2.19.5

Maintenance release: removes a dependency and the code pattern behind a false-positive supply-chain alert.

Changed

• gl-wiretap is now vendored into src/vendor/gl-wiretap.js, and its unused filesystem-writing codegen is removed.

  gl-wiretap is the recording proxy behind kernel.toString() — it transcribes a kernel's GL calls into replayable source. It also carried an opt-in debug feature that emits, as text, a line reading require('fs').writeFileSync('./<name>.ppm', ...). gpu.js never enabled it (the branch is gated on a readPixelsFile option gpu.js does not pass) and the string was only ever generated, never executed — but static analysis of a minified bundle cannot easily tell generated code from executed code, so it produced a critical-severity alert against dist/gpu-browser-core.min.js.

  The vendored copy is byte-identical to upstream 0.6.2 apart from 17 deleted lines. The file header documents the rationale, the original report, the exact removals, the MIT licence, and the conditions under which un-vendoring would make sense. All four dist bundles are now free of the pattern.

• One fewer runtime dependency. No API or behaviour changes; the 150 assertions covering kernel.toString() are unaffected.

Installing

npm install gpu.js@2.19.5

---

Note: this version was tagged but never published to npm. Its changes ship in 2.19.6 — install that instead.