Backport candidates for ITK 5.4.6 release

[hjmjohnson]

Tracking issue for commits on `main` that should be considered for backporting to the `release-5.4` branch for ITK 5.4.6. See also Discourse: Patches for ITK 5.4.6.

Open PRs targeting release-5.4

• Release 5.4 update gdcm #6059 Release 5.4 update GDCM (thewtex) — addresses CVE-2026-3650 security issue
• vtk field for release #4859 BUG: VTKPolyDataMeshIO FIELD data support (thewtex) — rebased, code cleaned up
• BUG: Backport null checks after ReadHeader in IPLCommonImageIO #6064 BUG: Backport null checks after ReadHeader in IPLCommonImageIO (Tier 1)
• BUG: Backport value-initialize singleton instances #6065 BUG: Backport value-initialize singleton instances (Tier 1)
• BUG: Backport ImageAdaptor::ComputeOffset for ImageRegionIterator #6066 BUG: Backport ImageAdaptor::ComputeOffset for ImageRegionIterator (Tier 2)
• BUG: Backport zero-check guard in CumulativeGaussianCostFunction #6067 BUG: Backport zero-check guard in CumulativeGaussianCostFunction (Tier 1)
• COMP: Backport IO modules publicly depend on ImageIOBase #6068 COMP: Backport IO modules publicly depend on ImageIOBase (Tier 3) — closed; correctness fix without reported breakage, out of scope for patch release

Already merged to release-5.4

• DOC: Sync spell-check dictionary with main branch #6056 DOC: Sync spell-check dictionary with main branch
• BUG: Backport BresenhamLine integer-only algorithm and double precision fix #6054 BUG: Backport BresenhamLine integer-only algorithm and double precision fix
• COMP: Update retired windows-2019 CI runner to windows-2022 #6053 COMP: Update retired windows-2019 CI runner to windows-2022
• BUG: Backport Voronoi infinite loop fix to release-5.4 #6052 BUG: Backport Voronoi infinite loop fix
• ENH: Backport #6027 — comprehensive tests for itk.Image buffer protocol and lifetime #6043 ENH: Backport comprehensive tests for `itk.Image` buffer protocol and lifetime
• ENH: Backport #6026 — PEP 688 buffer protocol and np.asarray() lifetime safety #6042 ENH: Backport PEP 688 buffer protocol and `np.asarray()` lifetime safety
• COMP: Move inline = default destructors to .cxx for 30 exported classes #6041 COMP: Move inline `= default` destructors to `.cxx` for 30 exported classes
• ENH: Add ITK_PYTHON_RELEASE_GIL option and SWIG -threads flag #6022 ENH: Add `ITK_PYTHON_RELEASE_GIL` option and SWIG `-threads` flag
• Backport #6007 For FFTW feature selections to release-5.4 #6025 Backport FFTW feature selections from PERF: Use ABI-guaranteed SIMD baselines for redistribution-safe FFTW builds #6007 (closed)

Tier 1 — Critical bug fixes

• `0eb1c42d` BUG: Add null checks after ReadHeader in IPLCommonImageIO → BUG: Backport null checks after ReadHeader in IPLCommonImageIO #6064
• `2f37d7a3` BUG: Value-initialize singleton instances → BUG: Backport value-initialize singleton instances #6065
• `d7845fee` BUG: Reorder zero-check guard in CumulativeGaussianCostFunction → BUG: Backport zero-check guard in CumulativeGaussianCostFunction #6067
• RECOMMEND REJECT `2eb511f4` BUG: Fix TIFF palette allocation — cherry-pick conflicts with release-5.4 style divergence in itkTIFFImageIO.cxx; manual adaptation required
• RECOMMEND REJECT `381bafa4` + `3fe861f0` BUG: Fix Math::Absolute — GTest file deleted on release-5.4, itkMath.h heavily refactored; high conflict risk

Tier 2 — High-value fixes

• `1e3a8833` BUG: Add ImageAdaptor::ComputeOffset → BUG: Backport ImageAdaptor::ComputeOffset for ImageRegionIterator #6066 (test adapted for release-5.4: no CTAD, no MakeIndexRange)
• RECOMMEND REJECT `c3becd3a` BUG: QuadEdgeMesh past-the-end pointer — cherry-pick conflicts with test file refactoring on main

Tier 3 — Build fixes

• REJECT `12be7405` COMP: VTKImageIO publicly depends on ImageIOBase → COMP: Backport IO modules publicly depend on ImageIOBase #6068 (closed) — correctness fix, no reported downstream breakage on release-5.4
• `3b3c1e15` COMP: Add missing typename in GPUDemonsRegistrationFunction — already present on release-5.4
• RECOMMEND REJECT `bfc8e07d` COMP: Promote ITK header paths for name mangling expat.h — rejected previously
• RECOMMEND REJECT `fc45cd9b` + `1d0305e7` COMP: Fix Python3::Module target not found on Windows — needs investigation; 2-commit dependency chain touching CMake infrastructure

Security

• GDCM CVE-2026-3650 memory consumption issue — Release 5.4 update gdcm #6059 addresses this

Rejected for backport

• REJECT COMP: Backport IO modules publicly depend on ImageIOBase #6068 COMP: IO modules publicly depend on ImageIOBase — correctness fix, no reported breakage; fix going to main instead
• REJECT COMP: Remove hardcoded -march=corei7, -mtune=generic, and dead code #6049 COMP: Remove hardcoded `-march=corei7` — may not apply cleanly
• REJECT COMP: Fix ccache hit rate on Azure DevOps to near-zero #6048 COMP: Fix ccache hit rate — different infrastructure on release-5.4
• REJECT `bfc8e07d` COMP: Promote ITK header paths for expat.h — previously rejected

---

Methodology: Compared `upstream/release-5.4..upstream/main` (2450 commits: 164 BUG, 232 COMP, 39 PERF). Filtered to commits after 2025-12-01 with ≤3 files changed for minimal backport risk. Excluded test-only and STYLE changes.

[blowekamp]

This is in accurate regarding GDCM. Regarding CVE-2026-3650 there appears to be no address-able bug report describing when or where the but occurs. There are have also been several other CVE type bug that have been patched to the master branch.

Due to changes in main with removal of openjpeg2000 in gdcm, there are some challenges in updating the third party library. We have typically not updated the third party libraries in patch releases.

[hjmjohnson]

#6072 fixes two DCMTK issues blocking external module builds (confirmed in ITKIOTransformDCMTK#17):

1. ijg12/include exported in INTERFACE_INCLUDE_DIRECTORIES but path doesn't exist (Linux)
2. MSVC __cplusplus == 199711L triggers DCMTK osconfig.h #error even with C++17 (Windows)

Branch: hjmjohnson:fix-dcmtk-external-module-compat targeting release-5.4.