Skip to content

2.3.3 Patch - #9150

Merged
ksen0 merged 10 commits into
stablefrom
233
Sep 7, 2026
Merged

2.3.3 Patch#9150
ksen0 merged 10 commits into
stablefrom
233

Conversation

@ksen0

@ksen0 ksen0 commented Sep 7, 2026

Copy link
Copy Markdown
Member

Release notes draft:

This patch release includes a security hardening measure, a couple of bugfixes, and documentation updates.

In #9145 @limzykenneth introduces MAX_GIF_PIXELS, a static property that defines how large, in total pixels, a GIF image is allowed to be loaded into a p5 sketch. The default value is 16,000,000. This means an image's width multiplied by its height must not exceed that value. The property can be set higher if needed. This limitation prevents a GIF with a very large canvas from taking up a lot of browser memory ("decompression bomb"). This patch addresses a security vulnerability report by @slash-init, thanks for reporting! Security vulnerabilities can be reported according to the SECURITY.md policy.

In #9006 @roymacdonald spotted and patched a typo in quaternion multiplication, adding tests as well. In #9039 @xdroberto fixed a Friendly Error System (FES) parameter validation bug that @TakagiHitoshi spotted.

Finally, in #9118 @ksen0 added initial documentation of p5's new Decorators API. This API is mainly aimed at addon authors, but is also used throughout the p5.js library code. In programming, a decorator helps to reduce duplicated code. In p5.js, decorators are applied using p5.registerDecoration(pattern, decorator). They have been supported since version 2.3.0, and follow the TC39 proposal as closely as possible. The new contributor guide is for p5.js code contributors who would like to learn when to use a decorator, and how.

Work continues (in the main branch) toward 2.4, but this atomic patch makes recent security updates and bugfixes available sooner, following our recent approach to patch releases.

🎉 Thanks to all contributors & stewards!

Full Changelog: v2.3.2...v2.3.3

limzykenneth and others added 10 commits September 7, 2026 17:51
Added guide on using decorators in p5.js
Added instructions for using @Private and @internal tags in docstrings.
Co-authored-by: Kenneth Lim <limzy.kenneth@gmail.com>
Co-authored-by: Kenneth Lim <limzy.kenneth@gmail.com>
…/max()

The runtime implementation of min() and max() is variadic, but their
documented overloads only declared (n0, n1), so the parameter validator
rejected calls like min(1, 2, 3, 4). Add a {...Number} rest parameter to
the two-number overload of both functions (same pattern as createVector)
and update parameterData.json accordingly.

Calls with fewer than two number arguments still fail validation with
the same friendly error as before, and the single-array overload is
unchanged.
@ksen0
ksen0 marked this pull request as ready for review September 7, 2026 15:54
@ksen0
ksen0 merged commit a2e8cb2 into stable Sep 7, 2026
2 of 3 checks passed
@ksen0
ksen0 deleted the 233 branch September 7, 2026 16:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants