AcademySoftwareFoundation · doug-walker · Jan 23, 2026 · Feb 11, 2026 · Mar 5, 2026 · Apr 1, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -8,9 +8,13 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
+    # Only do security updates rather than all version updates.
+    open-pull-requests-limit: 0
 
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
+    # Only do security updates rather than all version updates.
+    open-pull-requests-limit: 0
diff --git a/.github/workflows/analysis_workflow.yml b/.github/workflows/analysis_workflow.yml
@@ -44,8 +44,8 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 50
-      - name:  Install sonar-scanner and build-wrapper
-        uses: sonarsource/sonarcloud-github-c-cpp@v2
+      - name:  Install build-wrapper
+        uses: SonarSource/sonarqube-scan-action/install-build-wrapper@59db25f34e16620e48ab4bb9e4a5dce155cb5432 # v8.0.0
       - name: Install docs env
         run: share/ci/scripts/linux/dnf/install_docs_env.sh
       - name: Install tests env
@@ -78,6 +78,7 @@ jobs:
       - name: Generate code coverage report
         run: share/ci/scripts/linux/run_gcov.sh
       - name: Run sonar-scanner
+        uses: SonarSource/sonarqube-scan-action@59db25f34e16620e48ab4bb9e4a5dce155cb5432 # v8.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

diff --git a/.github/workflows/wheel_workflow.yml b/.github/workflows/wheel_workflow.yml
@@ -147,6 +147,7 @@ jobs:
           CIBW_BUILD: ${{ matrix.python }}
           CIBW_ARCHS: ${{ matrix.arch }}
           CIBW_MANYLINUX_X86_64_IMAGE: ${{ matrix.manylinux }}
+          CIBW_BEFORE_BUILD: "pip install sphinx-press-theme"
 
       - uses: actions/upload-artifact@v4
         with:
@@ -209,6 +210,7 @@ jobs:
           CIBW_BUILD: ${{ matrix.python }}
           CIBW_ARCHS: ${{ matrix.arch }}
           CIBW_MANYLINUX_AARCH64_IMAGE: ${{ matrix.manylinux }}
+          CIBW_BEFORE_BUILD: "pip install sphinx-press-theme"
 
       - uses: actions/upload-artifact@v4
         with:
@@ -268,6 +270,7 @@ jobs:
         env:
           CIBW_BUILD: ${{ matrix.python }}
           CIBW_ARCHS: ${{ matrix.arch }}
+          CIBW_BEFORE_BUILD: "pip install sphinx-press-theme"
 
       - uses: actions/upload-artifact@v4
         with:
@@ -323,6 +326,7 @@ jobs:
         env:
           CIBW_BUILD: ${{ matrix.python }}
           CIBW_ARCHS: ${{ matrix.arch }}
+          CIBW_BEFORE_BUILD: "pip install sphinx-press-theme"
 
       - uses: actions/upload-artifact@v4
         with:
@@ -378,6 +382,7 @@ jobs:
         env:
           CIBW_BUILD: ${{ matrix.python }}
           CIBW_ARCHS: ${{ matrix.arch }}
+          CIBW_BEFORE_BUILD: "pip install sphinx-press-theme"
 
       - uses: actions/upload-artifact@v4
         with:

diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -29,7 +29,7 @@ endif()
 # Project definition.
 
 project(OpenColorIO 
-    VERSION 2.5.1
+    VERSION 2.5.2
     DESCRIPTION "OpenColorIO (OCIO) is a complete color management solution"
     HOMEPAGE_URL https://github.com/AcademySoftwareFoundation/OpenColorIO
     LANGUAGES CXX C)
@@ -396,9 +396,7 @@ if(NOT DEFINED OCIO_NAMESPACE)
 elseif(OCIO_NAMESPACE STREQUAL "")
     message(FATAL_ERROR "A namespace cannot be empty.")
 else()
-    set(OCIO_NAMESPACE "OpenColorIO_${OCIO_NAMESPACE}_v${OpenColorIO_VERSION_MAJOR}_${OpenColorIO_VERSION_MINOR}${OpenColorIO_VERSION_RELEASE_TYPE}" CACHE STRING 
-        "Specify the main OCIO C++ namespace: Options include OpenColorIO OpenColorIO_<YOURFACILITY> etc.")
-    message(STATUS "Setting namespace to '${OCIO_NAMESPACE}' as none was specified.")
+    message(STATUS "Setting namespace to '${OCIO_NAMESPACE}'.")
 endif()
 
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -14,20 +14,16 @@ would be naive to say our code is immune to every exploit.
 
 ## Reporting Vulnerabilities
 
-Quickly resolving security related issues is a priority. If you think
-you've found a potential vulnerability in OpenColorIO, please report it by
-emailing security@opencolorio.org. Only TSC members and ASWF project
-management have access to these messages.
+Quickly resolving security related issues is a priority. The best way to report a 
+vulnerability is to file a GitHub security advisory. If that is not possible, it 
+is also fine to email your report to security@opencolorio.org. Only the project 
+administrators have access to these reports.
 
 Include detailed steps to reproduce the issue, and any other information that
 could aid an investigation. Someone will assess the report and make every
 effort to respond within 14 days.
 
-## Outstanding Security Issues
-
-None
-
-## Addressed Security Issues
+## History of CVE Fixes
 
 None
 
@@ -64,6 +60,3 @@ set of behaviors as with file loading.
 It is a bug if calling a function with well-formed arguments causes the 
 library to crash. It is a security issue if calling a function with 
 well-formed arguments causes arbitrary code execution.
-
-We do not consider this as severe as file format issues because in most 
-deployments the parameter space is not exposed to potential attackers.
diff --git a/docs/api/grading_transforms.rst b/docs/api/grading_transforms.rst
@@ -118,6 +118,53 @@ GradingRGBCurve
       .. doxygentypedef:: ${OCIO_NAMESPACE}::ConstGradingRGBCurveRcPtr
       .. doxygentypedef:: ${OCIO_NAMESPACE}::GradingRGBCurveRcPtr
 
+GradingHueCurveTransform
+************************
+
+.. tabs::
+
+   .. group-tab:: Python
+
+      .. autoclass:: PyOpenColorIO.GradingHueCurveTransform
+         :members:
+         :undoc-members:
+         :special-members: __init__, __str__
+         :inherited-members:
+
+   .. group-tab:: C++
+
+      .. doxygenclass:: ${OCIO_NAMESPACE}::GradingHueCurveTransform
+         :members:
+         :undoc-members:
+
+      .. doxygenfunction:: ${OCIO_NAMESPACE}::operator<<(std::ostream&, const GradingHueCurveTransform&) noexcept
+
+      .. doxygentypedef:: ${OCIO_NAMESPACE}::ConstGradingHueCurveTransformRcPtr
+      .. doxygentypedef:: ${OCIO_NAMESPACE}::GradingHueCurveTransformRcPtr
+
+GradingHueCurve
+^^^^^^^^^^^^^^^
+
+.. tabs::
+
+   .. group-tab:: Python
+
+      .. autoclass:: PyOpenColorIO.GradingHueCurve
+         :members:
+         :undoc-members:
+         :special-members: __init__, __str__
+
+   .. group-tab:: C++
+
+      .. doxygenclass:: ${OCIO_NAMESPACE}::GradingHueCurve
+         :members:
+         :undoc-members:
+
+      .. doxygenfunction:: ${OCIO_NAMESPACE}::operator<<(std::ostream&, const GradingHueCurve&)
+
+      .. doxygentypedef:: ${OCIO_NAMESPACE}::ConstGradingHueCurveRcPtr
+      .. doxygentypedef:: ${OCIO_NAMESPACE}::GradingHueCurveRcPtr
+
 GradingControlPoint
 ^^^^^^^^^^^^^^^^^^^
 

diff --git a/docs/index.rst b/docs/index.rst
@@ -36,19 +36,52 @@ best leverage them.  We have an OCIO User Experience (UX) working group that is
 gradually working on more coverage.
 
 The documentation is a work-in-progress and we would love to have your help to 
-improve it!  An easy way to get involved is to join the #docs or #ux channel on 
+improve it!  An easy way to get involved is to join the #opencolorio channel on 
 :ref:`slack`.
 
 
+Roadmap
+=======
+
+The project attempts to maintain a roadmap to give the community insight into
+upcoming development. The items are grouped into "Now", "Next", and "Later" categories.
+"Now" indicates work that is currently in-progress. "Next" indicates work that is being
+planned for imminent development (meaning now would be a good time to provide your input).
+The roadmap is available `here. <https://roadmap.opencolorio.org>`_
+
+
 Community
 =========
 
+.. _meetings:
+
+Meetings
+********
+
+The OpenColorIO project has a Technical Steering Committee meeting on Zoom every two weeks
+at noon LA time. The Zoom link is available from the `OCIO Calendar. <https://calendar.opencolorio.org>`_
+
+There is a general working group and "office hours" meeting once a month in the same
+time slot. The Zoom link is available from the `OCIO Calendar. <https://calendar.opencolorio.org>`_
+
+These meetings are open to anyone!
+
+
+.. _slack:
+
+Slack
+*****
+
+Join us on the `ASWF Slack <https://academysoftwarefdn.slack.com/>`_ in the channels 
+`#opencolorio` and `#opencolor-configs`.
+
+
 .. _mailing_lists:
 
 Mailing Lists
 *************
 
-There are two mailing lists associated with OpenColorIO:
+Most of the conversation happens on Slack, but there are two mailing lists associated with OpenColorIO:
 
 `ocio-user <https://lists.aswf.io/g/ocio-user>`__\ ``@lists.aswf.io``
     For end users (artists, often) interested in OCIO profile design,
@@ -57,14 +90,40 @@ There are two mailing lists associated with OpenColorIO:
 `ocio-dev <https://lists.aswf.io/g/ocio-dev>`__\ ``@lists.aswf.io``
     For developers interested OCIO APIs, code integration, compilation, etc.
 
-.. _slack:
 
-Slack
-*****
+Related Projects
+================
+
+.. _cif:
+
+ASWF Color Interop Forum
+************************
+
+The CIF is an open, cross-project forum for discussing color interoperability across varying workflows 
+and standards. The aim isn’t necessarily to develop new standards, but rather to make recommendations 
+for how to improve color accuracy through the existing infrastructure. 
+
+Recommendations are published on the `ColorInterop GitHub. <https://github.com/AcademySoftwareFoundation/ColorInterop>`_
+
+The forum has a monthly Zoom meeting on Mondays at noon LA time, as posted on the 
+`OCIO Calendar. <https://calendar.opencolorio.org>`_
+
+Discussion happens in the `#color-interop-forum` channel on the ASWF Slack.
+
+
+.. _nano:
+
+NanoColor
+*********
+
+NanoColor is a collaboration between OpenUSD, MaterialX, and OpenColorIO to ensure that there 
+is interoperable and flexible color management among those projects and related projects in 
+the computer graphics world.
 
-There is an OpenColorIO Slack workspace at: `<https://opencolorio.slack.com>`_.  
+The working group has a Zoom meeting every two weeks on Mondays at 1:00 pm LA time, as posted on the 
+`OCIO Calendar. <https://calendar.opencolorio.org>`_
 
-New users may join the workspace from `here <http://slack.opencolorio.org/>`_.
+Discussion happens in the `#nanocolor` channel on the ASWF Slack.
 
 
 Search

diff --git a/docs/releases/ocio_2_5.rst b/docs/releases/ocio_2_5.rst
@@ -39,6 +39,15 @@ For Developers
 
 * Please see the section below about version updates to required third-party dependencies.
 
+Library Version
++++++++++++++++
+
+* The 2.5.1 release is not ABI compatible with 2.5.0 for clients that use the GPU renderer
+  API due to a change made to correct an issue with the Vulkan support introduced in 2.5.0.
+  Because the SOVERSION of both libraries remains "2.5", applications using the GPU API that
+  were compiled with the 2.5.0 release must be recompiled to use the 2.5.1 library. Any
+  further releases in the 2.5.x series will be ABI-compatible with 2.5.1.
+
 
 New Feature Guide
 =================

diff --git a/docs/requirements.txt b/docs/requirements.txt
@@ -1,7 +1,4 @@
-# Fix an issue with the OCIO's Linux container images that have OpenSSL under 1.1.1.
-# If the container images are updated with OpenSSL 1.1.1+, the restriction on
-# urllib3 version <2 can be removed.
-urllib3<2
+urllib3<3
 # The builds for documentation fails with <0.18.0
 docutils>=0.18.1
 sphinx<=7.1.2
@@ -11,4 +8,4 @@ recommonmark
 sphinx-press-theme
 sphinx-tabs
 breathe
-setuptools<68.0.0
+setuptools<83.0.0
diff --git a/docs/site/homepage/config.toml b/docs/site/homepage/config.toml
@@ -105,14 +105,6 @@ post_share = true
 enable = false
 preloader = "images/opencolorio-color.png"
 
-# google map
-[params.map]
-enable = false
-gmap_api = "https://maps.googleapis.com/maps/api/js?key=AIzaSyBu5nZKbeK-WHQ70oqOWo-_4VmwOwKP9YQ"
-map_latitude = "51.5223477"
-map_longitude = "-0.1622023"
-map_marker = "images/marker.png"
-
 
 ############################# ASWF LINKS ##########################
 [[params.aswf]]

diff --git a/ext/sampleicc/src/include/iccProfileReader.h b/ext/sampleicc/src/include/iccProfileReader.h
@@ -586,6 +586,10 @@ namespace SampleICC
             if (!Read32(istream, &sizeData, 1))
                 return false;
 
+            // ICC curve entries are indexed by 16-bit values; 65536 is the maximum.
+            if (sizeData > 65536)
+                return false;
+
             mCurve.resize(sizeData);
 
             if (sizeData)

diff --git a/include/OpenColorIO/OpenColorTransforms.h b/include/OpenColorIO/OpenColorTransforms.h
@@ -1367,10 +1367,10 @@ class OCIOEXPORT GradingHueCurveTransform : public Transform
     virtual HSYTransformStyle getRGBToHSY() const = 0;
     virtual void setRGBToHSY(HSYTransformStyle style) = 0;
 
-    ///**
-    // * Parameters can be made dynamic so the values can be changed through the CPU or GPU processor,
-    // * but if there are several GradingHueCurveTransform only one can have dynamic parameters.
-    // */
+    /**
+     * Parameters can be made dynamic so the values can be changed through the CPU or GPU processor,
+     * but if there are several GradingHueCurveTransform only one can have dynamic parameters.
+     */
     virtual bool isDynamic() const noexcept = 0;
     virtual void makeDynamic() noexcept = 0;
     virtual void makeNonDynamic() noexcept = 0;

diff --git a/pyproject.toml b/pyproject.toml
@@ -1,12 +1,12 @@
 [build-system]
 requires = [
-    "setuptools>=42",
+    "setuptools>=82.0.1",
     "wheel",
     "cmake>=3.14",
     "ninja; sys_platform != 'win32' and platform_machine != 'arm64'",
     # Documentation requirements (see docs/requirements.txt for details)
-    "urllib3<2",
-    "docutils>=0.18.1",
+    "urllib3<3",
+    "docutils>=0.22.4",
     "sphinx<=7.1.2",
     "six",
     "testresources",

diff --git a/share/cmake/modules/Findpybind11.cmake b/share/cmake/modules/Findpybind11.cmake
@@ -140,5 +140,14 @@ if(_pybind11_TARGET_CREATE)
         INTERFACE_INCLUDE_DIRECTORIES ${pybind11_INCLUDE_DIR}
     )
 
+    # /bigobj is needed for bigger binding projects due to the limit to 64k
+    # addressable sections (see pybind11Common.cmake).
+    if (MSVC)
+        set_target_properties(pybind11::module PROPERTIES
+            INTERFACE_COMPILE_OPTIONS /bigobj
+        )
+
+    endif()
+
     mark_as_advanced(pybind11_INCLUDE_DIR pybind11_VERSION)
 endif()
diff --git a/share/cmake/modules/install/InstallZLIB.cmake b/share/cmake/modules/install/InstallZLIB.cmake
@@ -53,8 +53,8 @@ if(NOT ZLIB_FOUND AND OCIO_INSTALL_EXT_PACKAGES AND NOT OCIO_INSTALL_EXT_PACKAGE
 
     set(ZLIB_INCLUDE_DIRS "${_EXT_DIST_ROOT}/${CMAKE_INSTALL_INCLUDEDIR}")
 
-    # Windows need the "d" suffix at the end.
-    if(WIN32 AND BUILD_TYPE_DEBUG)
+    # Windows need the "d" suffix at the end (only for MSVC).
+    if(MSVC AND BUILD_TYPE_DEBUG)
         set(_ZLIB_LIB_SUFFIX "d")
     endif()