Patch releases rarely deserve a write-up. p5.js 2.3.3, published September 7, 2026, does — partly because it closes a real security hole in a library that a lot of people point at untrusted images, and partly because it fixes a piece of 3D math that had been quietly wrong.
The GIF cap
The headline change is a new static property, MAX_GIF_PIXELS, introduced by maintainer @limzykenneth. It defines the maximum total pixel count — width × height — that a GIF is allowed to have when loaded into a sketch. The default is 16,000,000, and it can be raised if you genuinely need to.
The attack it blocks is a decompression bomb: a GIF whose compressed file is trivially small but whose decoded canvas is enormous, so that decoding it eats browser memory until the tab dies. It’s a classic image-format problem and it applies to p5 specifically because p5 sketches are so often built to accept whatever image a visitor drags in. The report came from @slash-init through the project’s SECURITY.md disclosure process.
If your sketch loads only your own assets, this changes nothing for you. If your sketch has an upload box, a URL field, or anything a stranger can point at it, this is the release you want.
The quaternion typo
Tucked into the same release: @roymacdonald found and patched a typo in quaternion multiplication, and added tests alongside it.
This is the kind of bug that produces work rather than errors. Quaternions drive rotation in p5’s WebGL mode; an incorrect multiply doesn’t throw, it just makes rotations compose slightly wrong, in a way that looks like a mistake in your own sketch. Anyone who fought with unexplained rotational drift in p5 3D work over the last while may want to re-run it.
Also fixed: a Friendly Error System parameter-validation bug spotted by @TakagiHitoshi and patched by @xdroberto.
Decorators, finally explained
The other substantial item is documentation. @ksen0 added the first proper guide to p5’s Decorators API, which has existed since 2.3.0 but until now was a thing you learned by reading library source.
Decorators in p5 are applied with p5.registerDecoration(pattern, decorator) and follow the TC39 decorators proposal as closely as the maintainers could manage. They exist to remove duplicated code — p5 uses them internally throughout — and they are aimed primarily at addon authors, which is the population most likely to have been blocked by the absence of docs.
If you maintain a p5 library, this is the release that tells you how the mechanism you’ve been reverse-engineering is supposed to work.
Getting it
<script src="https://cdn.jsdelivr.net/npm/p5@2.3.3/lib/p5.js"></script>
<!-- Optional, for the WebGPU renderer -->
<script src="https://cdn.jsdelivr.net/npm/p5@2.3.3/lib/p5.webgpu.js"></script>
Work on 2.4 continues on main; the maintainers cut 2.3.3 as an atomic patch specifically to get the security fix out rather than waiting for the next minor. That is the right instinct, and it’s worth noting that a volunteer-run creative-coding library now has a coordinated disclosure process at all.