OpenSlide 4.0.1 released

[Benjamin Gilbert]

OpenSlide is a C library that provides a simple way to read
whole-slide images, also known as virtual slides.  OpenSlide 4.0.1 is
a feature release that adds support for ARGOS AVS, Huron TIFF, and
some Zeiss CZI files, improves support for Aperio, DICOM, Hamamatsu,
and MIRAX files, fixes two security issues, and adds other
improvements.

OpenSlide 4.0.1 can be obtained at [0].  OpenSlide is released under
the terms of the GNU Lesser General Public License, version 2.1.

[0]: https://openslide.org/download/


## New ARGOS AVS, Huron TIFF, Zeiss CZI support

OpenSlide can now read slide files in ARGOS AVS format, Huron TIFF
format with JPEG compression, and Zeiss CZI format uncompressed or
with Zstandard [1] lossless compression.  All three formats support
associated images and vendor-specific metadata properties.

Zeiss CZI images compressed with JPEG XR are planned for a future
release.  If you have a sample file in any of these formats which does
not work well, please open an issue [2].

[1]: https://facebook.github.io/zstd/
[2]: https://github.com/openslide/openslide/issues/new/choose


## Aperio, DICOM, Hamamatsu, MIRAX improvements

OpenSlide can now read large DICOM slides with individual pyramid
levels split across multiple files (concatenations).  It now also
supports DICOM slides with lossless JPEG 2000 compression and
correctly renders slides with RGB JPEG and lossy JPEG 2000
compression.

Hamamatsu NDPI slides larger than 4 GB are now fully supported without
restriction.  Certain files with highly-downsampled pyramid levels can
now be read without error.

Label and macro associated images in newer Aperio slides are now read
correctly, and the thumbnail associated image now shares the pyramid's
ICC profile if indicated by the metadata.

This release also adds support for additional DICOM, Hamamatsu NDPI,
and MIRAX slides, and for generic TIFFs with omitted image tiles.
MIRAX BMP slides are now read via a built-in BMP decoder, eliminating
OpenSlide's dependency on GDK-PixBuf.  I/O performance has been
substantially improved for DICOM, Hamamatsu VMS, and all TIFF-based
formats.


## Format-independent barcode property

OpenSlide now provides an `openslide.barcode` property containing the
decoded barcode from slide metadata, if available.  This property is
typically a copy of an existing vendor-specific property and is
currently available for ARGOS, DICOM, Leica, Ventana TIFF, and Zeiss
CZI slides.


## Security fixes

OpenSlide 4.0.1 addresses a bug in OpenSlide 3.4.1 and 4.0.0 allowing
a crafted Ventana BIF file to write arbitrary values to
attacker-controlled relative memory offsets, resulting in a crash or
potential execution of arbitrary code (CVE-2026-48977) [3].

This release also addresses a behavior change in libtiff 4.7.1 causing
OpenSlide to return uninitialized pixel data from partial bottom tile
rows of TIFF levels that were not compressed with JPEG or JPEG 2000
(CVE pending) [4].  Typical slide files did not trigger this issue,
but a crafted slide could cause disclosure of heap memory from a
network service that used OpenSlide to render user-provided slide
files.  This issue appeared in builds 4.0.0.10 and 4.0.0.11 of the
official OpenSlide binaries but was fixed in build 4.0.0.12.

[3]: https://github.com/openslide/openslide/security/advisories/GHSA-mxg2-48g7-fmwc
[4]: https://github.com/openslide/openslide/security/advisories/GHSA-f734-jv98-5677


## Getting OpenSlide

OpenSlide build 4.0.1.1 provides a single shared library containing
OpenSlide and all of its dependencies, and is available for Linux,
macOS, and Windows.  Users of OpenSlide Python can install OpenSlide
binaries directly from PyPI with `pip install openslide-bin`.

OpenSlide also provides a Fedora Copr and an Ubuntu PPA, enabling
users of Fedora, Ubuntu, and RHEL-compatible enterprise Linux to
easily install the latest OpenSlide and OpenSlide Python releases
before they reach the official repositories.  See the download page
[0] for instructions on enabling these repos.

OpenSlide's source code is available from the official website [0] or
on GitHub [5].  Starting with this release, OpenSlide can be built on
Windows without cross-compilation, using GCC or clang-cl.

[5]: https://github.com/openslide/openslide


## How to help

If you have a slide scanner that can produce files we don't have [6],
or ones OpenSlide can't read, please consider contributing a sample
[7].  If you grant us permission to redistribute your sample under the
Creative Commons Zero license [8], we can use it in automated tests
and share it with other developers working on open source WSI support.

[6]: https://github.com/openslide/openslide/wiki/DesiredTestData
[7]: https://openslide.org/submit/
[8]: https://creativecommons.org/public-domain/cc0/


## Acknowledgements

Thanks to everyone who reported issues in OpenSlide and who provided
sample slide files.  Special thanks to John Cupitt for implementing
DICOM concatenations, Nick Trahearn for implementing large NDPI
support, Wei Chen for implementing Zeiss CZI, Erik Lening for
reporting CVE-2026-48977, and Adam Červenka for reporting
GHSA-f734-jv98-5677.


## Full changelog

### Security

* Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977)
* Fix return of uninitialized pixels with libtiff 4.7.1 (GHSA-f734-jv98-5677)

### Format support

* New formats: ARGOS AVS, Huron TIFF
* New format: Zeiss CZI, uncompressed or zstd-compressed (thanks, Wei Chen)
* aperio: Support label and macro images on newer slides
* aperio: Add main image ICC profile to thumbnail if indicated by metadata
* dicom: Support levels split into multiple files (thanks, John Cupitt)
* dicom: Support reversible JPEG 2000 compression
* dicom: Fix colors with RGB JPEG (thanks, John) and irreversible JPEG 2000
* dicom: Support files with Image Type ORIGINAL\PRIMARY\VOLUME\RESAMPLED
* dicom: Fix swapped X and Y MPP
* generic-tiff: Support TIFFs with missing tiles
* hamamatsu: Fully support NDPI larger than 4 GB (thanks, Nick Trahearn)
* hamamatsu: Fix errors reading highly downsampled NDPI levels
* hamamatsu: Support NDPI files without RowsPerStrip
* hamamatsu: Correctly read NDPI ASCII strings shorter than 4 characters
* mirax: Support missing or variant OBJECTIVE_MAGNIFICATION
* mirax: Ignore empty Slidedat.ini key names

### New features

* Add openslide.barcode property
* Support building directly on Windows with GCC or clang-cl
* Add `slidetool test deps` command to run self-tests

### Changes

* Require Zstandard
* Require Meson ≥ 0.55; libdicom ≥ 1.3; libjpeg-turbo ≥ 1.3 or libjpeg ≥ 9c
* Replace GDK-PixBuf dependency with built-in BMP parser
* Improve I/O performance with DICOM, Hamamatsu, TIFF
* Prevent libtiff ≥ 4.5.0 from logging to stderr

### Bug fixes

* Fix filename character set of command-line tool output files on Windows