Bump openexr from 3.3.1 to 3.3.9

[dependabot]

Bumps openexr from 3.3.1 to 3.3.9.

Release notes

Sourced from openexr's releases.

v3.3.9

Patch release for v3.3 that addresses the following security vulnerabilities:

• CVE-2026-34589 DWA Lossy Decoder Heap Out-of-Bounds Write
• CVE-2026-34588 Signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
• CVE-2026-34544 integer overflow to OOB write in uncompress_b44_impl()
• CVE-2026-34543 Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
• CVE-2026-34380 Signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression
• CVE-2026-34379 Misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)
• CVE-2026-34378 Signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x

v3.3.8

Patch release that prevents an integer overflow when using the CompositeDeepScanLine API to combine multiple deep parts.

v3.3.7

Patch release that fixes an incorrect size check in istream_nonparallel_read that could lead to a buffer overflow on invalid input data.

v3.3.6

Patch release that addresses several bugs, primarily involving properly rejecting corrupt input data.

Specifically:

• Buffer overflow in PyOpenEXR_old's channels() and channel() in legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
• Use after free in PyObject_StealAttrString in legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
• Use of Uninitialized Memory in openexr, reported by Aldo Ristori (GitHub: Kaldreic).
• Heap-based Buffer Overflow Remote Code Execution Vulnerability, reported by Trend Micro Zero Day Initiative.

Full changelog: v3.3.5..v3.3.6

v3.3.5

Patch release with a couple bug/performance fixes:

• 🐛 Fix for DeepScanlineInputFile read memory leak
• 🚀 OpenEXRCore Deep pixel unpacking optimisation

v3.3.4

Patch release with several bug/build/performance fixes:

• 🐛 Fix a crash with deep scanline input
• 🐛 Fix a bug when reading a file with missing tiles
• 🐛 Fix a crash in exrmetrics
• 🛠️ Fix a problem with /EHsc and /MP flags that broke CUDA compilation
• 🛠️ Fix a build failure on MinGW
• 🚀 Enable vectorisation for ZIP reconstruct stage on Windows

v3.3.3

Patch release with miscellaneous bug/build/documentation fixes:

🐛 Fix a bug involving deep tiled images 🐛 Adjust the clamping on the dwa compression (Issue AcademySoftwareFoundation/openexr#1982)

... (truncated)

Changelog

Sourced from openexr's changelog.

Version 3.3.10 (April 17, 2026)

Patch release that addresses the following security vulnerabilities:

• CVE-2026-40244 Integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)
• CVE-2026-40250 Integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)

Merged Pull Requests

• 2346 Fix integer overflow in internal_dwa_compressor.h

Version 3.3.9 (April 4, 2026)

Patch release for v3.3 that addresses the following security vulnerabilities:

• CVE-2026-34589 DWA Lossy Decoder Heap Out-of-Bounds Write
• CVE-2026-34588 Signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
• CVE-2026-34544 integer overflow to OOB write in uncompress_b44_impl()
• CVE-2026-34543 Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
• CVE-2026-34380 Signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression
• CVE-2026-34379 Misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)
• CVE-2026-34378 Signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x

Merged Pull Requests

• 2329 Fix signed integer overflow in LossyDctDecoder_execute() pointer arithmatic
• 2328 fix integer overflow in PIZ wavelet buffer arithmetic
• 2324 Fix misaligned memory access in LossyDctDecoder_execute HALF→FLOAT expansion
• 2323 fix signed integer overflow in undo_pxr24_impl()
• 2321 Fix integer overflow in srcbuffer pointer arithmetic in unpack_*
• 2312 Fix B44/B44A integer overflow: use uint64_t for row offset
• 2310 PXR24: reject zlib output that does not match packed payload size

Version 3.3.8 (March 1, 2026)

Patch release that prevents an integer overflow when using the CompositeDeepScanLine API to combine multiple deep parts.

This release addresses the following CVEs:

• CVE-2026-27622 CompositeDeepScanLine integer-overflow leads to heap OOB write

... (truncated)

Commits

• 8bb3562 update v3.3.9 notes with added cves
• 1ff5a3b Fix misaligned memory access in LossyDctDecoder_execute HALF→FLOAT expansio...
• fa8c6d5 Security: fix signed integer overflow in undo_pxr24_impl() (PXR24 decoder) ...
• b4ef2a1 Fix integer overflow in srcbuffer pointer arithmetic in unpack_* (#2321)
• 2af0f74 PXR24: reject zlib output that does not match packed payload size (#2310)
• 067bf7d Fix B44/B44A integer overflow: use uint64_t for row offset (#2312)
• 4eefd45 bump version to 3.3.9 in install manifests
• b74b0d7 notes for v3.3.9
• c6d87de Bump version for v3.3.9
• 0c0cc32 Fix signed integer overflow in LossyDctDecoder_execute() pointer arithmetic...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.