Patch for Python 3.15 (fix RHBZ#2433881)

- Fixes CVE-2026-34378 / GHSA-v76p-4qvv-vh4g; closes RHBZ#2455493
- Fixes CVE-2026-34380 / GHSA-q3v8-hw4m-59w5; closes RHBZ#2455534
- Fixes CVE-2026-34588 / GHSA-588r-cr5c-w6hf; closes RHBZ#2455505
- Fixes CVE-2026-34589 / GHSA-p8xc-w3q4-h64x; closes RHBZ#2455501
- Fixes CVE-2026-34379 / GHSA-w88v-vqhq-5p24; closes RHBZ#2455497

.gitignore

@@ -17,3 +17,10 @@
 /OpenUSD-24.11.tar.gz
 /OpenUSD-25.02.tar.gz
 /OpenUSD-25.02a.tar.gz
+/OpenUSD-25.05.tar.gz
+/OpenUSD-25.05.01.tar.gz
+/OpenUSD-25.08.tar.gz
+/OpenUSD-25.11.tar.gz
+/OpenUSD-26.03.tar.gz
+/OpenUSD-26.05.tar.gz
+/OpenUSD-26.08.tar.gz

0001-Downstream-only-add-an-SONAME-version.patch

@@ -1,4 +1,4 @@
-From 0beb6ef89859d29599c159cb52e2b85419adb413 Mon Sep 17 00:00:00 2001
+From ee4e9b30e14133e35c23821d3dc7aa93df354a38 Mon Sep 17 00:00:00 2001
 From: "Benjamin A. Beasley" <code@musicinmybrain.net>
 Date: Fri, 27 Oct 2023 12:56:58 -0400
 Subject: [PATCH] Downstream-only: add an SONAME version
@@ -33,15 +33,15 @@ built with -DPXR_BUILD_EXAMPLES=OFF, but it is.)
 ---
  cmake/defaults/Version.cmake | 6 ++++++
  cmake/macros/Private.cmake   | 1 +
- cmake/macros/Public.cmake    | 1 +
- 3 files changed, 8 insertions(+)
+ cmake/macros/Public.cmake    | 2 ++
+ 3 files changed, 9 insertions(+)
 
 diff --git a/cmake/defaults/Version.cmake b/cmake/defaults/Version.cmake
-index 6dd5d5f2d..0a20d47c5 100644
+index c31b5e8d9..fabb45397 100644
 --- a/cmake/defaults/Version.cmake
 +++ b/cmake/defaults/Version.cmake
-@@ -10,3 +10,9 @@ set(PXR_MINOR_VERSION "25")
- set(PXR_PATCH_VERSION "2") # NOTE: Must not have leading 0 for single digits
+@@ -10,3 +10,9 @@ set(PXR_MINOR_VERSION "26")
+ set(PXR_PATCH_VERSION "8") # NOTE: Must not have leading 0 for single digits
  
  math(EXPR PXR_VERSION "${PXR_MAJOR_VERSION} * 10000 + ${PXR_MINOR_VERSION} * 100 + ${PXR_PATCH_VERSION}")
 +
@@ -51,29 +51,37 @@ index 6dd5d5f2d..0a20d47c5 100644
 +    "Downstream shared object version"
 +)
 diff --git a/cmake/macros/Private.cmake b/cmake/macros/Private.cmake
-index 6fe1134c1..692924954 100644
+index cddb4e095..5e4b4603a 100644
 --- a/cmake/macros/Private.cmake
 +++ b/cmake/macros/Private.cmake
-@@ -1372,6 +1372,7 @@ function(_pxr_library NAME)
+@@ -1355,6 +1355,7 @@ function(_pxr_library NAME)
+             FOLDER "${folder}"
+             POSITION_INDEPENDENT_CODE ON
              IMPORT_PREFIX "${args_PREFIX}"            
++            SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
              PREFIX "${args_PREFIX}"
              SUFFIX "${args_SUFFIX}"
-+	    SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
      )
- 
-     target_compile_definitions(${NAME}
 diff --git a/cmake/macros/Public.cmake b/cmake/macros/Public.cmake
-index 2647707ac..1917edf87 100644
+index 5f6a5456b..553b645ec 100644
 --- a/cmake/macros/Public.cmake
 +++ b/cmake/macros/Public.cmake
-@@ -1115,6 +1115,7 @@ function(pxr_toplevel_prologue)
-                     FOLDER "${folder}"
+@@ -415,6 +415,7 @@ function(pxr_library NAME)
+         TYPE "${args_TYPE}"
+         PREFIX "${prefix}"
+         SUFFIX "${suffix}"
++        SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
+         SUBDIR "${subdir}"
+         CPPFILES "${args_CPPFILES};${${NAME}_CPPFILES}"
+         PUBLIC_HEADERS "${args_PUBLIC_HEADERS};${${NAME}_PUBLIC_HEADERS}"
+@@ -1213,6 +1214,7 @@ function(pxr_toplevel_prologue)
                      PREFIX "${libPrefix}"
                      IMPORT_PREFIX "${libPrefix}"
-+		    SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
+                     OUTPUT_NAME ${libName}
++                    SOVERSION ${PXR_DOWNSTREAM_SOVERSION}
              )
              _get_install_dir("lib" libInstallPrefix)
              install(
 -- 
-2.48.1
+2.55.0
 

0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch

@@ -0,0 +1,65 @@
+From 817e23674f1b4ba62481c4e9794f0665a44d83f8 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Fri, 1 Aug 2025 08:47:41 -0400
+Subject: [PATCH] Downstream-only: use Valgrind macro instead of inline
+ assembly
+
+Upstream already has a plan to make this change, but is waiting to be
+able to add a build dependency on valgrind-devel. We have no such
+obstacle, and this change fixes the inline assembly failing to compile
+on aarch64.
+---
+ pxr/exec/vdf/executorDataVector.cpp | 28 +++-------------------------
+ 1 file changed, 3 insertions(+), 25 deletions(-)
+
+diff --git a/pxr/exec/vdf/executorDataVector.cpp b/pxr/exec/vdf/executorDataVector.cpp
+index 96dacca06..7e5625678 100644
+--- a/pxr/exec/vdf/executorDataVector.cpp
++++ b/pxr/exec/vdf/executorDataVector.cpp
+@@ -11,40 +11,18 @@
+ #include "pxr/base/tf/stl.h"
+ #include "pxr/base/trace/trace.h"
+ 
++#include <valgrind/memcheck.h>
++
+ PXR_NAMESPACE_OPEN_SCOPE
+ 
+ 
+ /// Issue a magic instruction sequence which Valgrind will intercept and mark
+ /// the specified memory defined for memcheck.
+ ///
+-/// XXX: We should replace this with the VALGRIND_MAKE_MEM_DEFINED macro
+-///      from memcheck.h, once we can establish a build dependency on
+-///      valgrind-devel.
+-///
+ static inline void
+ Vdf_ExecutorDataVector_ValgrindMakeDefined(void *ptr, size_t size)
+ {
+-#if defined(ARCH_OS_LINUX) && defined(ARCH_CPU_INTEL)
+-    // Pass a result and a pointer to some arguments via registers
+-    volatile unsigned long long int result;
+-    volatile unsigned long long int args[6] = {
+-        0x4D430002,                  // Memcheck: MAKE_MEM_DEFINED
+-        (uintptr_t)(ptr),            // Memory address
+-        size,                        // Size in bytes
+-        0, 0, 0                      // Remaining unused arguments
+-    };
+-
+-    // Magical instruction sequence which Valgrind will interpret as an
+-    // annotation (see valgrind.h)
+-    __asm__ volatile(
+-        "rolq $3,  %%rdi ; rolq $13, %%rdi\n\t"
+-        "rolq $61, %%rdi ; rolq $51, %%rdi\n\t"
+-        "xchgq %%rbx, %%rbx"
+-        : "=d" (result)
+-        : "a" (&args[0]), "0" (0)
+-        : "cc", "memory"
+-    );
+-#endif
++    VALGRIND_MAKE_MEM_DEFINED(ptr, size);
+ }
+ 
+ Vdf_ExecutorDataVector::~Vdf_ExecutorDataVector()
+-- 
+2.55.0
+

0001-Downstream-only-use-the-system-double-conversion-lib.patch

@@ -1,4 +1,4 @@
-From 892fffda8fe1e388cb1511889636e80a864bed43 Mon Sep 17 00:00:00 2001
+From 2d851f23e912d8312f2ea6818963150a8c484138 Mon Sep 17 00:00:00 2001
 From: "Benjamin A. Beasley" <code@musicinmybrain.net>
 Date: Wed, 28 Aug 2024 10:42:48 -0400
 Subject: [PATCH 1/6] Downstream-only: use the system double-conversion library
@@ -8,10 +8,10 @@ Subject: [PATCH 1/6] Downstream-only: use the system double-conversion library
  1 file changed, 3 insertions(+), 8 deletions(-)
 
 diff --git a/pxr/base/tf/CMakeLists.txt b/pxr/base/tf/CMakeLists.txt
-index 438e9af37..749af9a2b 100644
+index 4294f2cb5..b45df65b8 100644
 --- a/pxr/base/tf/CMakeLists.txt
 +++ b/pxr/base/tf/CMakeLists.txt
-@@ -110,11 +110,14 @@ function(add_py_dll_link_test)
+@@ -105,11 +105,14 @@ function(add_py_dll_link_test)
  
  endfunction()
  
@@ -21,12 +21,12 @@ index 438e9af37..749af9a2b 100644
      LIBRARIES
          arch
          ${WINLIBS}
-         ${TBB_tbb_LIBRARY}
+         TBB::tbb
 +	${double-conversion_LIBRARY}
  
-     INCLUDE_DIRS
-         ${TBB_INCLUDE_DIRS}
-@@ -281,14 +284,6 @@ pxr_library(tf
+     PUBLIC_CLASSES
+         anyUniquePtr
+@@ -276,14 +279,6 @@ pxr_library(tf
  
      CPPFILES
          initConfig.cpp
@@ -42,5 +42,5 @@ index 438e9af37..749af9a2b 100644
  
      PYMODULE_CPPFILES
 -- 
-2.48.1
+2.55.0
 

0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch

@@ -0,0 +1,110 @@
+From f3e9600db6086e834c0503cdaf30b5ba7ed53ceb Mon Sep 17 00:00:00 2001
+From: Anonymous Coward <nobody@redhat.com>
+Date: Sun, 26 Jul 2026 16:13:18 +0200
+Subject: [PATCH] Replace PyWeakref_GetObject with PyWeakref_GetRef
+
+PyWeakref_GetObject was removed in Python 3.15. Replace all four call
+sites with PyWeakref_GetRef, which returns a strong reference instead
+of a borrowed one, and adjust reference counting accordingly.
+
+In Tf_PyIdHandle::Ptr(), return Py_None when the referent is dead to
+match the original behaviour (previously returned NULL erroneously).
+
+In Tf_PyWeakObject::GetObject(), explicitly return a Python None object
+on failure, matching the original semantics exactly.
+
+Fixes: https://github.com/PixarAnimationStudios/OpenUSD/issues/3966
+
+Assisted-by: Claude Opus 4.6
+Reviewed-by: OpenUSD Maintainers <usd-maintainers@fedoraproject.org>
+---
+ pxr/base/tf/pyFunction.h     | 13 +++++++++----
+ pxr/base/tf/pyIdentity.cpp   | 10 +++++++++-
+ pxr/base/tf/pyWeakObject.cpp | 12 +++++++++---
+ 3 files changed, 27 insertions(+), 8 deletions(-)
+
+diff --git a/pxr/base/tf/pyFunction.h b/pxr/base/tf/pyFunction.h
+index 85af943b2..f77b5b71b 100644
+--- a/pxr/base/tf/pyFunction.h
++++ b/pxr/base/tf/pyFunction.h
+@@ -49,11 +49,13 @@ struct TfPyFunctionFromPython<Ret (Args...)>
+             using namespace pxr_boost::python;
+             // Attempt to get the referenced callable object.
+             TfPyLock lock;
+-            object callable(handle<>(borrowed(PyWeakref_GetObject(weak.ptr()))));
+-            if (TfPyIsNone(callable)) {
++            PyObject *rawCallable = NULL;
++            if (PyWeakref_GetRef(weak.ptr(), &rawCallable) <= 0) {
+                 TF_WARN("Tried to call an expired python callback");
+                 return Ret();
+             }
++            // PyWeakref_GetRef returns a strong reference; handle<> steals it.
++            object callable{handle<>(rawCallable)};
+             return TfPyCall<Ret>(callable)(args...);
+         }
+     };
+@@ -68,12 +70,15 @@ struct TfPyFunctionFromPython<Ret (Args...)>
+             // Attempt to get the referenced self parameter, then build a new
+             // instance method and call it.
+             TfPyLock lock;
+-            PyObject *self = PyWeakref_GetObject(weakSelf.ptr());
+-            if (self == Py_None) {
++            PyObject *self = NULL;
++            if (PyWeakref_GetRef(weakSelf.ptr(), &self) <= 0) {
+                 TF_WARN("Tried to call a method on an expired python instance");
+                 return Ret();
+             }
++            // PyWeakref_GetRef returns a strong reference to self; PyMethod_New
++            // takes its own reference, so release ours afterward.
+             object method(handle<>(PyMethod_New(func.ptr(), self)));
++            Py_DECREF(self);
+             return TfPyCall<Ret>(method)(args...);
+         }
+     };
+diff --git a/pxr/base/tf/pyIdentity.cpp b/pxr/base/tf/pyIdentity.cpp
+index 5389d8f25..06b7f9b0c 100644
+--- a/pxr/base/tf/pyIdentity.cpp
++++ b/pxr/base/tf/pyIdentity.cpp
+@@ -136,7 +136,15 @@ PyObject *
+ Tf_PyIdHandle::Ptr() const {
+     if (_weakRef) {
+         TfPyLock lock;
+-        return PyWeakref_GetObject(_weakRef);
++        PyObject *obj = NULL;
++        if (PyWeakref_GetRef(_weakRef, &obj) > 0) {
++            // Return a borrowed-style reference: decrement so the caller
++            // does not need to release. Safe because the GIL is held by
++            // all callers.
++            Py_DECREF(obj);
++            return obj;
++        }
++        return Py_None;   // dead referent → match original behaviour
+     }
+     return 0;
+ }
+diff --git a/pxr/base/tf/pyWeakObject.cpp b/pxr/base/tf/pyWeakObject.cpp
+index 8cfddc729..ecdd7f705 100644
+--- a/pxr/base/tf/pyWeakObject.cpp
++++ b/pxr/base/tf/pyWeakObject.cpp
+@@ -115,9 +115,15 @@ Tf_PyWeakObject::GetOrCreate(pxr_boost::python::object const &obj)
+ pxr_boost::python::object
+ Tf_PyWeakObject::GetObject() const
+ {
+-    return pxr_boost::python::object
+-        (pxr_boost::python::handle<>
+-         (pxr_boost::python::borrowed(PyWeakref_GetObject(_weakRef.get()))));
++    PyObject *obj = NULL;
++    if (PyWeakref_GetRef(_weakRef.get(), &obj) > 0) {
++        // PyWeakref_GetRef returns a strong reference; handle<> steals it.
++        return pxr_boost::python::object(
++            pxr_boost::python::handle<>(obj));
++    }
++    // Dead referent: return Py_None explicitly, as the original did.
++    return pxr_boost::python::object(
++        pxr_boost::python::handle<>(pxr_boost::python::borrowed(Py_None)));
+ }
+ 
+ void
+-- 
+2.55.0
+

0002-Downstream-only-use-the-system-lz4-library.patch

@@ -1,17 +1,17 @@
-From 07716964aaf5aab8345e1801a18bcab8a493e5e5 Mon Sep 17 00:00:00 2001
+From 9fd6089b3e95bb882199ee359fbba83f7c4bb410 Mon Sep 17 00:00:00 2001
 From: "Benjamin A. Beasley" <code@musicinmybrain.net>
 Date: Thu, 29 Aug 2024 13:30:18 -0400
 Subject: [PATCH 2/6] Downstream-only: use the system lz4 library
 
 ---
- pxr/base/tf/CMakeLists.txt | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
+ pxr/base/tf/CMakeLists.txt | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
 
 diff --git a/pxr/base/tf/CMakeLists.txt b/pxr/base/tf/CMakeLists.txt
-index 749af9a2b..56ca1fd83 100644
+index b45df65b8..5e6de96da 100644
 --- a/pxr/base/tf/CMakeLists.txt
 +++ b/pxr/base/tf/CMakeLists.txt
-@@ -111,6 +111,8 @@ function(add_py_dll_link_test)
+@@ -106,6 +106,8 @@ function(add_py_dll_link_test)
  endfunction()
  
  find_library(double-conversion_LIBRARY NAMES double-conversion REQUIRED)
@@ -20,19 +20,18 @@ index 749af9a2b..56ca1fd83 100644
  
  pxr_library(tf
      LIBRARIES
-@@ -118,9 +120,11 @@ pxr_library(tf
+@@ -113,6 +115,10 @@ pxr_library(tf
          ${WINLIBS}
-         ${TBB_tbb_LIBRARY}
+         TBB::tbb
  	${double-conversion_LIBRARY}
 +	${LZ4_LIBRARIES}
- 
-     INCLUDE_DIRS
-         ${TBB_INCLUDE_DIRS}
++
++    INCLUDE_DIRS
 +        ${LZ4_INCLUDE_DIRS}
  
      PUBLIC_CLASSES
          anyUniquePtr
-@@ -284,7 +288,6 @@ pxr_library(tf
+@@ -279,7 +285,6 @@ pxr_library(tf
  
      CPPFILES
          initConfig.cpp
@@ -41,5 +40,5 @@ index 749af9a2b..56ca1fd83 100644
      PYMODULE_CPPFILES
          module.cpp
 -- 
-2.48.1
+2.55.0
 

0003-Downstream-only-use-the-system-pugixml-library.patch

@@ -1,16 +1,16 @@
-From 6723d17b04358284e46b717da6dd3d9a25fd094d Mon Sep 17 00:00:00 2001
+From 73637a9bf67b3f7afe5070e5d56b07524e14a073 Mon Sep 17 00:00:00 2001
 From: "Benjamin A. Beasley" <code@musicinmybrain.net>
 Date: Fri, 30 Aug 2024 09:32:08 -0400
 Subject: [PATCH 3/6] Downstream-only: use the system pugixml library
 
 ---
- .../renderman-26/plugin/rmanArgsParser/CMakeLists.txt       | 6 +++---
+ third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
 
-diff --git a/third_party/renderman-26/plugin/rmanArgsParser/CMakeLists.txt b/third_party/renderman-26/plugin/rmanArgsParser/CMakeLists.txt
-index ad5c1f49e..79b82e3f0 100644
---- a/third_party/renderman-26/plugin/rmanArgsParser/CMakeLists.txt
-+++ b/third_party/renderman-26/plugin/rmanArgsParser/CMakeLists.txt
+diff --git a/third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt b/third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt
+index 244f27aa8..1e00413c4 100644
+--- a/third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt
++++ b/third_party/renderman/plugin/rmanArgsParser/CMakeLists.txt
 @@ -1,6 +1,8 @@
  set(PXR_PREFIX "")
  set(PXR_PACKAGE rmanArgsParser)
@@ -20,9 +20,9 @@ index ad5c1f49e..79b82e3f0 100644
  pxr_plugin(rmanArgsParser
      LIBRARIES
          arch
-@@ -10,12 +12,10 @@ pxr_plugin(rmanArgsParser
+@@ -9,12 +11,10 @@ pxr_plugin(rmanArgsParser
+         vt
          ar
-         ndr
          sdr
 +	${pugixml_LIBRARY}
  
@@ -35,5 +35,5 @@ index ad5c1f49e..79b82e3f0 100644
      PRIVATE_HEADERS
          api.h
 -- 
-2.48.1
+2.55.0
 

0004-Downstream-only-use-the-system-rapidjson-library.patch

@@ -1,22 +1,23 @@
-From 69a381db3ad7e0a457fb547eab46d6fdd6532f32 Mon Sep 17 00:00:00 2001
+From f331a476a66e41e93d83b7a2e438d3ee7f12ea32 Mon Sep 17 00:00:00 2001
 From: "Benjamin A. Beasley" <code@musicinmybrain.net>
 Date: Sat, 31 Aug 2024 11:08:18 -0400
 Subject: [PATCH 4/6] Downstream-only: use the system rapidjson library
 
 ---
- pxr/base/js/CMakeLists.txt | 37 -------------------------------------
- 1 file changed, 37 deletions(-)
+ pxr/base/js/CMakeLists.txt | 40 --------------------------------------
+ 1 file changed, 40 deletions(-)
 
 diff --git a/pxr/base/js/CMakeLists.txt b/pxr/base/js/CMakeLists.txt
-index d59dc1f6d..086d1bc48 100644
+index 8cbda8c52..ec8f3c249 100644
 --- a/pxr/base/js/CMakeLists.txt
 +++ b/pxr/base/js/CMakeLists.txt
-@@ -15,43 +15,6 @@ pxr_library(js
+@@ -15,46 +15,6 @@ pxr_library(js
          converter.h
          types.h
  
 -    PRIVATE_HEADERS
 -        rapidjson/allocators.h
+-        rapidjson/cursorstreamwrapper.h
 -        rapidjson/document.h
 -        rapidjson/encodedstream.h
 -        rapidjson/encodings.h
@@ -26,6 +27,7 @@ index d59dc1f6d..086d1bc48 100644
 -        rapidjson/filewritestream.h
 -        rapidjson/fwd.h
 -        rapidjson/internal/biginteger.h
+-        rapidjson/internal/clzll.h
 -        rapidjson/internal/diyfp.h
 -        rapidjson/internal/dtoa.h
 -        rapidjson/internal/ieee754.h
@@ -50,11 +52,12 @@ index d59dc1f6d..086d1bc48 100644
 -        rapidjson/schema.h
 -        rapidjson/stream.h
 -        rapidjson/stringbuffer.h
+-        rapidjson/uri.h
 -        rapidjson/writer.h
 -
      DOXYGEN_FILES
          overview.dox
  )
 -- 
-2.48.1
+2.55.0
 

0005-Downstream-only-use-the-system-libdeflate.patch

@@ -1,16 +1,16 @@
-From 190572d6e81729f7e04ddf50891c7af368ea4995 Mon Sep 17 00:00:00 2001
+From a537b44edabe942380d2e87ea7069bdf32b93dbc Mon Sep 17 00:00:00 2001
 From: "Benjamin A. Beasley" <code@musicinmybrain.net>
 Date: Sun, 1 Sep 2024 21:30:11 -0400
 Subject: [PATCH 5/6] Downstream-only: use the system libdeflate
 
 ---
- pxr/imaging/hio/CMakeLists.txt                    |  7 +++++++
- pxr/imaging/hio/OpenEXR/OpenEXRCore/compression.c |  3 +--
- pxr/imaging/hio/OpenEXR/OpenEXRCoreUnity.h        | 12 ------------
+ pxr/imaging/hio/CMakeLists.txt                       |  7 +++++++
+ .../hioOpenEXR/OpenEXR/OpenEXRCore/compression.c     |  3 +--
+ .../plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h     | 12 ------------
  3 files changed, 8 insertions(+), 14 deletions(-)
 
 diff --git a/pxr/imaging/hio/CMakeLists.txt b/pxr/imaging/hio/CMakeLists.txt
-index 75e1e6298..09264c600 100644
+index e61fc7c54..7cfbe9d70 100644
 --- a/pxr/imaging/hio/CMakeLists.txt
 +++ b/pxr/imaging/hio/CMakeLists.txt
 @@ -1,6 +1,9 @@
@@ -34,10 +34,10 @@ index 75e1e6298..09264c600 100644
  
      PUBLIC_CLASSES
          fieldTextureData
-diff --git a/pxr/imaging/hio/OpenEXR/OpenEXRCore/compression.c b/pxr/imaging/hio/OpenEXR/OpenEXRCore/compression.c
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/compression.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/compression.c
 index a672e833b..1d2eaea56 100644
---- a/pxr/imaging/hio/OpenEXR/OpenEXRCore/compression.c
-+++ b/pxr/imaging/hio/OpenEXR/OpenEXRCore/compression.c
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/compression.c
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/compression.c
 @@ -8,8 +8,7 @@
  #include "internal_memory.h"
  #include "internal_structs.h"
@@ -48,10 +48,10 @@ index a672e833b..1d2eaea56 100644
  
  #if (                                                                          \
      LIBDEFLATE_VERSION_MAJOR > 1 ||                                            \
-diff --git a/pxr/imaging/hio/OpenEXR/OpenEXRCoreUnity.h b/pxr/imaging/hio/OpenEXR/OpenEXRCoreUnity.h
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h
 index 7481a346e..71bdde9cc 100644
---- a/pxr/imaging/hio/OpenEXR/OpenEXRCoreUnity.h
-+++ b/pxr/imaging/hio/OpenEXR/OpenEXRCoreUnity.h
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCoreUnity.h
 @@ -8,18 +8,6 @@
  
  #include "OpenEXRCore/openexr_config.h"
@@ -72,5 +72,5 @@ index 7481a346e..71bdde9cc 100644
  
  #include "OpenEXRCore/attributes.c"
 -- 
-2.48.1
+2.55.0
 

0006-Downstream-only-use-the-system-libavif.patch

@@ -1,28 +1,28 @@
-From 8173625c157a1cb59c0f5cf8039afde9cce84641 Mon Sep 17 00:00:00 2001
+From f2a3615238a691e11a4029c33498e7f21a34fff9 Mon Sep 17 00:00:00 2001
 From: "Benjamin A. Beasley" <code@musicinmybrain.net>
 Date: Wed, 4 Sep 2024 11:09:47 -0400
 Subject: [PATCH 6/6] Downstream-only: use the system libavif
 
 ---
  pxr/imaging/plugin/hioAvif/AVIFImage.cpp  |   2 +-
- pxr/imaging/plugin/hioAvif/CMakeLists.txt | 195 +---------------------
- 2 files changed, 8 insertions(+), 189 deletions(-)
+ pxr/imaging/plugin/hioAvif/CMakeLists.txt | 194 +---------------------
+ 2 files changed, 7 insertions(+), 189 deletions(-)
 
 diff --git a/pxr/imaging/plugin/hioAvif/AVIFImage.cpp b/pxr/imaging/plugin/hioAvif/AVIFImage.cpp
-index b902a9806..e83af2acc 100644
+index b56369ee5..c6fcb4a6c 100644
 --- a/pxr/imaging/plugin/hioAvif/AVIFImage.cpp
 +++ b/pxr/imaging/plugin/hioAvif/AVIFImage.cpp
-@@ -29,7 +29,7 @@ ARCH_PRAGMA_UNUSED_FUNCTION
+@@ -30,7 +30,7 @@ ARCH_PRAGMA_UNUSED_FUNCTION
  #include "pxr/base/tf/stringUtils.h"
  #include "pxr/base/tf/type.h"
  
 -#include "pxr/imaging/plugin/hioAvif/AVIF/src/avif/avif.h"
 +#include <avif/avif.h>
  
+ PXR_NAMESPACE_OPEN_SCOPE
  
- #include "pxr/base/arch/export.h"
 diff --git a/pxr/imaging/plugin/hioAvif/CMakeLists.txt b/pxr/imaging/plugin/hioAvif/CMakeLists.txt
-index 29ffe0fdf..7f1680eaf 100644
+index 1ac2683f6..7d583c137 100644
 --- a/pxr/imaging/plugin/hioAvif/CMakeLists.txt
 +++ b/pxr/imaging/plugin/hioAvif/CMakeLists.txt
 @@ -1,6 +1,9 @@
@@ -35,14 +35,11 @@ index 29ffe0fdf..7f1680eaf 100644
  pxr_plugin(hioAvif
      LIBRARIES
          ar
-@@ -8,196 +11,12 @@ pxr_plugin(hioAvif
+@@ -8,197 +11,12 @@ pxr_plugin(hioAvif
          gf
          hio
          tf
 +	${AVIF_LIBRARIES}
-+
-+    INCLUDE_DIRS
-+	${AVIF_INCLUDE_DIRS}
  
 -    PRIVATE_HEADERS
 -        aom/aom.h
@@ -53,89 +50,89 @@ index 29ffe0fdf..7f1680eaf 100644
 -        aom/aom_image.h
 -        aom/aom_integer.h
 -        aom/aomdx.h
--        aom/aom_dsp/binary_codes_reader.h
--        aom/aom_dsp/bitreader.h
--        aom/aom_dsp/aom_dsp_common.h
--        aom/aom_dsp/bitreader_buffer.h
--        aom/aom_dsp/blend.h
--        aom/aom_dsp/entcode.h
--        aom/aom_dsp/entdec.h
--        aom/aom_dsp/grain_table.h
--        aom/aom_dsp/aom_filter.h
--        aom/aom_dsp/grain_synthesis.h
--        aom/aom_dsp/intrapred_common.h
--        aom/aom_dsp/prob.h
--        aom/aom_dsp/recenter.h
--        aom/aom_dsp/txfm_common.h
--        aom/aom_mem/aom_mem.h
--        aom/aom_mem/include/aom_mem_intrnl.h
--        aom/aom_ports/bitops.h
--        aom/aom_ports/aom_once.h
--        aom/aom_ports/mem.h
--        aom/aom_ports/mem_ops.h
--        aom/aom_ports/mem_ops_aligned.h
--        aom/aom_ports/msvc.h
--        aom/aom_ports/system_state.h
--        aom/aom_ports/aom_timer.h
--        aom/aom_scale/aom_scale.h
--        aom/aom_scale/yv12config.h
--        aom/aom_util/aom_thread.h
--        aom/av1/av1_iface_common.h
--        aom/av1/common/av1_common_int.h
--        aom/av1/common/alloccommon.h
--        aom/av1/common/av1_inv_txfm1d.h
--        aom/av1/common/av1_inv_txfm1d_cfg.h
--        aom/av1/common/av1_loopfilter.h
--        aom/av1/common/av1_txfm.h
--        aom/av1/common/blockd.h
--        aom/av1/common/cdef.h
--        aom/av1/common/cdef_block.h
--        aom/av1/common/cfl.h
--        aom/av1/common/common.h
--        aom/av1/common/common_data.h
--        aom/av1/common/convolve.h
--        aom/av1/common/entropy.h
--        aom/av1/common/entropymode.h
--        aom/av1/common/entropymv.h
--        aom/av1/common/enums.h
--        aom/av1/common/filter.h
--        aom/av1/common/frame_buffers.h
--        aom/av1/common/mv.h
--        aom/av1/common/mvref_common.h
--        aom/av1/common/idct.h
--        aom/av1/common/obmc.h
--        aom/av1/common/obu_util.h
--        aom/av1/common/odintrin.h
--        aom/av1/common/pred_common.h
--        aom/av1/common/quant_common.h
--        aom/av1/common/reconinter.h
--        aom/av1/common/reconintra.h
--        aom/av1/common/resize.h
--        aom/av1/common/restoration.h
--        aom/av1/common/scale.h
--        aom/av1/common/scan.h
--        aom/av1/common/seg_common.h
--        aom/av1/common/thread_common.h
--        aom/av1/common/tile_common.h
--        aom/av1/common/timing.h
--        aom/av1/common/token_cdfs.h
--        aom/av1/common/txb_common.h
--        aom/av1/common/warped_motion.h
--        aom/av1/decoder/decodeframe.h
--        aom/av1/decoder/decoder.h
--        aom/av1/decoder/decodemv.h
--        aom/av1/decoder/decodetxb.h
--        aom/av1/decoder/detokenize.h
--        aom/av1/decoder/dthread.h
--        aom/av1/decoder/obu.h
--        aom/config/aom_config.h
--        aom/config/aom_dsp_rtcd.h
--        aom/config/aom_scale_rtcd.h
--        aom/config/aom_version.h
--        aom/config/av1_rtcd.h
+-        aom/aom_external_partition.h
 -        aom/internal/aom_codec_internal.h
 -        aom/internal/aom_image_internal.h
--        aom/internal/common/args_helper.h
+-        aom_dsp/aom_dsp_common.h
+-        aom_dsp/aom_filter.h
+-        aom_dsp/binary_codes_reader.h
+-        aom_dsp/bitreader.h
+-        aom_dsp/bitreader_buffer.h
+-        aom_dsp/blend.h
+-        aom_dsp/entcode.h
+-        aom_dsp/entdec.h
+-        aom_dsp/flow_estimation/corner_detect.h
+-        aom_dsp/flow_estimation/flow_estimation.h
+-        aom_dsp/grain_params.h
+-        aom_dsp/grain_table.h
+-        aom_dsp/intrapred_common.h
+-        aom_dsp/odintrin.h
+-        aom_dsp/prob.h
+-        aom_dsp/pyramid.h
+-        aom_dsp/recenter.h
+-        aom_dsp/txfm_common.h
+-        aom_mem/aom_mem.h
+-        aom_mem/include/aom_mem_intrnl.h
+-        aom_ports/aom_once.h
+-        aom_ports/aom_timer.h
+-        aom_ports/bitops.h
+-        aom_ports/mem.h
+-        aom_ports/mem_ops.h
+-        aom_ports/mem_ops_aligned.h
+-        aom_ports/sanitizer.h
+-        aom_scale/yv12config.h
+-        aom_util/aom_thread.h
+-        aom_util/aom_pthread.h
+-        av1/av1_iface_common.h
+-        av1/common/alloccommon.h
+-        av1/common/av1_common_int.h
+-        av1/common/av1_inv_txfm1d.h
+-        av1/common/av1_inv_txfm1d_cfg.h
+-        av1/common/av1_loopfilter.h
+-        av1/common/av1_txfm.h
+-        av1/common/blockd.h
+-        av1/common/cdef.h
+-        av1/common/cdef_block.h
+-        av1/common/cfl.h
+-        av1/common/common.h
+-        av1/common/common_data.h
+-        av1/common/convolve.h
+-        av1/common/entropy.h
+-        av1/common/entropymode.h
+-        av1/common/entropymv.h
+-        av1/common/enums.h
+-        av1/common/filter.h
+-        av1/common/frame_buffers.h
+-        av1/common/idct.h
+-        av1/common/mv.h
+-        av1/common/mvref_common.h
+-        av1/common/obmc.h
+-        av1/common/obu_util.h
+-        av1/common/pred_common.h
+-        av1/common/quant_common.h
+-        av1/common/reconinter.h
+-        av1/common/reconinter_template.inc
+-        av1/common/reconintra.h
+-        av1/common/resize.h
+-        av1/common/restoration.h
+-        av1/common/scale.h
+-        av1/common/scan.h
+-        av1/common/seg_common.h
+-        av1/common/thread_common.h
+-        av1/common/tile_common.h
+-        av1/common/timing.h
+-        av1/common/token_cdfs.h
+-        av1/common/txb_common.h
+-        av1/common/warped_motion.h
+-        av1/decoder/decodeframe.h
+-        av1/decoder/decodemv.h
+-        av1/decoder/decoder.h
+-        av1/decoder/decodetxb.h
+-        av1/decoder/detokenize.h
+-        av1/decoder/dthread.h
+-        av1/decoder/grain_synthesis.h
+-        av1/decoder/obu.h
+-        common/args_helper.h
 -        AVIF/src/avif/avif.h
 -        AVIF/src/avif/internal.h
 -        AVIF/src/src-libyuv/libyuv/basic_types.h
@@ -145,71 +142,74 @@ index 29ffe0fdf..7f1680eaf 100644
 -        AVIF/src/src-libyuv/libyuv/scale.h
 -        AVIF/src/src-libyuv/libyuv/scale_row.h
 -        AVIF/src/src-libyuv/libyuv/version.h
--        
++    INCLUDE_DIRS
++	${AVIF_INCLUDE_DIRS}
+ 
      CPPFILES
--        aom/aom_codec.c
--        aom/aom_decoder.c
--        aom/aom_image.c
--        aom/aom_integer.c
--        aom/aom_dsp/aom_convolve.c
--        aom/aom_dsp/aom_dsp_rtcd.c
--        aom/aom_dsp/binary_codes_reader.c
--        aom/aom_dsp/bitreader.c
--        aom/aom_dsp/bitreader_buffer.c
--        aom/aom_dsp/blend_a64_hmask.c
--        aom/aom_dsp/blend_a64_vmask.c
--        aom/aom_dsp/blend_a64_mask.c
--        aom/aom_dsp/entcode.c
--        aom/aom_dsp/entdec.c
--        aom/aom_dsp/grain_synthesis.c
--        aom/aom_dsp/intrapred.c
--        aom/aom_dsp/loopfilter.c
--        aom/aom_mem/aom_mem.c
--        aom/aom_scale/aom_scale_rtcd.c
--        aom/aom_scale/generic/aom_scale.c
--        aom/aom_scale/generic/gen_scalers.c
--        aom/aom_scale/generic/yv12config.c
--        aom/aom_scale/generic/yv12extend.c
--        aom/aom_util/aom_thread.c
--        aom/av1/av1_dx_iface.c
--        aom/av1/common/alloccommon.c
--        aom/av1/common/av1_inv_txfm1d.c
--        aom/av1/common/av1_inv_txfm2d.c
--        aom/av1/common/av1_loopfilter.c
--        aom/av1/common/av1_txfm.c
--        aom/av1/common/av1_rtcd.c
--        aom/av1/common/blockd.c
--        aom/av1/common/cdef.c
--        aom/av1/common/cdef_block.c
--        aom/av1/common/cfl.c
--        aom/av1/common/convolve.c
--        aom/av1/common/entropymode.c 
--        aom/av1/common/entropy.c
--        aom/av1/common/entropymv.c
--        aom/av1/common/frame_buffers.c
--        aom/av1/common/idct.c
--        aom/av1/common/mvref_common.c
--        aom/av1/common/obu_util.c
--        aom/av1/common/pred_common.c
--        aom/av1/common/quant_common.c        
--        aom/av1/common/reconinter.c
--        aom/av1/common/reconintra.c
--        aom/av1/common/resize.c
--        aom/av1/common/restoration.c
--        aom/av1/common/av1_scale.c
--        aom/av1/common/scan.c
--        aom/av1/common/seg_common.c
--        aom/av1/common/thread_common.c
--        aom/av1/common/timing.c
--        aom/av1/common/txb_common.c
--        aom/av1/common/tile_common.c
--        aom/av1/common/warped_motion.c
--        aom/av1/decoder/decodeframe.c
--        aom/av1/decoder/decodemv.c
--        aom/av1/decoder/decoder.c
--        aom/av1/decoder/decodetxb.c
--        aom/av1/decoder/detokenize.c
--        aom/av1/decoder/obu.c
+-        aom/src/aom_codec.c
+-        aom/src/aom_decoder.c
+-        aom/src/aom_image.c
+-        aom/src/aom_integer.c
+-        aom_dsp/aom_convolve.c
+-        aom_dsp/aom_dsp_rtcd.c
+-        aom_dsp/binary_codes_reader.c
+-        aom_dsp/bitreader.c
+-        aom_dsp/bitreader_buffer.c
+-        aom_dsp/blend_a64_hmask.c
+-        aom_dsp/blend_a64_mask.c
+-        aom_dsp/blend_a64_vmask.c
+-        aom_dsp/entcode.c
+-        aom_dsp/entdec.c
+-        aom_dsp/intrapred.c
+-        aom_dsp/loopfilter.c
+-        aom_dsp/odintrin.c
+-        aom_dsp/pyramid.c
+-        aom_mem/aom_mem.c
+-        aom_scale/aom_scale_rtcd.c
+-        aom_scale/generic/yv12config.c
+-        aom_scale/generic/yv12extend.c
+-        aom_util/aom_thread.c
+-        av1/av1_dx_iface.c
+-        av1/common/alloccommon.c
+-        av1/common/av1_inv_txfm1d.c
+-        av1/common/av1_inv_txfm2d.c
+-        av1/common/av1_loopfilter.c
+-        av1/common/av1_rtcd.c
+-        av1/common/av1_txfm.c
+-        av1/common/blockd.c
+-        av1/common/cdef.c
+-        av1/common/cdef_block.c
+-        av1/common/cfl.c
+-        av1/common/common_data.c
+-        av1/common/convolve.c
+-        av1/common/entropy.c
+-        av1/common/entropymode.c
+-        av1/common/entropymv.c
+-        av1/common/frame_buffers.c
+-        av1/common/idct.c
+-        av1/common/mvref_common.c
+-        av1/common/obu_util.c
+-        av1/common/pred_common.c
+-        av1/common/quant_common.c
+-        av1/common/reconinter.c
+-        av1/common/reconintra.c
+-        av1/common/resize.c
+-        av1/common/restoration.c
+-        av1/common/scale.c
+-        av1/common/scan.c
+-        av1/common/seg_common.c
+-        av1/common/thread_common.c
+-        av1/common/tile_common.c
+-        av1/common/timing.c
+-        av1/common/txb_common.c
+-        av1/common/warped_motion.c
+-        av1/decoder/decodeframe.c
+-        av1/decoder/decodemv.c
+-        av1/decoder/decoder.c
+-        av1/decoder/decodetxb.c
+-        av1/decoder/detokenize.c
+-        av1/decoder/grain_synthesis.c
+-        av1/decoder/obu.c
 -        AVIF/src/alpha.c
 -        AVIF/src/avif.c
 -        AVIF/src/codec_aom.c
@@ -237,5 +237,5 @@ index 29ffe0fdf..7f1680eaf 100644
  
      RESOURCE_FILES
 -- 
-2.48.1
+2.55.0
 

2266.patch

@@ -1,217 +0,0 @@
-From a07a6b4d1da19bfc499db49641d74fb7c1a71e9b Mon Sep 17 00:00:00 2001
-From: "Benjamin A. Beasley" <code@musicinmybrain.net>
-Date: Sat, 11 Feb 2023 13:58:42 -0500
-Subject: [PATCH] Port to Embree 4.x
-
----
- cmake/modules/FindEmbree.cmake                   | 16 ++++++++--------
- pxr/imaging/plugin/hdEmbree/context.h            |  2 +-
- pxr/imaging/plugin/hdEmbree/mesh.cpp             |  2 +-
- pxr/imaging/plugin/hdEmbree/mesh.h               |  4 ++--
- pxr/imaging/plugin/hdEmbree/meshSamplers.h       |  4 ++--
- pxr/imaging/plugin/hdEmbree/pch.h                |  6 +++---
- pxr/imaging/plugin/hdEmbree/renderDelegate.h     |  2 +-
- pxr/imaging/plugin/hdEmbree/renderParam.h        |  2 +-
- pxr/imaging/plugin/hdEmbree/renderer.cpp         |  8 ++------
- pxr/imaging/plugin/hdEmbree/renderer.h           |  4 ++--
- .../plugin/hdEmbree/testenv/testHdEmbree.cpp     |  2 +-
- 11 files changed, 24 insertions(+), 28 deletions(-)
-
-diff --git a/cmake/modules/FindEmbree.cmake b/cmake/modules/FindEmbree.cmake
-index cd52f6b7f5..7c3ecd7cd8 100644
---- a/cmake/modules/FindEmbree.cmake
-+++ b/cmake/modules/FindEmbree.cmake
-@@ -20,11 +20,11 @@
- #=============================================================================
- 
- if (APPLE)
--    set (EMBREE_LIB_NAME libembree3.dylib)
-+    set (EMBREE_LIB_NAME libembree4.dylib)
- elseif (UNIX)
--    set (EMBREE_LIB_NAME libembree3.so)
-+    set (EMBREE_LIB_NAME libembree4.so)
- elseif (WIN32)
--    set (EMBREE_LIB_NAME embree3.lib)
-+    set (EMBREE_LIB_NAME embree4.lib)
- endif()
- 
- find_library(EMBREE_LIBRARY
-@@ -39,7 +39,7 @@ find_library(EMBREE_LIBRARY
- )
- 
- find_path(EMBREE_INCLUDE_DIR
--    embree3/rtcore.h
-+    embree4/rtcore.h
- HINTS
-     "${EMBREE_LOCATION}/include"
-     "$ENV{EMBREE_LOCATION}/include"
-@@ -47,12 +47,12 @@ DOC
-     "Embree headers path"
- )
- 
--if (EMBREE_INCLUDE_DIR AND EXISTS "${EMBREE_INCLUDE_DIR}/embree3/rtcore_version.h" )
--    file(STRINGS "${EMBREE_INCLUDE_DIR}/embree3/rtcore_version.h" TMP REGEX "^#define RTC_VERSION_MAJOR.*$")
-+if (EMBREE_INCLUDE_DIR AND EXISTS "${EMBREE_INCLUDE_DIR}/embree4/rtcore_version.h" )
-+    file(STRINGS "${EMBREE_INCLUDE_DIR}/embree4/rtcore_version.h" TMP REGEX "^#define RTC_VERSION_MAJOR.*$")
-     string(REGEX MATCHALL "[0-9]+" MAJOR ${TMP})
--    file(STRINGS "${EMBREE_INCLUDE_DIR}/embree3/rtcore_version.h" TMP REGEX "^#define RTC_VERSION_MINOR.*$")
-+    file(STRINGS "${EMBREE_INCLUDE_DIR}/embree4/rtcore_version.h" TMP REGEX "^#define RTC_VERSION_MINOR.*$")
-     string(REGEX MATCHALL "[0-9]+" MINOR ${TMP})
--    file(STRINGS "${EMBREE_INCLUDE_DIR}/embree3/rtcore_version.h" TMP REGEX "^#define RTC_VERSION_PATCH.*$")
-+    file(STRINGS "${EMBREE_INCLUDE_DIR}/embree4/rtcore_version.h" TMP REGEX "^#define RTC_VERSION_PATCH.*$")
-     string(REGEX MATCHALL "[0-9]+" PATCH ${TMP})
- 
-     set (EMBREE_VERSION ${MAJOR}.${MINOR}.${PATCH})
-diff --git a/pxr/imaging/plugin/hdEmbree/context.h b/pxr/imaging/plugin/hdEmbree/context.h
-index 4165adb1e6..af9cc4ef5b 100644
---- a/pxr/imaging/plugin/hdEmbree/context.h
-+++ b/pxr/imaging/plugin/hdEmbree/context.h
-@@ -14,7 +14,7 @@
- #include "pxr/base/gf/matrix4f.h"
- #include "pxr/base/vt/array.h"
- 
--#include <embree3/rtcore.h>
-+#include <embree4/rtcore.h>
- 
- PXR_NAMESPACE_OPEN_SCOPE
- 
-diff --git a/pxr/imaging/plugin/hdEmbree/mesh.cpp b/pxr/imaging/plugin/hdEmbree/mesh.cpp
-index 195f83a633..d3cb949952 100644
---- a/pxr/imaging/plugin/hdEmbree/mesh.cpp
-+++ b/pxr/imaging/plugin/hdEmbree/mesh.cpp
-@@ -203,7 +203,7 @@ void HdEmbreeMesh::_EmbreeCullFaces(const RTCFilterFunctionNArguments* args)
-             default: break;
-         }
-         if (cull) {
--            // This is how you reject a hit in embree3 instead of setting
-+            // This is how you reject a hit in embree3/4 instead of setting
-             // geomId to invalid on the ray
-             args->valid[i] = 0;
-         }
-diff --git a/pxr/imaging/plugin/hdEmbree/mesh.h b/pxr/imaging/plugin/hdEmbree/mesh.h
-index bbb006302f..ef1ef07a98 100644
---- a/pxr/imaging/plugin/hdEmbree/mesh.h
-+++ b/pxr/imaging/plugin/hdEmbree/mesh.h
-@@ -15,8 +15,8 @@
- 
- #include "pxr/imaging/plugin/hdEmbree/meshSamplers.h"
- 
--#include <embree3/rtcore.h>
--#include <embree3/rtcore_ray.h>
-+#include <embree4/rtcore.h>
-+#include <embree4/rtcore_ray.h>
- 
- PXR_NAMESPACE_OPEN_SCOPE
- 
-diff --git a/pxr/imaging/plugin/hdEmbree/meshSamplers.h b/pxr/imaging/plugin/hdEmbree/meshSamplers.h
-index c32c35fffa..3712a9e3ab 100644
---- a/pxr/imaging/plugin/hdEmbree/meshSamplers.h
-+++ b/pxr/imaging/plugin/hdEmbree/meshSamplers.h
-@@ -12,8 +12,8 @@
- #include "pxr/imaging/hd/meshUtil.h"
- #include "pxr/base/vt/types.h"
- 
--#include <embree3/rtcore.h>
--#include <embree3/rtcore_geometry.h>
-+#include <embree4/rtcore.h>
-+#include <embree4/rtcore_geometry.h>
- 
- #include <bitset>
- 
-diff --git a/pxr/imaging/plugin/hdEmbree/pch.h b/pxr/imaging/plugin/hdEmbree/pch.h
-index 0369fea3a1..2f9f19fa09 100644
---- a/pxr/imaging/plugin/hdEmbree/pch.h
-+++ b/pxr/imaging/plugin/hdEmbree/pch.h
-@@ -84,9 +84,9 @@
- #undef toupper
- #endif
- #endif // PXR_PYTHON_SUPPORT_ENABLED && !PXR_USE_INTERNAL_BOOST_PYTHON
--#include <embree3/rtcore.h>
--#include <embree3/rtcore_geometry.h>
--#include <embree3/rtcore_ray.h>
-+#include <embree4/rtcore.h>
-+#include <embree4/rtcore_geometry.h>
-+#include <embree4/rtcore_ray.h>
- #include <tbb/blocked_range.h>
- #include <tbb/cache_aligned_allocator.h>
- #include <tbb/concurrent_hash_map.h>
-diff --git a/pxr/imaging/plugin/hdEmbree/renderDelegate.h b/pxr/imaging/plugin/hdEmbree/renderDelegate.h
-index 1d8694daa6..72894b9080 100644
---- a/pxr/imaging/plugin/hdEmbree/renderDelegate.h
-+++ b/pxr/imaging/plugin/hdEmbree/renderDelegate.h
-@@ -14,7 +14,7 @@
- #include "pxr/base/tf/staticTokens.h"
- 
- #include <mutex>
--#include <embree3/rtcore.h>
-+#include <embree4/rtcore.h>
- 
- PXR_NAMESPACE_OPEN_SCOPE
- 
-diff --git a/pxr/imaging/plugin/hdEmbree/renderParam.h b/pxr/imaging/plugin/hdEmbree/renderParam.h
-index 206a7458bc..354fed4faa 100644
---- a/pxr/imaging/plugin/hdEmbree/renderParam.h
-+++ b/pxr/imaging/plugin/hdEmbree/renderParam.h
-@@ -11,7 +11,7 @@
- #include "pxr/imaging/hd/renderDelegate.h"
- #include "pxr/imaging/hd/renderThread.h"
- 
--#include <embree3/rtcore.h>
-+#include <embree4/rtcore.h>
- 
- PXR_NAMESPACE_OPEN_SCOPE
- 
-diff --git a/pxr/imaging/plugin/hdEmbree/renderer.cpp b/pxr/imaging/plugin/hdEmbree/renderer.cpp
-index 88d5e79093..820238c373 100644
---- a/pxr/imaging/plugin/hdEmbree/renderer.cpp
-+++ b/pxr/imaging/plugin/hdEmbree/renderer.cpp
-@@ -667,9 +667,7 @@ HdEmbreeRenderer::_TraceRay(unsigned int x, unsigned int y,
-     rayHit.ray.flags = 0;
-     _PopulateRayHit(&rayHit, origin, dir, 0.0f);
-     {
--      RTCIntersectContext context;
--      rtcInitIntersectContext(&context);
--      rtcIntersect1(_scene, &context, &rayHit);
-+      rtcIntersect1(_scene, &rayHit);
-       //
-       // there is something odd about how this is used in Embree. Is it reversed
-       // here and then when it it used in
-@@ -1005,9 +1003,7 @@ HdEmbreeRenderer::_ComputeAmbientOcclusion(GfVec3f const& position,
-         shadow.flags = 0;
-         _PopulateRay(&shadow, position, shadowDir, 0.001f);
-         {
--          RTCIntersectContext context;
--          rtcInitIntersectContext(&context);
--          rtcOccluded1(_scene,&context,&shadow);
-+          rtcOccluded1(_scene,&shadow);
-         }
- 
-         // Record this AO ray's contribution to the occlusion factor: a
-diff --git a/pxr/imaging/plugin/hdEmbree/renderer.h b/pxr/imaging/plugin/hdEmbree/renderer.h
-index 2da9880848..fc3e062dd8 100644
---- a/pxr/imaging/plugin/hdEmbree/renderer.h
-+++ b/pxr/imaging/plugin/hdEmbree/renderer.h
-@@ -15,8 +15,8 @@
- #include "pxr/base/gf/matrix4d.h"
- #include "pxr/base/gf/rect2i.h"
- 
--#include <embree3/rtcore.h>
--#include <embree3/rtcore_ray.h>
-+#include <embree4/rtcore.h>
-+#include <embree4/rtcore_ray.h>
- 
- #include <random>
- #include <atomic>
-diff --git a/pxr/imaging/plugin/hdEmbree/testenv/testHdEmbree.cpp b/pxr/imaging/plugin/hdEmbree/testenv/testHdEmbree.cpp
-index 02c2ca69f8..93705b2d28 100644
---- a/pxr/imaging/plugin/hdEmbree/testenv/testHdEmbree.cpp
-+++ b/pxr/imaging/plugin/hdEmbree/testenv/testHdEmbree.cpp
-@@ -23,7 +23,7 @@
- 
- #include "pxr/base/tf/errorMark.h"
- 
--#include <embree3/rtcore.h>
-+#include <embree4/rtcore.h>
- #include <iostream>
- 
- PXR_NAMESPACE_USING_DIRECTIVE

3487.patch

@@ -1,22 +0,0 @@
-From 97151da9044e0fb488b61d664cc56fda0b711bf7 Mon Sep 17 00:00:00 2001
-From: "Benjamin A. Beasley" <code@musicinmybrain.net>
-Date: Tue, 21 Jan 2025 22:05:01 -0500
-Subject: [PATCH] Add missing #include <cstdint>
-
-Fixes failure to compile with GCC 15
----
- pxr/usd/usd/zipFile.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/pxr/usd/usd/zipFile.h b/pxr/usd/usd/zipFile.h
-index 4356be7ecb..8f22420966 100644
---- a/pxr/usd/usd/zipFile.h
-+++ b/pxr/usd/usd/zipFile.h
-@@ -10,6 +10,7 @@
- #include "pxr/pxr.h"
- #include "pxr/usd/usd/api.h"
- 
-+#include <cstdint>
- #include <memory>
- #include <string>
- #include <utility>

3903.patch

@@ -0,0 +1,83 @@
+From 3e51fb244dd264b09179999d29dc7c5afd7e71e3 Mon Sep 17 00:00:00 2001
+From: "Benjamin A. Beasley" <code@musicinmybrain.net>
+Date: Tue, 2 Dec 2025 10:43:31 +0000
+Subject: [PATCH] Backport fixes for CVE-2025-64181 etc. in OpenEXRCore
+
+---
+ .../hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c    | 20 ++++++++++++++++---
+ .../OpenEXR/OpenEXRCore/internal_util.h       |  4 ++--
+ .../OpenEXR/OpenEXRCore/parse_header.c        |  4 +++-
+ 3 files changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c
+index cfe80b4cd68..e11209fe660 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/chunk.c
+@@ -1292,6 +1292,16 @@ exr_read_tile_chunk_info (
+         return pctxt->report_error (
+             pctxt, EXR_ERR_INVALID_ARGUMENT, "Invalid packed size of 0");
+ 
++    if (part->comp_type == EXR_COMPRESSION_NONE &&
++       cinfo->packed_size != cinfo->unpacked_size)
++    {
++         return pctxt->print_error (
++             pctxt,
++             EXR_ERR_BAD_CHUNK_LEADER,
++             "Mismatch between unpacked and packed size with uncompressed data: packed is %" PRIu64 "; unpacked is %" PRIu64,
++             cinfo->packed_size, cinfo->unpacked_size);
++    }
++
+     return EXR_ERR_SUCCESS;
+ }
+ 
+@@ -1350,11 +1360,15 @@ exr_read_chunk (
+         rv    = pctxt->do_read (
+             pctxt, packed_data, toread, &dataoffset, &nread, rmode);
+ 
+-        if (rmode == EXR_ALLOW_SHORT_READ && nread < (int64_t) toread)
++        if (rmode == EXR_ALLOW_SHORT_READ &&
++            nread >= 0 &&
++            nread < (int64_t) toread)
++        {
+             memset (
+                 ((uint8_t*) packed_data) + nread,
+-                0,
+-                toread - (uint64_t) (nread));
++                    0,
++            (size_t)(toread - (uint64_t)nread));
++        }
+     }
+     else
+         rv = EXR_ERR_SUCCESS;
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_util.h b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_util.h
+index 3c6f02786cc..e0fa3933d92 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_util.h
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/internal_util.h
+@@ -31,10 +31,10 @@ compute_sampled_height (int height, int y_sampling, int start_y)
+         else
+             start = start_y;
+         end = start_y + height - 1;
+-        end -= (end < 0) ? (-end % y_sampling) : (end % y_sampling);
++        end -= (end < 0 ? -end : end) % y_sampling;
+ 
+         if (start > end)
+-            nlines = 0;
++            nlines = start == start_y ? 1 : 0;
+         else
+             nlines = (end - start) / y_sampling + 1;
+     }
+diff --git a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/parse_header.c b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/parse_header.c
+index d7230392693..8b6cf78cc59 100644
+--- a/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/parse_header.c
++++ b/pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/parse_header.c
+@@ -2293,7 +2293,9 @@ internal_exr_compute_chunk_offset_size (struct _internal_exr_part* curpart)
+ 
+     w = (uint64_t) (((int64_t) dw.max.x) - ((int64_t) dw.min.x) + 1);
+ 
+-    if (curpart->tiles)
++    if (curpart->storage_mode != EXR_STORAGE_SCANLINE &&
++       curpart->storage_mode != EXR_STORAGE_DEEP_SCANLINE &&
++       curpart->tiles)
+     {
+         const exr_attr_tiledesc_t* tiledesc  = curpart->tiles->tiledesc;
+         int64_t                    tilecount = 0;

534b22c12dc18203ab5b233792debca8bf843b2e.patch

@@ -1,34 +0,0 @@
-From 534b22c12dc18203ab5b233792debca8bf843b2e Mon Sep 17 00:00:00 2001
-From: Matt Johnson <matt.johnson@epicgames.com>
-Date: Fri, 24 Jan 2025 16:17:30 -0800
-Subject: [PATCH] work: account for task_group_base interface change in oneTBB
- 2022.0.0
-
-The `m_wait_ctx` member being used in a narrow band of oneTBB versions was removed in a refactor that went into version [v2022.0.0](https://github.com/oneapi-src/oneTBB/releases/tag/v2022.0.0) which was released yesterday:
-https://github.com/oneapi-src/oneTBB/commit/1f52f5093ec7ce23829fe64ab82ac5541fea42ee
-
-This change accounts for the update in the new version of oneTBB and uses the newly added `m_wait_vertex` member to access the same context as before.
-
-Closes #3392
-
-(Internal change: 2354795)
----
- pxr/base/work/dispatcher.cpp | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/pxr/base/work/dispatcher.cpp b/pxr/base/work/dispatcher.cpp
-index 24daa98b5b..45a9f38004 100644
---- a/pxr/base/work/dispatcher.cpp
-+++ b/pxr/base/work/dispatcher.cpp
-@@ -34,7 +34,11 @@ WorkDispatcher::WorkDispatcher()
- #if TBB_INTERFACE_VERSION_MAJOR >= 12
- inline tbb::detail::d1::wait_context& 
- WorkDispatcher::_TaskGroup::_GetInternalWaitContext() {
-+#if TBB_INTERFACE_VERSION_MINOR >= 14
-+    return m_wait_vertex.get_context();
-+#else
-     return m_wait_ctx;
-+#endif
- }
- #endif
- 

sources

@@ -1 +1 @@
-SHA512 (OpenUSD-25.02a.tar.gz) = 6369b902d4e84bda7f3b54357915a933f2d3ea7753b9f702350af6d341572d49a0644ccf803a469e9b452aad1f3d81d7cbfab340f2509fba1213ffd575cf402b
+SHA512 (OpenUSD-26.08.tar.gz) = 82f7bb4f77b295be79cd36f591f242276d36c0d589b0fca383344c27e70daf7e29151bf587528bb2fc2b2a8b974387a253993ace3caf5f79ae70f9ebbc71cf1a

usd.spec

@@ -2,15 +2,13 @@
 # package version, as a reminder of the need to rebuild dependent packages on
 # every update. See additional notes near the downstream ABI versioning patch.
 # It should be 0.MAJOR.MINOR without leading zeros, e.g. 22.03 → 0.22.3.
-%global downstream_so_version 0.25.2
+%global downstream_so_version 0.26.8
 
 %bcond alembic       1
 %bcond draco         1
 %bcond embree        1
 %bcond jemalloc      0
-# Not yet packaged: https://github.com/AcademySoftwareFoundation/MaterialX
-# https://bugzilla.redhat.com/show_bug.cgi?id=2262694
-%bcond materialx     0
+%bcond materialx     1
 # Default "UNIX Makefiles" backend for CMake would also work fine; ninja is a
 # bit faster. We conditionalize it just in case there are backend-specific
 # issues in the future.
@@ -27,7 +25,7 @@
 %bcond test          0
 
 Name:           usd
-Version:        25.02a
+Version:        26.08
 Release:        %autorelease
 Summary:        3D VFX pipeline interchange file format
 
@@ -35,12 +33,15 @@ Summary:        3D VFX pipeline interchange file format
 #
 # Apache-2.0:
 #   - pxr/imaging/hgiVulkan/spirv_reflect.{cpp,h}
+#   - pxr/imaging/plugin/hdEmbree/pxrPbrt/pbrtUtils.h
+#   - pxr/imaging/plugin/hdEmbree/pxrIES/pxr-IES.patch
+#   - pxr/imaging/plugin/hdEmbree/pxrIES/ies.{cpp,h}
 # BSD-3-Clause:
 #   - pxr/base/gf/ilmbase_*
 #   - pxr/base/js/rapidjson/msinttypes/ (removed in %%prep)
 #   - pxr/base/tf/pxrCLI11/ (removed in %%prep)
 #   - pxr/base/tf/pxrDoubleConversion/ (removed in %%prep)
-#   - pxr/imaging/hio/OpenEXR/OpenEXRCore/
+#   - pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/
 #   - pxr/imaging/plugin/hioAvif/AVIF/src/src-libyuv/
 # BSD-2-Clause:
 #   - pxr/base/tf/pxrLZ4/ (removed in %%prep)
@@ -58,14 +59,14 @@ Summary:        3D VFX pipeline interchange file format
 #   - pxr/base/tf/pxrTslRobinMap/
 #   - pxr/imaging/garch/khrplatform.h
 #   - pxr/imaging/hgiVulkan/vk_mem_alloc.h
-#   - pxr/imaging/hio/OpenEXR/deflate/ (removed in %%prep)
-#   - third_party/renderman-26/plugin/rmanArgsParser/pugixml/ (removed in %%prep)
+#   - pxr/imaging/plugin/hioOpenEXR/OpenEXR/deflate/ (removed in %%prep)
+#   - third_party/renderman/plugin/rmanArgsParser/pugixml/ (removed in %%prep)
 # MIT OR Unlicense:
 #   - pxr/imaging/hio/stb/
 # Pixar AND GPL-3.0-or-later WITH Bison-exception-2.2:
 #   - pxr/usd/sdf/path.tab.{cpp,h}
 #   - pxr/usd/sdf/textFileFormat.tab.{cpp,h}
-#   - third_party/renderman-26/plugin/hdPrman/virtualStructConditionalGrammar.tab.{cpp,h}
+#   - third_party/renderman/plugin/hdPrman/virtualStructConditionalGrammar.tab.{cpp,h}
 #
 # Additionally, the following would be listed above but are removed in %%prep:
 #
@@ -126,12 +127,13 @@ Source1:        org.openusd.usdview.desktop
 # built with -DPXR_BUILD_EXAMPLES=OFF, but it is.)
 Patch:          0001-Downstream-only-add-an-SONAME-version.patch
 
-# Port to Embree 4.x
-# https://github.com/PixarAnimationStudios/OpenUSD/pull/2266
-# See also:
-# hdEmbree: add support for building against embree4
-# https://github.com/PixarAnimationStudios/USD/pull/2266
-Patch:          %{forgeurl}/pull/2266.patch
+# Downstream-only: use Valgrind macro instead of inline assembly
+#
+# Upstream already has a plan to make this change, but is waiting to be
+# able to add a build dependency on valgrind-devel. We have no such
+# obstacle, and this change fixes the inline assembly failing to compile
+# on aarch64.
+Patch:          0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch
 
 # Downstream-only: use the system double-conversion library
 Patch:          0001-Downstream-only-use-the-system-double-conversion-lib.patch
@@ -146,15 +148,17 @@ Patch:          0005-Downstream-only-use-the-system-libdeflate.patch
 # Downstream-only: use the system libavif library
 Patch:          0006-Downstream-only-use-the-system-libavif.patch
 
-# work: account for task_group_base interface change in oneTBB 2022.0.0
-# https://github.com/PixarAnimationStudios/OpenUSD/pull/3392
-# Merged as commit 534b22c12dc18203ab5b233792debca8bf843b2e.
-Patch:          %{forgeurl}/commit/534b22c12dc18203ab5b233792debca8bf843b2e.patch
+# Backport fixes for CVE-2025-64181 etc. in OpenEXRCore
+# https://github.com/PixarAnimationStudios/OpenUSD/pull/3903
+Patch:          %{forgeurl}/pull/3903.patch
 
-# Add missing #include <cstdint>
-# https://github.com/PixarAnimationStudios/OpenUSD/pull/3487
-# Fixes failure to compile with GCC 15
-Patch:          %{forgeurl}/pull/3487.patch
+# Replace PyWeakref_GetObject with PyWeakref_GetRef
+# Fixes RHBZ#2433881. This patch is LLM-generated and needs expert human
+# review, but it at least builds. See discussion in
+# https://bugzilla.redhat.com/show_bug.cgi?id=2433881.
+# Mentioned upstream in
+# https://github.com/PixarAnimationStudios/OpenUSD/issues/3966#issuecomment-5128542913.
+Patch:          0001-Replace-PyWeakref_GetObject-with-PyWeakref_GetRef.patch
 
 # Base
 BuildRequires:  gcc-c++
@@ -170,8 +174,13 @@ BuildRequires:  help2man
 BuildRequires:  pkgconfig(blosc)
 BuildRequires:  pkgconfig(dri)
 BuildRequires:  hdf5-devel
-BuildRequires:  opensubdiv-devel >= 3.6.0
+BuildRequires:  cmake(OpenSubdiv)
 BuildRequires:  pkgconfig(tbb)
+# This seems to be an indirect dependency, probably through OpenSubdiv.
+# Ideally, everything would take care of its own dependencies, and we wouldn’t
+# have to specify it directly, but we haven’t studied the problem closely
+# enough to propose a fix.
+BuildRequires:  pkgconfig(OpenCL)
 # Unbundled:
 BuildRequires:  cmake(double-conversion)
 BuildRequires:  pkgconfig(liblz4)
@@ -185,6 +194,9 @@ BuildRequires:  pkgconfig(libavif)
 
 BuildRequires:  cmake(Imath) >= 3.0
 
+# Introduced by 0001-Downstream-only-use-Valgrind-macro-instead-of-inline.patch
+BuildRequires:  valgrind-devel
+
 %if %{with alembic}
 BuildRequires:  cmake(Alembic)
 %endif
@@ -201,6 +213,13 @@ BuildRequires:  embree-devel
 BuildRequires:  pkgconfig(jemalloc)
 %endif
 
+%if %{with materialx}
+BuildRequires:  cmake(materialx)
+BuildRequires:  materialx-data
+BuildRequires:  pkgconfig(xt)
+BuildRequires:  python3-materialx
+%endif
+
 %if %{with ocio}
 BuildRequires:  cmake(OpenColorIO)
 %endif
@@ -219,7 +238,7 @@ BuildRequires:  openvdb-devel
 %endif
 
 %if %{with ptex}
-BuildRequires:  pkgconfig(ptex)
+BuildRequires:  cmake(ptex)
 %endif
 
 # Header-only library: -static is for tracking per guidelines
@@ -236,12 +255,11 @@ BuildRequires:  pkgconfig(ptex)
 # CVE-2023-45664
 # CVE-2023-45666
 # CVE-2023-45667
-BuildRequires:  stb_image-devel >= 2.28^20231011gitbeebb24-12
-BuildRequires:  stb_image-static
-BuildRequires:  stb_image_write-devel >= 1.16
-BuildRequires:  stb_image_write-static
-BuildRequires:  stb_image_resize-devel >= 0.97
-BuildRequires:  stb_image_resize-static
+# https://github.com/nothings/stb/issues/1860
+# https://github.com/nothings/stb/issues/1861
+BuildRequires:  stb_image-static >= 2.30^20251025gitf1c79c0-2
+BuildRequires:  stb_image_write-static >= 1.16
+BuildRequires:  stb_image_resize-static >= 0.97
 
 Requires:       usd-libs%{?_isa} = %{version}-%{release}
 Requires:       python3-usd%{?_isa} = %{version}-%{release}
@@ -252,7 +270,7 @@ Requires:       python3-usd%{?_isa} = %{version}-%{release}
 #
 # Note that pxr/base/arch/assumptions.cpp explicitly tests the machine is not
 # big-endian, and pxr/base/arch/defines.h explicitly enforces x86_64 or ARM64.
-ExclusiveArch:  aarch64 x86_64
+ExclusiveArch:  %{arm64} %{x86_64}
 
 %description
 Universal Scene Description (USD) is a time-sampled scene
@@ -282,8 +300,9 @@ Provides:       bundled(ilmbase) = 2.5.3
 # Currently, Fedora’s PEGTL is too old:
 # https://bugzilla.redhat.com/show_bug.cgi?id=1902427
 Provides:       bundled(PEGTL) = 3.2.7
-# Version from pxr/imaging/hio/OpenEXR/OpenEXRCore/openexr_version.h
-# From pxr/imaging/hio/OpenEXR/README.md:
+# Version from
+# pxr/imaging/plugin/hioOpenEXR/OpenEXR/OpenEXRCore/openexr_version.h
+# From pxr/imaging/plugin/hioOpenEXR/OpenEXR/README.md:
 #   A few changes are still in progress to upstreamed to the OpenEXR project,
 #   but these are minor, and otherwise, almost all differences between the
 #   interred OpenEXRCore and the official OpenEXR repo are consolidated to the
@@ -312,6 +331,39 @@ Provides:       bundled(openexr) = 3.2.0
 # effort to remove the Boost dependency. While pxr_boost::python is derived
 # from boost::python, it is not intended to remain compatible with it.
 Provides:       bundled(boost) = 1.85.0
+# From LICENSE.txt:
+# ===========================================================
+# PBRT (Sampling functions)
+# ============================================================
+# USD includes code derived from the pbrt-v4 library, retrieved from
+# https://github.com/mmp/pbrt-v4/tree/8c19f304558fd7681e2fef2c395a689d0106fb05, which was
+# provided subject to the unmodified Apache 2.0 license. For details, see
+# https://github.com/mmp/pbrt-v4/blob/8c19f304558fd7681e2fef2c395a689d0106fb05/LICENSE.txt
+#
+# The bundled routines in pxr/imaging/plugin/hdEmbree/pxrPbrt/pbrtUtils.h are
+# just a handful of small internal utility functions. It would not be
+# reasonable to add a dependency on the full pbrt ray tracer even if these were
+# exposed in a public API.
+Provides:       bundled(pbrt-v4) = 4~20251208.8c19f30
+# From LICENSE.txt:
+# ============================================================
+# Cycles (IES reader)
+# ============================================================
+# USD includes classes from the Blender Foundation's Cycles project, retrieved from
+# https://projects.blender.org/blender/cycles/src/commit/0be21d452506ec90259b9063c28b5a6fc1cac6a1,
+# which was provided subject to the unmodified Apache 2.0 license. For details, see
+# https://projects.blender.org/blender/cycles/src/commit/0be21d452506ec90259b9063c28b5a6fc1cac6a1/LICENSE
+#
+# These are not a candidate for unbundling because they are internal utility
+# functions not available in the public API. There are also some minor
+# modifications for OpenUSD, documented in
+# pxr/imaging/plugin/hdEmbree/pxrIES/pxr-IES.patch.
+#
+# Is this commit a post-release snapshot of 4.5.0, or a pre-release snapshot of
+# 5.0.0? How can we tell? There doesn’t seem to be a project version number
+# embedded in the source tree. Since this commit hash is only two commits ahead
+# of the v4.5.0 tag, we consider it a 4.5.0 post-release.
+Provides:       bundled(cycles) = 4.5.0^20251210.0be21d4
 
 # We are currently able to unbundle these and use system libraries, but we
 # retain the virtual Provides, commented out, as documentation and in case we
@@ -324,7 +376,7 @@ Provides:       bundled(boost) = 1.85.0
 # Version from: pxr/base/tf/pxrCLI11/README.md
 # Provides:       bundled(cli11) = 2.3.1
 # Version from:
-# third_party/renderman-26/plugin/rmanArgsParser/pugixml/pugiconfig.hpp
+# third_party/renderman/plugin/rmanArgsParser/pugixml/pugiconfig.hpp
 # (header comment)
 # Provides:       bundled(pugixml) = 1.9
 # Version from: pxr/base/js/rapidjson/rapidjson.h
@@ -333,7 +385,7 @@ Provides:       bundled(boost) = 1.85.0
 # Version from: pxr/base/tf/pxrTslRobinMap/robin_growth_policy.h
 # (PXR_TSL_RH_VERSION_{MAJOR,MINOR,PATCH})
 # Provides:       bundled(robin-map) = 1.3.0
-# Version from pxr/imaging/hio/OpenEXR/deflate/libdeflate.h
+# Version from pxr/imaging/plugin/hioOpenEXR/OpenEXR/deflate/libdeflate.h
 # Provides:       bundled(libdeflate) = 1.18
 # Version from pxr/imaging/plugin/hioAvif/AVIF/src/avif/avif.h
 #   We actually have a post-release snapshot of libavif, because
@@ -348,8 +400,8 @@ Provides:       bundled(boost) = 1.85.0
 # https://chromium.googlesource.com/libyuv/libyuv and find the commit hash that
 # corresponds to a particular serial number.
 # LIBYUV_VERSION 1895 = commit a97746349b244efd54ab1eb0c0a7366717b33f39
-# Provides:       bundled(libyuv) = 0^20240812gita977463
-# Version from pxr/imaging/plugin/hioAvif/aom/config/aom_version.h
+# Provides:       bundled(libyuv) = 0^20240812.a977463
+# Version from pxr/imaging/plugin/hioAvif/config/aom_version.h
 # Provides:       bundled(aom) = 3.0.0
 
 %description libs
@@ -364,6 +416,11 @@ Requires:       usd-libs%{?_isa} = %{version}-%{release}
 # Unbundled, and exposed in the API:
 Requires:       cli11-devel cli11-static
 Requires:       robin-map-devel robin-map-static
+# Needed by cmake config
+Requires:       cmake(OpenSubdiv)
+%if %{with materialx}
+Requires:       cmake(materialx)
+%endif
 
 %description devel
 This package contains the C++ header files and symbolic links to the shared
@@ -380,8 +437,8 @@ BuildRequires:  python3dist(jinja2)
 BuildRequires:  desktop-file-utils
 BuildRequires:  python3dist(pyside6)
 BuildRequires:  pyside6-tools
-%endif
 BuildRequires:  python3dist(pyopengl)
+%endif
 Requires:       font(roboto)
 Requires:       font(robotoblack)
 Requires:       font(robotolight)
@@ -389,8 +446,8 @@ Requires:       font(robotomono)
 Requires:       python3dist(jinja2)
 %if %{with usdview}
 Requires:       python3dist(pyside6)
-%endif
 Requires:       python3dist(pyopengl)
+%endif
 
 Requires:       usd-libs%{?_isa} = %{version}-%{release}
 
@@ -463,9 +520,9 @@ cat > pxr/base/tf/pxrCLI11/CLI11.h <<'EOF'
 namespace pxr_CLI = CLI;
 EOF
 # Remove the bundled copy of pugixml.
-find third_party/renderman-*/plugin/rmanArgsParser/pugixml/ \
+find third_party/renderman/plugin/rmanArgsParser/pugixml/ \
     -type f ! -name '*.hpp' -print -delete
-for hdr in third_party/renderman-*/plugin/rmanArgsParser/pugixml/*.hpp
+for hdr in third_party/renderman/plugin/rmanArgsParser/pugixml/*.hpp
 do
   cat > "${hdr}" <<EOF
 #include <$(basename "${hdr}")>
@@ -488,7 +545,7 @@ namespace pxr_tsl = tsl;
 EOF
 done
 # Remove the bundled copy of libdeflate.
-rm -rv pxr/imaging/hio/OpenEXR/deflate/
+rm -rv pxr/imaging/plugin/hioOpenEXR/OpenEXR/deflate/
 # Remove the bundled copies of libavif, along with the associated libaom and
 # the libyuv that is in the libavif sources.
 rm -rv pxr/imaging/plugin/hioAvif/aom/ \
@@ -562,13 +619,13 @@ extra_flags="${extra_flags-} -DTBB_SUPPRESS_DEPRECATED_MESSAGES=1"
      -DPXR_BUILD_TESTS=%{expr:%{with test}?"ON":"OFF"} \
      -DPXR_BUILD_TUTORIALS=OFF \
      -DPXR_BUILD_USD_IMAGING=ON \
+     -DPXR_BUILD_EXEC=ON \
      -DPXR_BUILD_USD_TOOLS=ON \
      -DPXR_BUILD_USDVIEW=%{expr:%{with usdview}?"ON":"OFF"} \
      \
      -DPXR_BUILD_ALEMBIC_PLUGIN=%{expr:%{with alembic}?"ON":"OFF"} \
      -DPXR_BUILD_DRACO_PLUGIN=%{expr:%{with draco}?"ON":"OFF"} \
      -DPXR_BUILD_EMBREE_PLUGIN=%{expr:%{with embree}?"ON":"OFF"} \
-     -DPXR_BUILD_MATERIALX_PLUGIN=%{expr:%{with materialx}?"ON":"OFF"} \
      -DPXR_BUILD_OPENCOLORIO_PLUGIN=%{expr:%{with ocio}?"ON":"OFF"} \
      -DPXR_BUILD_OPENIMAGEIO_PLUGIN=%{expr:%{with oiio}?"ON":"OFF"} \
      -DPXR_BUILD_PRMAN_PLUGIN=OFF \
@@ -578,6 +635,7 @@ extra_flags="${extra_flags-} -DTBB_SUPPRESS_DEPRECATED_MESSAGES=1"
      -DPXR_ENABLE_PTEX_SUPPORT=%{expr:%{with ptex}?"ON":"OFF"} \
      -DPXR_ENABLE_OSL_SUPPORT=%{expr:%{with openshading}?"ON":"OFF"} \
      -DPXR_ENABLE_MALLOCHOOK_SUPPORT=OFF \
+     -DPXR_ENABLE_MATERIALX_SUPPORT=%{expr:%{with materialx}?"ON":"OFF"} \
      -DPXR_ENABLE_PYTHON_SUPPORT=ON \
      \
      -DPXR_INSTALL_LOCATION="%{_libdir}/usd/plugin" \
@@ -596,6 +654,10 @@ extra_flags="${extra_flags-} -DTBB_SUPPRESS_DEPRECATED_MESSAGES=1"
 mkdir -p %{buildroot}%{python3_sitearch}
 mv %{buildroot}%{python3_sitelib}/* %{buildroot}%{python3_sitearch}
 
+# Upstream may expect to use this as a script in development, but we install it
+# without executable permissions, so we remove the shebang.
+sed -r -i '1{/^#!/d}' '%{buildroot}%{python3_sitearch}/pxr/Usd/usdGenSchema.py'
+
 %if %{with usdview}
 # Install a desktop icon for usdview
 desktop-file-install                                    \
@@ -639,7 +701,11 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d
 %{_bindir}/hdGenSchema
 %{_bindir}/sdfdump
 %{_bindir}/sdffilter
+%if %{with materialx}
+%{_bindir}/usdBakeMaterialX
+%endif
 %{_bindir}/usdGenSchema
+%{_bindir}/usdInitSchema
 %{_bindir}/usdcat
 %{_bindir}/usdchecker
 %if %{with draco}
@@ -656,6 +722,7 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d
 %{_bindir}/usdstitch
 %{_bindir}/usdstitchclips
 %{_bindir}/usdtree
+%{_bindir}/usdupdatecrate
 %{_bindir}/usdzip
 %if %{with usdview}
 %{_datadir}/applications/org.openusd.usdview.desktop
@@ -666,7 +733,11 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d
 %{_mandir}/man1/hdGenSchema.1*
 %{_mandir}/man1/sdfdump.1*
 %{_mandir}/man1/sdffilter.1*
+%if %{with materialx}
+%{_mandir}/man1/usdBakeMaterialX.1*
+%endif
 %{_mandir}/man1/usdGenSchema.1*
+%{_mandir}/man1/usdInitSchema.1*
 %{_mandir}/man1/usdcat.1*
 %{_mandir}/man1/usdchecker.1*
 %if %{with draco}
@@ -683,6 +754,7 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/org.openusd.usdview.d
 %{_mandir}/man1/usdstitch.1*
 %{_mandir}/man1/usdstitchclips.1*
 %{_mandir}/man1/usdtree.1*
+%{_mandir}/man1/usdupdatecrate.1*
 %{_mandir}/man1/usdzip.1*
 %if %{with usdview}
 %{_mandir}/man1/testusdview.1*