graphics/openexr-website-docs3.4.16

graphics/openexr*: update to 3.4.16 bugfix release

"v3.4.16 fixes a bug which created unreadable DWAB files in certain
circumstances.  There is also a fix to prevent 'undefined behavior'
warnings with the BytesAttribute"

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.16
PR:		299085
Pull request:	https://github.com/freebsd/freebsd-ports/pull/631
MFH:		2026Q4

graphics/openexr*: security fix update to v3.4.15

"v3.4.15 fixes two memory issues when parsing IDManifests. Corrupt
or maliciously formed OpenEXR images could trigger excessive memory
allocation, but only in code which decodes the idmanifest attribute.
Other code is unaffected, even when handling files with idmanifest
attributes [...] CVEs have been requested for these issues."
<https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.15>

CVEs are not yet communicated.

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/blob/v3.4.15/CHANGES.md#version-3415-august-21-2026

Pull request:	https://github.com/freebsd/freebsd-ports/pull/594
MFH:		2026Q3
PR:		297717

graphics/openexr*: Security update 3.4.13 => 3.4.14

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14

PR:		297486
Reported by:	mandree (maintainer)
Approved by:	osa, vvd (Mentors, implicit)
Pull Request:	https://github.com/freebsd/freebsd-ports/pull/580
MFH:		2026Q3
Security:	CVE-2026-68514 PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow
Security:	CVE-2026-68513 PyOpenEXR prefixed literal RGB key collision heap buffer overflow
Security:	CVE-2026-62986 PyOpenEXR deep prefixed RGB stale lane disclosure
Security:	CVE-2026-61703 PyOpenEXR deep mixed RGB heap buffer overflow
Security:	CVE-2026-61555 empty multiView viewFromChannelName file crash
Security:	CVE-2026-59985 ILP32 OpenEXRCore RLE decode heap OOB read DoS
Security:	CVE-2026-59984 ILP32 B44 InputFile decode scratch buffer overflow
Security:	CVE-2026-59983 ILP32 DeepTiledInputFile sample count table decode OOB read
Security:	CVE-2026-59982 ILP32 DWAA InputFile packed AC buffer overflow
Security:	CVE-2026-59981 OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read
Security:	CVE-2026-59189 OpenEXRUtil DeepImageChannel row nonzero dataWindow heap OOB read
Security:	CVE-2026-59187 OpenEXR exrmetrics deep pixelmode heap buffer overflow
Security:	CVE-2026-59186 OpenEXR ILP32 TiledRgbaInputFile large tile Array2D heap OOB write
Security:	CVE-2026-59184 OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write
Security:	CVE-2026-59183 Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding

graphics/ImageMagick: update to 7.1.2-25

Changes:	https://github.com/ImageMagick/ImageMagick/compare/7.1.2-24...7.1.2-25
Security:	CVE-2026-53460
Security:	CVE-2026-53461
Security:	CVE-2026-53462
Security:	CVE-2026-53463
Security:	CVE-2026-53464
Security:	CVE-2026-53465
PR:		296190

graphics/openexr*: security update to 3.4.13

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.13
MFH:		2026Q2
PR:		296159

Security:	CVE-2026-55373
OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts

Security:	CVE-2026-55371
OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length

Security:	CVE-2026-55059
OpenEXRUtil SampleCountChannel row setter heap out-of-bounds

Security:	CVE-2026-54920
Integer Overflow and Use of Uninitialized Pointer leading to Invalid Delete in OpenEXRUtil Image Resize

Security:	CVE-2026-53532
Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)

Pull Request:	https://github.com/freebsd/freebsd-ports/pull/543

graphics/openexr*: update to 3.4.12

Changelog: https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.12

PR:	295508
Sponsored by:	Netzkommune GmbH

graphics/openexr*: Security update to 3.4.11

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.11

PR:		294882
Security:	787cde46-4424-11f1-943f-05b19d100dca
		CVE-2026-42217
		CVE-2026-42216
		CVE-2026-41142
MFH:		2026Q2

graphics/openexr*: Security update to 3.4.10

Addresses security vulnerabilities

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.10

Obtained from:	GitHub repo
Security:	CVE-2026-39886
		CVE-2026-40244
		CVE-2026-40250

graphics/openexr*: Security update to 3.4.9

Addresses several security vulnerabilities

Changelog:
https://github.com/AcademySoftwareFoundation/openexr/blob/v3.4.9/CHANGES.md#version-349-april--3-2026

PR:		294197
Security:       CVE-2026-34589, CVE-2026-34588, CVE-2026-34380,
		CVE-2026-34379, CVE-2026-34378,
		adb096d4-2e72-11f1-acc1-339a1a6999b0

graphics/openexr*: Update to 3.4.8

Bugfix release

Changelog(s):
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.8
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.7
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.6

PR:		293859

graphics/openexr*: Security update to v3.4.5 and i386 fix

"Patch release that fixes an incorrect size check in
istream_nonparallel_read that could lead to a buffer overflow on invalid
input data."

Also fix i386 self-tests by adding -msse2: i386 builds require SSE2, but
the upstream cmake stuff does not enable this, so use CFLAGS_i386.

To prevent people seeing SIGILL crashes down late at run-time,
check if the CPU is sse2-capable by querying the clang compiler from
the pre-install script (pkg-plist's @preexec). Suggested by diizzy@.
  Other than that we could use the cpuid or the lscpu port instead, but
let's for now assume everything that wants to run OpenEXR also has a
working cc that is clang and has -march=native and gives us CPU details).
(GCC also gives us this but will use a different output format.)

While here, make failed tests verbose through ctest's environment so we
can see what's up from the build log already. (We need to go through
this indirection because our cmake.mk's :testing feature wants to go
through the test target instead of calling ctest directly.)

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.5
Security:	716d25a6-0fdc-11f1-bfdf-ff9355aecb00
MFH:		2026Q1

graphics/openexr-website-docs: fix 3.4.4 distinfo

graphics/openexr*: update to 3.4.4

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.4

graphics/openexr-website-docs: update distfile to match 3.4.3

graphics/openexr*: security update to 3.4.3

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.3
Security:	c71a3914-ba96-11f0-aada-f59a8ea34d12
MFH:		2025Q4

graphics/openexr*: update to v3.4.1

ChangeLog:	<https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.1>

graphics/openexr*: update to v3.4.0

Adds lossless compression with High Throughput JPEG-2000 (HTJ2K)
encoding, which adds an OpenJPH dependency.

The OneAPI TBB option isn't provided because it massively increases
self-test time on FreeBSD 14.3-amd64 and I don't see how production
use would be different.  This is with an AMD Ryzen processor.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.0

graphics/openexr*: update to v3.3.5 bugfix release

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.5
MFH:		2025Q3 (after a few days)

graphics/openexr-website-docs: fix up distinfo

graphics/openexr*: Update to v3.3.4

Changelog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.4
MFH:		2025Q2

graphics/openexr*: update to v3.3.3

This contains out-of-bounds memory access fixes, hence:

MFH:		2025Q1
ChangeLog: 	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3

graphics/openexr-website-docs: unbreak and update to 3.3.2

And while here, decouple our PORTVERSION from the openexr version so we
don't break builds.

v3.3.2 seems to have a regression and causes a warning around Latest
News inserts on one site, so add -DSPHINX_OPTS= to override the default
of -W which means "treat warnings as errors", as of 3.3.2, I see one
warning.

graphics/openexr*: upgrade to 3.3.1

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.1

Also add a local docs/CMakeLists.txt patch to add an exrmetrics man
page, omission reported upstream to
https://github.com/AcademySoftwareFoundation/openexr/issues/1881

graphics/openexr*: upgrade to 3.3.0

This changes the ABI (but not the API) and .so file name,
so we will need to bump all PORTREVISIONs of users, and we'll also fix
graphics/ctl and multimedia/olive.

This is not going to be MFHd to 2024Q4 due to API change, and therefore
has also waited for 2024Q4 to branch before we committed this to main,
so as to avoid 2024Q4 breakage.

ChangeLog:	https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.0
PR:		281859

graphics/openexr-website-docs: fix build with v3.2.4 changes

- share the distfiles directory and the NO_WRKSUBDIR
- update patch for updated upstream CMakeLists.txt infrastructure

graphics/openexr-website-docs: update for v3.2.2

MFH:		2024Q1

graphics/openexr-website-docs: push distinfo update

...forgotten when pushing graphics/openexr 3.2.1 update 9a529daeee.

Reported by:	pkg-fallout@

graphics/openexr: update to 3.2.0

- Also install manual pages (generated through help2man)
- The website (formerly known "DOCS" build) requires the "convert(1)"
  tool, which is part of ImageMagick, which itself depends on OpenEXR.
  To break the loop, split out the offline website build to a new
  package, graphics/openexr-website-docs