Release v1.1.14#358

Merged

ormidales merged 33 commits intomainfrom

1.1.14

Mar 13, 2026

Commits on Mar 13, 2026

Initial plan
Copilot
committed
fix: pass percent-decoded URI to resolveUri callback and update JSDoc

Copilot
and
ormidales
committed
Potential fix for pull request finding

ormidales
and
Copilot
authored
Potential fix for pull request finding

ormidales
and
Copilot
authored
Merge pull request #352 from ormidales/copilot/major-fix-gltloader-uri-validation
ormidales
authored
Initial plan
Copilot
committed
fix: use FNV-1a hash as shader cache key instead of raw GLSL source

Copilot
and
ormidales
committed
Potential fix for pull request finding

ormidales
and
Copilot
authored
Merge pull request #353 from ormidales/copilot/fix-glsl-source-as-key
ormidales
authored
Initial plan
Copilot
committed
fix: enforce maxJsonBufferBytes on decoded string before JSON.parse

Copilot
and
ormidales
committed
Potential fix for pull request finding

ormidales
and
Copilot
authored
Potential fix for pull request finding

ormidales
and
Copilot
authored
Potential fix for pull request finding

ormidales
and
Copilot
authored
fix: correct test thresholds and JSDoc units for text.length*2 guard

Copilot
and
ormidales
committed
Merge pull request #354 from ormidales/copilot/fix-json-parse-unbounded-input
ormidales
authored
Initial plan
Copilot
committed
fix(csp): enforce strict-dynamic with hash; replace bare self with none where no scripts are loaded

Copilot
and
ormidales
committed
fix(csp): clarify strict-dynamic requirement in SECURITY.md; add hash-drift test for demo.html

Copilot
and
ormidales
committed
Merge pull request #355 from ormidales/copilot/fix-csp-meta-tag-issue
ormidales
authored
Initial plan
Copilot
committed
fix(ShaderCache): validate explicit key length — throw RangeError for keys > MAX_KEY_LENGTH (512)

Copilot
and
ormidales
committed
Merge pull request #356 from ormidales/copilot/patch-fix-shadercache-key-length
ormidales
authored
Initial plan
Copilot
committed
fix: add URI length cap in validateExternalUri strict mode to prevent catastrophic backtracking

Copilot
and
ormidales
committed
fix: clarify MAX_URI_LENGTH comment and include len/max in rejection error

Copilot
and
ormidales
committed
Merge pull request #357 from ormidales/copilot/patch-fix-validate-external-uri
ormidales
authored
Bump version from 1.1.13 to 1.1.14
ormidales
authored
Bump version from 1.1.13 to 1.1.14
ormidales
authored
Initial plan
Copilot
committed
fix: address review feedback for GltfLoader and ShaderCache

Copilot
and
ormidales
committed
fix: validate JSON size options, add GLB chunk bounds check, fix brittle test

Copilot
and
ormidales
committed
Merge pull request #359 from ormidales/copilot/sub-pr-358
ormidales
authored

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release v1.1.14#358

Release v1.1.14#358
ormidales merged 33 commits intomainfrom
1.1.14

Commits on Mar 13, 2026

Initial plan

fix: pass percent-decoded URI to resolveUri callback and update JSDoc

Potential fix for pull request finding

Potential fix for pull request finding

Merge pull request #352 from ormidales/copilot/major-fix-gltloader-uri-validation

Initial plan

fix: use FNV-1a hash as shader cache key instead of raw GLSL source

Potential fix for pull request finding

Merge pull request #353 from ormidales/copilot/fix-glsl-source-as-key

Initial plan

fix: enforce maxJsonBufferBytes on decoded string before JSON.parse

Potential fix for pull request finding

Potential fix for pull request finding

Potential fix for pull request finding

fix: correct test thresholds and JSDoc units for text.length*2 guard

Merge pull request #354 from ormidales/copilot/fix-json-parse-unbounded-input

Initial plan

fix(csp): enforce strict-dynamic with hash; replace bare self with none where no scripts are loaded

fix(csp): clarify strict-dynamic requirement in SECURITY.md; add hash-drift test for demo.html

Merge pull request #355 from ormidales/copilot/fix-csp-meta-tag-issue

Initial plan

fix(ShaderCache): validate explicit key length — throw RangeError for keys > MAX_KEY_LENGTH (512)

Merge pull request #356 from ormidales/copilot/patch-fix-shadercache-key-length

Initial plan

fix: add URI length cap in validateExternalUri strict mode to prevent catastrophic backtracking

fix: clarify MAX_URI_LENGTH comment and include len/max in rejection error

Merge pull request #357 from ormidales/copilot/patch-fix-validate-external-uri

Bump version from 1.1.13 to 1.1.14

Bump version from 1.1.13 to 1.1.14

Initial plan

fix: address review feedback for GltfLoader and ShaderCache

fix: validate JSON size options, add GLB chunk bounds check, fix brittle test

Merge pull request #359 from ormidales/copilot/sub-pr-358