gpujs/gpu.js 2.19.6

on GitHub

Maintenance release. Includes everything from 2.19.5, which was tagged but never published to npm — install this one.

Changed

• gl-wiretap is vendored into src/vendor/gl-wiretap.js, with its unused filesystem-writing codegen removed (from 2.19.5).

  gl-wiretap is the recording proxy behind kernel.toString(). It also carried an opt-in debug feature that emits, as text, a line reading require('fs').writeFileSync('./<name>.ppm', ...). gpu.js never enabled it, and the string was only ever generated, never executed — but static analysis of a minified bundle cannot easily tell those apart, so it produced a critical-severity supply-chain alert against dist/gpu-browser-core.min.js. The vendored copy is byte-identical to upstream 0.6.2 apart from 17 deleted lines; the file header documents the rationale, the report, the removals and the MIT licence.

• Requires gpu-mock.js ^1.4.1, which marks its gpu.js peer dependency optional. It was only ever needed for types, but as a hard peer it made npm install a second, redundant copy of gpu.js into consumers' trees.

Together these remove two packages from a default install, and gl-wiretap no longer appears anywhere in the dependency tree.

No API or behaviour changes; the 150 assertions covering kernel.toString() are unaffected.

Installing

npm install gpu.js@2.19.6