v3.1.15.0

Release 3.1.15.0 (Jul 1, 2026) -- compared to 3.1.14.1
---------------------------------------------------------
  - *deepdata*: Widen `merge_deep_pixels` srcpixel to int64_t, change its return type, and add `OIIO_NODISCARD_ERROR`. [#5252](#5252) [#5253](#5253) (by @luna-y-kim / Luna Kim)
  - *ImageBuf*: Fix copy ctor of IC-backed ImageBuf zeroing bufspan strides. [#5244](#5244)
  - *cineon*: More robust to invalid numbers of channels and bit depths; also fixes a channel-naming counter bug and a memory leak in init(). [#5250](#5250) (3.1.15.0, 3.0.20.0)
  - *deepdata*: Correct Zback channel in `sort()`, change int pixel to int64_t. [#5241](#5241) (by @luna-y-kim / Luna Kim)
  - *fits*: Fix stack overflow from recursive header-block reading on corrupt files; convert to an iterative loop with a 10000-header safety limit. [#5248](#5248) (3.1.15.0, 3.0.20.0)
  - *fmath.h*: Fix typo in `convert_type` default argument, `min()` should have been `max()`. [#5227](#5227) (by @luna-y-kim / Luna Kim)
  - *hdr*: Make the HDR reader tolerant to CR in the ASCII header. [#5261](#5261)
  - *iff*: Fix allocation bug when reading 16 bit RGBA + float z (buffer size did not account for the z channel). [#5251](#5251) (3.1.15.0, 3.0.20.0)
  - *tiff*: The "tiff:half" hint was only applying to first MIP level. [#5240](#5240)
  - *ci*: Fixes to build_opencolorio.bash script [#5219](#5219); upgrade 'latest' CI tests to OpenEXR v3.4.14, fmt 12.2, PugiXML v1.16 [#5245](#5245).
  - *build*: Add support for gcc-15 [#5126](#5126), gcc-16 [#5225](#5225), and C++26 [#5230](#5230), each tested in CI.
  - *build*: Suppress warnings in fmt library when building on Mac. [#5237](#5237) (by @antond-weta / Anton Dukhovnikov) (3.1.15.0, 3.0.20.0)
  - *int*: Remove deprecated `std::codecvt` from strutil.cpp internals. [#5107](#5107)
  - *docs*: Fix typos in fmath.h comments. [#5222](#5222) (by @luna-y-kim / Luna Kim) (3.1.15.0, 3.0.20.0)
  - *docs*: Fix typos and update reference link in deepdata comments. [#5238](#5238) (by @luna-y-kim / Luna Kim)
  - *docs*: Clarify plugin.h explanations by saying their Unix-like equivalents. [#5226](#5226)
  - *docs*: Fix typo in bitcast docs. [#5255](#5255)

v3.0.20.0

Release 3.0.20.0 (Jul 1, 2026) -- compared to 3.0.19.1
---------------------------------------------------------
  - *cineon*: More robust to invalid numbers of channels and bit depths; also fixes a channel-naming counter bug and a memory leak in init() [#5250](#5250) (by @lgritz / Larry Gritz)
  - *fits*: Fix stack overflow from recursive header-block reading on corrupt files; convert to an iterative loop with a 10000-header safety limit [#5248](#5248) (by @lgritz / Larry Gritz)
  - *iff*: Fix allocation bug when reading 16 bit RGBA + float z (buffer size did not account for the z channel) [#5251](#5251) (by @lgritz / Larry Gritz)
  - *ci*: Address disabled old node support on aswf-old jobs for OIIO 3.0 [#5278](#5278) (by @lgritz / Larry Gritz)
  - *build*: Suppress warnings in fmt library when building on Mac [#5237](#5237) (by @antond-weta / Anton Dukhovnikov)
  - *docs*: Fix typos in fmath.h comments [#5222](#5222) (by @luna-y-kim / Luna Kim)

v3.1.14.1

Release 3.1.14.1 (Jun 14, 2026) -- compared to 3.1.14.0
---------------------------------------------------------
  - *build*: Fix build break when auto-build pystring is needed, after it updated to v1.2.0. [#5235](#5235)
  - *admin*: Clarify security policy to explain what qualifies as a vulnerability. [#5232](#5232)
  - *admin*: Misc administrative docs fixups. [#5233](#5233)

v3.0.19.1

Release 3.0.19.1 (Jun 14, 2026) -- compared to 3.0.19.0
---------------------------------------------------------
  - *build*: Fix build break when auto-build pystring is needed, after it updated to v1.2.0 [#5235](#5235)
  - *admin*: Clarify security policy to explain what qualifies as a vulnerability [#5232](#5232)

v3.1.14.0

Release 3.1.14.0 (Jun 1, 2026) -- compared to 3.1.13.1
---------------------------------------------------------
  - *oiiotool*: Add `--nchannels` flag for parity with maketx. [#5198](#5198) (by Danny Greenstein)
  - *oiiotool*: Commands taking offsets or geometry arguments now accept a more flexible offset notation with commas as alternative separators (e.g., `X,Y` or `WxH,X,Y` in addition to the X11-style `+X+Y` form). This affects `--create`, `--crop`, `--cut`, `--fit`, `--fullsize`, `--origin`, `--originoffset`, `--paste`, `--pattern`, `--printstats`, `--resize`. [#5209](#5209)
  - *oiiotool*: Be more cautious about implicit promotion to float when `--autocc` is used alongside explicit color space names. [#5192](#5192)
  - *color mgmt*: For OCIO built-in configs, replace the default file rules with more sensible ones that avoid spurious matches (e.g., no longer assumes all `.exr` files use ACES2065-1 primaries). [#5194](#5194)
  - *iconvert*: Allow `-o outfile` for output file designation, for parity with oiiotool syntax. [#5173](#5173)
  - *ColorConfig*: New `isData()` API method to query if a color space is a data space; fix Python `isColorSpaceLinear()`. [#5191](#5191)
  - *ustring*: Allow freeing the ustring table via `OIIO::attribute("ustring:cleanup", 1)` or env var `OIIO_USTRING_CLEANUP=1`, useful for suppressing false positives in memory leak detection tools. [#5213](#5213)
  - *dicom*: Enforce reasonable resolution limits to guard against corrupt files. [#5167](#5167) (3.1.14.0, 3.0.19.0)
  - *gif*: Preserve RGB values of transparent-indexed pixels (previously only alpha was set, zeroing the RGB channels). [#5188](#5188) (by Lumina Wang)
  - *jpeg*: More correctly handle bounds checks for malformed APP1 Exif and APP2 ICC metadata markers. [#5174](#5174) (by Vlad Erium)
  - *jpeg-xl*: Enforce format resolution limits, for better detection of corrupt or invalid files. [#5202](#5202) (by Hannah Gulka)
  - *jpeg-xl*: Prevent JXL reader from loading or allocating memory for arbitrarily large non-image files. [#5203](#5203) (by Maxwell Iverson) (3.1.14.0, 3.0.19.0)
  - *pnm*: Prevent PNM reader from loading or allocating memory for arbitrarily large non-image files. [#5203](#5203) (by Maxwell Iverson) (3.1.14.0, 3.0.19.0)
  - *psd*: Fix indexed transparency. [#5177](#5177) (by Vlad Erium)
  - *softimage*: Fix possible small allocation leak in RLE decoder. [#5182](#5182)
  - *webp*: Fix bounds handling for WebP EXIF metadata chunks. [#5175](#5175) (by Vlad Erium)
  - *webp*: Enforce format resolution limits, for better detection of corrupt or invalid files. [#5202](#5202) (by Hannah Gulka)
  - *perf(windows)*: Speedup various file system operations on Windows using native APIs. [#5199](#5199) (by Lumina Wang)
  - *build*: Remove `-Wno-unused-result` from gcc compile options, surfacing more potential warnings. [#5214](#5214) (by Luna Kim)
  - *ci*: Fix broken CI by locking down aswf container for 2023 [#5200](#5200); remove deprecated windows-2025 runner [#5189](#5189)
  - *admin*: Add CVE-2024-55194 (long since fixed) to security alerts. [#5216](#5216)
  - *Contributors*: First-time contributors to this release: Hannah Gulka, Luna Kim, Marta Feriani, Maxwell Iverson.

v3.0.19.0

Release 3.0.19.0 (Jun 1, 2026) -- compared to 3.0.18.1
---------------------------------------------------------
  - *pnm,jxl*: Prevent PNM/JXL readers from loading, or doing allocations for, arbitrarily large non-image files [#5203](#5203) (by Maxwell Iverson)
  - *dicom*: Enforce reasonable resolution limits to guard against corrupt file [#5167](#5167)
  - *build*: Test building with clang 22.1, fix warnings uncovered [#5067](#5067)
  - *ci*: Fix broken CI by locking down aswf container for 2023 [#5200](#5200)
  - *tests*: New ref image for libheif 1.22 [#5212](#5212)

v3.1.13.1

Release 3.1.13.1 (May 3, 2026) -- compared to 3.1.13.0
---------------------------------------------------------
  - *dpx*: Several safety fixes for corrupt DPX files: integer overflow protection in buffer size calculations, span-based pointer safety, and use of check_open() for resolution/channel validation [#5170](#5170)

v3.1.13.0

Release 3.1.13.0 (May 1, 2026) -- compared to 3.1.12.0
---------------------------------------------------------
  - *IBA*: Add FLIP perceptual image difference metric as an experimental feature for testing, including new `ImageBufAlgo::experimental::FLIP_diff()` C++ API, Python `ImageBufAlgo.FLIP_diff()`, and `oiiotool --flipdiff` command. Also introduces `oiiotool --experimental` flag to enable experimental features not yet part of the stable API. [#5154](#5154) [#5171](#5171) [#5147](#5147)
  - *fmath.h*: Make `degrees()` and `radians()` `constexpr` [#5151](#5151)
  - *ImageSpec*: `ImageSpec::get_string_attribute()` didn't correctly translate to string [#5161](#5161)
  - *bmp*: Correctly handle the combination of greyscale + RLE compression [#5163](#5163)
  - *dds*: Corruption protection: validate resolution and guard against integer overflow [#5131](#5131)
  - *heif*: Fix incorrect tracking of current subimage [#5166](#5166)
  - *iinfo*: Better error handling, especially from `--hash` [#5168](#5168)
  - *jpeg*: Be more flexible with corrupt IPTC blocks [#5140](#5140)
  - *jpeg2000*: Guard against integer overflow in buffer size computation [#5143](#5143)
  - *rla*: Harden against corrupted files. [#5153](#5153) [#5172](#5172)
  - *sgi*: Better detection of corrupt RLE info that could overflow [#5141](#5141)
  - *softimage*: Multiple hardening fixes against corrupted input: prevent buffer overruns from corrupt RLE [#5142](#5142), more general hardening [#5155](#5155), fix malformed channel packets [#5156](#5156)
  - *targa*: Protection against corrupt, mis-sized palette [#5165](#5165)
  - *tiff*: Care with missing rowsperstrip [#5160](#5160); more care ignoring XMP tags that should not be used [#5162](#5162)
  - *xmp*: Correctly parse XMP with self-closing elements [#5106](#5106)
  - *fix*: Relax OpenColorIO exception handling to be more robust against errors [#5164](#5164)
  - *ci*: Fix CI breakages: fmtlib renamed 'master' branch to 'main' [#5127](#5127); fix Mac CI by adding missing jpeg-xl install [#5139](#5139)
  - *ci*: Try to reduce costs and timeouts for expensive tests in debug mode [#5150](#5150)
  - *deps*: Update R3D SDK to version 9.2.0 [#5148](#5148) (by Peter Kovář)
  - *build*: Fix Makefile wrapper to properly quote test regex [#5146](#5146); minor debugging fixes to dependency_utils [#5128](#5128)
  - *int*: Turn on OIIO_NODISCARD_ERROR_ENABLE for internal builds [#5145](#5145)
  - *admin*: Update security instructions to emphasize reporting via GitHub [#5149](#5149)

v3.0.18.1

Release 3.0.18.1 (May 3, 2026) -- compared to 3.0.18.0
---------------------------------------------------------
  - *dpx*: Several safety fixes for corrupt DPX files: integer overflow protection in buffer size calculations, span-based pointer safety, and use of check_open() for resolution/channel validation [#5170](#5170)