AcademySoftwareFoundation · meimchu · May 15, 2026 · May 15, 2026 · May 15, 2026 · May 15, 2026
diff --git a/.github/workflows/ci_workflow.yml b/.github/workflows/ci_workflow.yml
@@ -57,9 +57,9 @@ jobs:
     container:
       # DockerHub: https://hub.docker.com/u/aswf
       # Source: https://github.com/AcademySoftwareFoundation/aswf-docker
-      image: aswf/ci-ocio:${{ matrix.vfx-cy }}
+      image: aswf/ci-ocio:${{ matrix.container-tag || matrix.vfx-cy }}
     strategy:
-      fail-fast: true
+      fail-fast: false
       matrix:
         build: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]
         include:
@@ -204,6 +204,7 @@ jobs:
             cc-compiler: clang
             compiler-desc: Clang
             vfx-cy: 2023
+            container-tag: 2023.2
             install-ext-packages: MISSING
           - build: 2
             build-type: Release
@@ -217,6 +218,7 @@ jobs:
             cc-compiler: gcc
             compiler-desc: GCC
             vfx-cy: 2023
+            container-tag: 2023.2
             install-ext-packages: ALL
           - build: 1
             build-type: Release
@@ -230,6 +232,7 @@ jobs:
             cc-compiler: gcc
             compiler-desc: GCC
             vfx-cy: 2023
+            container-tag: 2023.2
             install-ext-packages: ALL
     env:
       CXX: ${{ matrix.cxx-compiler }}

diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -287,6 +287,19 @@ message(STATUS "")
 message(STATUS "Checking for GPU configuration...")
 include(CheckSupportGL)
 
+# DirectX 12 is only available on Windows.
+if(WIN32)
+    option(OCIO_DIRECTX_ENABLED "Enable DirectX 12 GPU rendering support" ON)
+else()
+    set(OCIO_DIRECTX_ENABLED OFF CACHE BOOL "Enable DirectX 12 GPU rendering support" FORCE)
+endif()
+mark_as_advanced(OCIO_DIRECTX_ENABLED)
+
+# Vulkan is cross-platform but requires an external SDK, so it is off by
+# default; enable explicitly with -DOCIO_VULKAN_ENABLED=ON.
+option(OCIO_VULKAN_ENABLED "Enable Vulkan GPU rendering support" OFF)
+mark_as_advanced(OCIO_VULKAN_ENABLED)
+
 
 ###############################################################################
 # Check for ARM neon here because we need to know if ARM NEON is supported

diff --git a/SECURITY.md b/SECURITY.md
@@ -23,10 +23,6 @@ Include detailed steps to reproduce the issue, and any other information that
 could aid an investigation. Someone will assess the report and make every
 effort to respond within 14 days.
 
-## History of CVE Fixes
-
-None
-
 ## File Format Expectations
 
 Attempting to read an OCIO config (YAML) file will:
@@ -60,3 +56,7 @@ set of behaviors as with file loading.
 It is a bug if calling a function with well-formed arguments causes the 
 library to crash. It is a security issue if calling a function with 
 well-formed arguments causes arbitrary code execution.
+
+## History of CVE Fixes
+
+CVE-2026-42450 -- Stack buffer overflow in sscanf. (Fixed in OCIO 2.5.2)
diff --git a/docs/quick_start/installation.rst b/docs/quick_start/installation.rst
@@ -287,6 +287,8 @@ Here are the most common OCIO-specific CMake options (the default values are sho
 - ``-DOCIO_BUILD_TESTS=ON`` (Set to OFF to not build the unit tests)
 - ``-DOCIO_BUILD_GPU_TESTS=ON`` (Set to OFF to not build the GPU unit tests)
 - ``-DOCIO_USE_HEADLESS=OFF`` (Set to ON to do headless GPU rendering)
+- ``-DOCIO_DIRECTX_ENABLED=ON`` (Windows only; set to OFF to disable the DirectX 12 GPU rendering backend used by ``test_dx``. Forced OFF on non-Windows platforms.)
+- ``-DOCIO_VULKAN_ENABLED=OFF`` (Set to ON to enable the Vulkan GPU rendering backend used by ``test_vulkan``. Requires the Vulkan SDK to be installed and findable by CMake.)
 - ``-DOCIO_WARNING_AS_ERROR=ON`` (Set to OFF to turn off warnings as errors)
 - ``-DOCIO_BUILD_DOCS=OFF`` (Set to ON to build the documentation)
 

diff --git a/share/cmake/modules/FindDirectX-Headers.cmake b/share/cmake/modules/FindDirectX-Headers.cmake
@@ -0,0 +1,76 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright Contributors to the OpenColorIO Project.
+#
+# Locate DirectX-Headers (header-only, Windows only)
+#
+# Variables defined by this module:
+#   DirectX-Headers_FOUND        - Indicate whether the package was found or not
+#   DirectX-Headers_INCLUDE_DIR  - Location of the header files
+#   DirectX-Headers_VERSION      - Package version
+#
+# Global targets defined by this module:
+#   Microsoft::DirectX-Headers
+#
+# DirectX-Headers can be supplied by the caller through any of the standard
+# CMake mechanisms:
+# -- Set -DDirectX-Headers_DIR to the directory containing directx-headers-config.cmake
+# -- Set -DDirectX-Headers_ROOT to the install prefix (with include/directx/ underneath)
+# -- Set -DDirectX-Headers_INCLUDE_DIR to the directory containing directx/d3d12.h
+#
+# When OCIO_INSTALL_EXT_PACKAGES is not ALL, this module first tries to locate
+# an existing install via the upstream CMake config, then falls back to a
+# manual header search. If still not found and OCIO_INSTALL_EXT_PACKAGES is
+# MISSING (the default), OCIO's ocio_install_dependency() pathway will invoke
+# InstallDirectX-Headers.cmake to build it via FetchContent.
+#
+
+if(NOT OCIO_INSTALL_EXT_PACKAGES STREQUAL ALL)
+    # Prefer the upstream CMake config (installed as lower-case).
+    find_package(directx-headers ${DirectX-Headers_FIND_VERSION} CONFIG QUIET)
+
+    if(directx-headers_FOUND)
+        set(DirectX-Headers_FOUND TRUE)
+        if(directx-headers_VERSION)
+            set(DirectX-Headers_VERSION ${directx-headers_VERSION})
+        endif()
+    else()
+        # Fall back to locating the public header directly (e.g. when the
+        # headers were installed without the CMake config, or are provided
+        # by a vendored copy).
+        find_path(DirectX-Headers_INCLUDE_DIR
+            NAMES
+                directx/d3d12.h
+            HINTS
+                ${DirectX-Headers_ROOT}
+            PATH_SUFFIXES
+                include
+        )
+    endif()
+
+    # If OCIO can install the package itself, demote REQUIRED so a missing
+    # dependency here does not abort configuration before the install step.
+    if(OCIO_INSTALL_EXT_PACKAGES STREQUAL MISSING)
+        set(DirectX-Headers_FIND_REQUIRED FALSE)
+    endif()
+
+    include(FindPackageHandleStandardArgs)
+    find_package_handle_standard_args(DirectX-Headers
+        REQUIRED_VARS
+            DirectX-Headers_INCLUDE_DIR
+        VERSION_VAR
+            DirectX-Headers_VERSION
+    )
+endif()
+
+###############################################################################
+### Create target (only needed for the manual-header-search fallback; the
+### upstream CMake config already defines Microsoft::DirectX-Headers).
+
+if(DirectX-Headers_FOUND AND NOT TARGET Microsoft::DirectX-Headers AND DirectX-Headers_INCLUDE_DIR)
+    add_library(Microsoft::DirectX-Headers INTERFACE IMPORTED GLOBAL)
+    set_target_properties(Microsoft::DirectX-Headers PROPERTIES
+        INTERFACE_INCLUDE_DIRECTORIES "${DirectX-Headers_INCLUDE_DIR}"
+    )
+
+    mark_as_advanced(DirectX-Headers_INCLUDE_DIR DirectX-Headers_VERSION)
+endif()
diff --git a/share/cmake/modules/install/InstallDirectX-Headers.cmake b/share/cmake/modules/install/InstallDirectX-Headers.cmake
@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright Contributors to the OpenColorIO Project.
+#
+# Install DirectX-Headers (header-only, Windows only)
+# https://github.com/microsoft/DirectX-Headers
+#
+###############################################################################
+
+include(FetchContent)
+
+if(OCIO_DirectX-Headers_RECOMMENDED_VERSION)
+    set(DirectX-Headers_VERSION ${OCIO_DirectX-Headers_RECOMMENDED_VERSION})
+else()
+    set(DirectX-Headers_VERSION ${DirectX-Headers_FIND_VERSION})
+endif()
+
+set(FETCHCONTENT_BASE_DIR "${CMAKE_BINARY_DIR}/ext/build/DirectX-Headers")
+set(DIRECTX_HEADERS_BUILD_TEST OFF CACHE BOOL "" FORCE)
+
+FetchContent_Declare(DirectX-Headers
+    GIT_REPOSITORY https://github.com/microsoft/DirectX-Headers.git
+    GIT_TAG        v${DirectX-Headers_VERSION}
+)
+
+FetchContent_MakeAvailable(DirectX-Headers)
+
+# Signal success to ocio_install_dependency so ocio_handle_dependency does not
+# abort at the next required-check. FetchContent_MakeAvailable has just created
+# the Microsoft::DirectX-Headers target via the upstream CMakeLists.
+if(TARGET Microsoft::DirectX-Headers)
+    set(DirectX-Headers_FOUND TRUE)
+endif()
diff --git a/share/cmake/utils/LocateDXCompilerRuntime.cmake b/share/cmake/utils/LocateDXCompilerRuntime.cmake
@@ -0,0 +1,78 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright Contributors to the OpenColorIO Project.
+#
+# Locate the dxcompiler.dll + dxil.dll runtime pair needed to run D3D12 shader
+# compilation at test time, and surface their file version.
+#
+# Inputs:
+#   OCIO_DXCOMPILER_DLL  - Optional user-supplied path to dxcompiler.dll.
+#                          When set, overrides the Windows SDK Redist/D3D
+#                          search. Useful when the SDK-bundled DLL is too old.
+#
+# Outputs:
+#   DXCOMPILER_DLL       - Path to dxcompiler.dll (cache variable).
+#   DXIL_DLL             - Path to the adjacent dxil.dll (cache variable, may
+#                          be left unset if not found next to dxcompiler.dll).
+
+set(OCIO_DXCOMPILER_DLL "" CACHE FILEPATH
+    "Optional explicit path to dxcompiler.dll (e.g. from a newer DirectX Shader Compiler release). \
+Overrides the automatic Windows SDK Redist/D3D search."
+)
+
+if(OCIO_DXCOMPILER_DLL)
+    if(NOT EXISTS "${OCIO_DXCOMPILER_DLL}")
+        message(FATAL_ERROR "OCIO_DXCOMPILER_DLL=${OCIO_DXCOMPILER_DLL} does not exist.")
+    endif()
+    set(DXCOMPILER_DLL "${OCIO_DXCOMPILER_DLL}" CACHE FILEPATH
+        "Path to dxcompiler.dll (user-supplied via OCIO_DXCOMPILER_DLL)" FORCE)
+else()
+    find_file(DXCOMPILER_DLL
+        NAMES dxcompiler.dll
+        PATHS
+            # Note: x64 hardcoded; update if ARM64 Windows support is needed.
+            "$ENV{WindowsSdkDir}Redist/D3D/x64"
+            "C:/Program Files (x86)/Windows Kits/10/Redist/D3D/x64"
+        NO_DEFAULT_PATH
+        DOC "Path to dxcompiler.dll from Windows SDK"
+    )
+endif()
+
+if(DXCOMPILER_DLL)
+    get_filename_component(_dxc_dll_dir "${DXCOMPILER_DLL}" DIRECTORY)
+    find_file(DXIL_DLL
+        NAMES dxil.dll
+        HINTS "${_dxc_dll_dir}"
+        NO_DEFAULT_PATH
+    )
+
+    # Report the found dxcompiler.dll version so crash reports can identify
+    # mismatched or outdated DXC builds without re-running diagnostics.
+    string(REPLACE "'" "''" _dxc_dll_ps "${DXCOMPILER_DLL}")
+    execute_process(
+        COMMAND powershell -NoProfile -Command
+            "(Get-Item -LiteralPath '${_dxc_dll_ps}').VersionInfo.FileVersion"
+        OUTPUT_VARIABLE _dxc_version
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+        ERROR_QUIET
+    )
+    if(_dxc_version)
+        message(STATUS "Found dxcompiler.dll (version ${_dxc_version}): ${DXCOMPILER_DLL}")
+    else()
+        message(STATUS "Found dxcompiler.dll (version unknown): ${DXCOMPILER_DLL}")
+    endif()
+    message(STATUS
+        "If test_dx crashes during shader compilation, the Windows SDK's dxcompiler.dll "
+        "may be too old to produce signed DXIL on this system. Replace it with a newer "
+        "build from https://github.com/microsoft/DirectXShaderCompiler/releases, or set "
+        "-DOCIO_DXCOMPILER_DLL=<path> to point at a specific dxcompiler.dll."
+    )
+else()
+    message(WARNING
+        "OCIO_DIRECTX_ENABLED is ON but dxcompiler.dll was not found in the "
+        "Windows SDK Redist/D3D path. test_dx will fail at runtime unless "
+        "dxcompiler.dll and dxil.dll are on PATH. Install the Windows SDK "
+        "redistributable components, set -DOCIO_DXCOMPILER_DLL=<path> to supply "
+        "a specific dxcompiler.dll, or set -DOCIO_DIRECTX_ENABLED=OFF to "
+        "disable the DirectX 12 backend."
+    )
+endif()
diff --git a/src/OpenColorIO/Config.cpp b/src/OpenColorIO/Config.cpp
@@ -2561,7 +2561,8 @@ const char * Config::getInactiveColorSpaces() const
 bool Config::isInactiveColorSpace(const char * colorspace) const noexcept
 {
     StringUtils::StringVec svec;
-    pystring::split(getImpl()->m_inactiveColorSpaceNamesConf.c_str(), svec, ", ");
+    svec = StringUtils::Split(getImpl()->m_inactiveColorSpaceNamesConf.c_str(), ',');
+    StringUtils::Trim(svec);
 
     for (size_t i = 0; i < svec.size(); i++)
     {
@@ -6026,7 +6027,7 @@ bool Config::isArchivable() const
                 // 1) Path may not be absolute.
                 pystring::os::path::isabs(normPath)  || 
                 // 2) Path may not start with double dot ".." (going above working directory).
-                pystring::startswith(normPath, "..") ||
+                StringUtils::StartsWith(normPath, "..") ||
                 // 3) A context variable may not be located at the start of the path.
                 (ContainsContextVariables(path) && 
                 (StringUtils::Find(path, "$") == 0 || 

diff --git a/src/OpenColorIO/OCIOZArchive.cpp b/src/OpenColorIO/OCIOZArchive.cpp
@@ -174,7 +174,7 @@ void addSupportedFiles(void * archiver, const char * path, const char * configWo
                 std::string root, ext;
                 pystring::os::path::splitext(root, ext, std::string(entry->d_name));
                 // Strip leading dot character in order to get the extension name only.
-                ext = pystring::lstrip(ext, ".");
+                ext = StringUtils::LeftTrim(ext, '.');
 
                 // Check if the extension is supported. Using logic from LoadFileUncached().
                 FormatRegistry & formatRegistry = FormatRegistry::GetInstance();

diff --git a/src/OpenColorIO/Op.cpp b/src/OpenColorIO/Op.cpp
@@ -4,8 +4,6 @@
 #include <cstring>
 #include <sstream>
 
-#include <pystring.h>
-
 #include <OpenColorIO/OpenColorIO.h>
 
 #include "Logging.h"
@@ -23,6 +21,7 @@
 #include "ops/lut1d/Lut1DOp.h"
 #include "ops/lut3d/Lut3DOp.h"
 #include "ops/range/RangeOp.h"
+#include "utils/StringUtils.h"
 
 namespace OCIO_NAMESPACE
 {
@@ -470,15 +469,15 @@ std::ostream& operator<< (std::ostream & os, const Op & op)
     return os;
 }
 
-std::string SerializeOpVec(const OpRcPtrVec & ops, int indent)
+std::string SerializeOpVec(const OpRcPtrVec & ops, size_t indent)
 {
     std::ostringstream oss;
 
     for (OpRcPtrVec::size_type idx = 0, size = ops.size(); idx < size; ++idx)
     {
         const OpRcPtr & op = ops[idx];
 
-        oss << pystring::mul(" ", indent);
+        oss << StringUtils::Repeat(" ", indent);
         oss << "Op " << idx << ": " << *op << " ";
         oss << op->getCacheID();
 

diff --git a/src/OpenColorIO/Op.h b/src/OpenColorIO/Op.h
@@ -409,7 +409,7 @@ class OpRcPtrVec
 
 };
 
-std::string SerializeOpVec(const OpRcPtrVec & ops, int indent=0);
+std::string SerializeOpVec(const OpRcPtrVec & ops, size_t indent=0);
 
 void CreateOpVecFromOpData(OpRcPtrVec & ops,
                             const ConstOpDataRcPtr & opData,

diff --git a/src/OpenColorIO/fileformats/FileFormatIridasLook.cpp b/src/OpenColorIO/fileformats/FileFormatIridasLook.cpp
@@ -416,7 +416,7 @@ class XMLParserHelper
         if (pImpl->m_size)
         {
             std::string size_raw = std::string(s, len);
-            std::string size_clean = pystring::strip(size_raw, "'\" "); // strip quotes and space
+            std::string size_clean = StringUtils::Trim(size_raw, "'\" "); // strip quotes and space
 
             long int size_3d{};
 

diff --git a/src/OpenColorIO/transforms/FileTransform.cpp b/src/OpenColorIO/transforms/FileTransform.cpp
@@ -613,7 +613,7 @@ void LoadFileUncached(FileFormat * & returnFormat,
     std::string root, extension;
     pystring::os::path::splitext(root, extension, filepath);
     // remove the leading '.'
-    extension = pystring::replace(extension,".","",1);
+    extension = StringUtils::Replace(extension, ".", "", 1);
 
     FormatRegistry & formatRegistry = FormatRegistry::GetInstance();
 

diff --git a/src/apps/ociochecklut/main.cpp b/src/apps/ociochecklut/main.cpp
@@ -52,18 +52,18 @@ class ProcessorWrapper
         m_gpu = gpu;
         if (!m_oglApp)
         {
-            m_oglApp = OCIO::OglApp::CreateOglApp("ociochecklut", 256, 20);
+            m_oglApp = OCIO::GraphicalApp::CreateApp("ociochecklut", 256, 20);
 
             if (m_verbose)
             {
-                m_oglApp->printGLInfo();
+                m_oglApp->printGraphicsInfo();
             }
         }
 
-        m_oglApp->setPrintShader(m_verbose);
+        m_oglApp->setShaderVerbose(m_verbose);
         float image[4]{ 0.f, 0.f, 0.f, 0.f };
-        m_oglApp->initImage(1, 1, OCIO::OglApp::COMPONENTS_RGBA, image);
-        m_oglApp->createGLBuffers();
+        m_oglApp->initImage(1, 1, OCIO::GraphicalApp::COMPONENTS_RGBA, image);
+        m_oglApp->createBuffers();
         OCIO::GpuShaderDescRcPtr shaderDesc = OCIO::GpuShaderDesc::CreateShaderDesc();
         shaderDesc->setLanguage(OCIO::GPU_LANGUAGE_GLSL_1_2);
         m_gpu->extractGpuShaderInfo(shaderDesc);
@@ -98,7 +98,7 @@ class ProcessorWrapper
         m_oglApp->redisplay();
         m_oglApp->readImage(pixel.data());
     }
-    OCIO::OglAppRcPtr m_oglApp;
+    OCIO::GraphicalAppRcPtr m_oglApp;
 #else
     void applyGPU(std::vector<float> &)
     {