneous website improvements

This release also addresses:

  • OSS-fuzz 66676 Null-dereference in Imf_3_3::realloc_deepdata
  • OSS-fuzz 66612 Null-dereference in Imf_3_3::realloc_deepdata

Merged Pull Requests

  • 1653 Allow partial chunk tables
  • 1652 Fix 0 samples in deep data
  • 1651 Add recent releases to website news
  • 1650 Fix memory leaks in exrstdattr and example code (#1649)
  • 1647 Remove -Dsonar.login from sonar-scanner command line
  • 1643 Use component for python
  • 1640 Fix version tag for python wheel sdist
  • 1637 Add instructions for creating signed releases/tags
  • 1636 Do synk scans weekly on Sunday mornings
  • 1635 check and control reduceMemory and reduceTime in stream mode
  • 1634 adds a shortcut to avoid reconstructing every call
  • 1633 Fix install of symlink
  • 1631 Remove snyk-scan-pr.yml
  • 1629 Build python wheels via scikit-build-core
  • 1626 Bazel support: Bump Imath to 3.1.10
  • 1624

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [openexr](https://github.com/AcademySoftwareFoundation/OpenEXR) from 1.3.2 to 3.2.3.
- [Release notes](https://github.com/AcademySoftwareFoundation/OpenEXR/releases)
- [Changelog](https://github.com/AcademySoftwareFoundation/openexr/blob/main/CHANGES.md)
- [Commits](https://github.com/AcademySoftwareFoundation/OpenEXR/commits/v3.2.3)

---
updated-dependencies:
- dependency-name: openexr
  dependency-version: 3.2.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Apr 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file python Pull requests that update python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants