This patch release includes a security hardening measure, a couple of bugfixes, and documentation updates.
Use this version by including:
<script src="https://cdn.jsdelivr.net/npm/p5@2.3.3/lib/p5.js"></script>
<!-- Optional for WEBGPU renderer: -->
<script src="https://cdn.jsdelivr.net/npm/p5@2.3.3/lib/p5.webgpu.js"></script>In #9145 @limzykenneth introduces MAX_GIF_PIXELS, a static property that defines how large, in total pixels, a GIF image is allowed to be loaded into a p5 sketch. The default value is 16,000,000. This means an image's width multiplied by its height must not exceed that value. The property can be set higher if needed. This limitation prevents a GIF with a very large canvas from taking up a lot of browser memory ("decompression bomb"). This patch addresses a security vulnerability report by @slash-init, thanks for reporting! Security vulnerabilities can be reported according to the SECURITY.md policy.
In #9006 @roymacdonald spotted and patched a typo in quaternion multiplication, adding tests as well. In #9039 @xdroberto fixed a Friendly Error System (FES) parameter validation bug that @TakagiHitoshi spotted.
Finally, in #9118 @ksen0 added initial documentation of p5's new Decorators API. This API is mainly aimed at addon authors, but is also used throughout the p5.js library code. In programming, a decorator helps to reduce duplicated code. In p5.js, decorators are applied using p5.registerDecoration(pattern, decorator). They have been supported since version 2.3.0, and follow the TC39 proposal as closely as possible. The new contributor guide is for p5.js code contributors who would like to learn when to use a decorator, and how.
Work continues (in the main branch) toward 2.4, but this atomic patch makes recent security updates and bugfixes available sooner, following our recent approach to patch releases.
🎉 Thanks to all contributors & stewards!
Full Changelog: v2.3.2...v2.3.3