Hey All, PICO-8 0.2.7 is now up on lexaloffle, Humble and itch.io. No CHIP/PocketCHIP build yet, sorry! (my last PocketCHIP died -- I'll come back to that later)

This update introduces some late additions to the API before freezing at 0.3, and improvements aimed at handheld devices. 0.2.7 also includes an important security patch for a vulnerability affecting untrusted carts running locally (see below).

RRECT

This feature was needed for Picotron but I think also feels at home in PICO-8 / Voxatron. rrect() and rrectfill() take x,y for the top left corner, a width and height of the rectangle, and a radius for the corners. When the radius is 0 (the default), rrect / rrectfill act as an alternative to rect / rectfill when it is more convenient to specify a width and height rather than x1, y1.

Outlines & Underlines

P8SCII in 0.2.7 has new commands for outlining and underlining text. To get an outline, use \^o followed by a single character for colour, and two hex characters that indicate which of the 8 neighbouring pixels to draw:

0x01    0x02    0x04
0x08     --     0x10
0x20    0x40    0x80

For example, to draw a dot with a red(8) outline of the lower neighbours (0x20+0x40+0x80) and the top left neighbour (0x1), the command would be: ?"\^o8e1."

The underline command \^u does not take any parameters; it draws a line in the foreground colour 1 pixel below the bottom of the character. See the manual for more details:
https://www.lexaloffle.com/dl/docs/pico-8_manual.html#P8SCII_Outlines

Cart Prefetching & Cache Surfing

Cartridges that are listed in SPLORE are now proactively fetched from the BBS in the background, instead of downloading a cart only once it is selected. This makes it easier to grab a bunch of cartridges from the BBS and then play them while offline. Simply list the carts you'd like to download (e.g. by scrolling through NEW and selecting [LOAD MORE]), and wait for a few seconds for them to finish downloading. There is a small colourful spinner animation in the top left corner that indicates batch downloading is in progress. It is visible when a cartridge is not selected (e.g. on the [more] or [update] menu items), which you can see in the gif below.

Prefetching can be disabled (or made more aggressive) in config.txt with:

max_prefetch_threads 0

Cartridges that are downloaded to the local cache can also be listed newest first from the local files list under [CACHE] in the root directory. In the gif, you can see prefetched cartridges showing up in the cache listing each time [REFRESH] is selected.

Note that BBS cartridges that are downloaded are never automatically deleted from the cache (they do not expire), so there is normally no need to manually download and copy cartridges if they can be found in splore (e.g. by adding them to your favourites).

Favourited cartridges in the cache do not necessarily have any metadata stored (author, full title), and show up as just the cart id. For such carts, metadata is fetched from the BBS the next time the cartridge is run while internet is available.

BBS Favourite Listings

To list cartridges that you have favourited via the website (while logged in), you can now use the search section in splore:

1. Set your favourites (or likes) to public on the settings page

2. In PICO-8, seach for: fav:username or like:username

Multicart Export Limit: 32 Cartridges

0.2.7 now allows up to 32 cartridges in a single HTML or binary export, an increase from the previous limit of 16. This is aimed at [groups of] authors who would like to release bundles of carts, and I think 32 is a cute size in that context. I've heard from several groups who are interested in creating "n-in-1 game" style collections, which PICO-8 is naturally suited for, and 16 cartridges isn't quite enough for that. I don't think I could stomache going as far as 64 though -- you'd need to start packing multiple tiny games per cart for that!

[The downside of course is that a 32 cart limit does introduce extra unwanted gravity towards Making Bigger Things. However, there have only been a handful of projects that have pushed the 16 cart limit in order to cram extra content into a single game, and I don't think any of them would have suffered from this new limit.]

Security Patch

When run un-sandboxed (i.e. as a local cart), ls() in 0.2.6b and earlier caused a buffer overrun for long input strings, allowing a hypothetical bad actor to construct an RCE attack. A proof of concept for such an attack that works under windows was posted 4 weeks ago, but the author kindly took it down soon after while I worked on this patch. In 0.2.7 I've fixed that particular case, audited the codebase for similar issues, and introduced some extra safeguards for string handling that is in code paths reachable by the userland api. I opted to release it along with 0.2.7 features to encourage as many users to update as possible.

This vulnerability does not impact cartridges that are run directly from splore or via load #foo, and I have been monitoring the BBS cartridge submissions for anything suspicious. In any case, please consider updating soon especially if you planning on running carts locally from un-trusted sources.

Changelog

v0.2.7

Added: rrect, rrectfill(x,y,w,h,corner_radius,col)
Added: ?"\^o8ff..." to print outlines (col, 2 hex values for neighbour bits)
Added: ?"\^uunderline"
Added: ?"\^;" and ?"\^," for one-off characters that respect padding
Added: browse cached carts via splore's local tab
Added: background cart downloading (any bbs cart visible in a splore list is fetched from cdn)
Added: splore: search publicly listed favourites, likes // fav:username or like:username
Added: splore: search for top-starred by time // t:month t:week t:20 for last n days, tr:2022 for time range
Added: sfx(n) returns the channel index it was played on
Added: config.txt: boot_to_splore 1 // always launch splore on startup. same as using the -splore commandline switch
Added: config.txt: accept_future 1  // allow loading cartridges created with future versions of PICO-8
Added: when multiple displays are present, fullscreen favours the display that the window is currenly inside
Changed: print"\^w\^t\^=..." draws horizontal stripes (used to be the same as \^p)
Changed: max multicart export is now 32 cartridges, max serial file size is 512k (was 16, 256k)
Changed: cartdata() can switch between up to 4 different ids per session
Changed: Mac build uses statically linked libcurl (used to make a system() call to curl for each request)
Fixed: ls(longstr) causes buffer overrun // dangerous, but doesn't apply to sandboxed (bbs) carts 
Fixed: circfill with a negative radius and inverted drawing bit set is a NOP (should fill entire screen)
Fixed: drawing filled shapes completely outside of clip rectangle sometimes crashes under web (illegal read)
Fixed: memory corruption when using remapped video memory after reboot
Fixed: ?"\^c" doesn't cost any cpu (should be same as cls())
Fixed: dset() not flushed on run() when data changes more than once in the last second
Fixed: ?"⁷s000" or ?"\as00" crashes on Mac OS X // bad assumption about null termination; explains #tomorrowswinds crash
Fixed: coresume() only returns first return value
Fixed: splore: while in fold-out cart menu, PAGEUP, PAGEDOWN, HOME, END apply to cart list instead of cart menu cursor
Fixed: merge_joysticks maps multiple players to a single controller instead of vice versa ._.
Fixed: import/drop a png: colourfitting secret colours fails when the display palette entries have any of bits 0x70 set
Fixed: katakana mode ltsu lya lyu lyo produces ッャュョ instead of っゃゅょ (also: added xtsu xya xyu xyo alternative) 
Fixed: first note of sfx 63 clobbered when previewing waveform instrument
Fixed: ctrl-c inside sfx data copies nothing when no notes are selected (should copy whole sfx as a [sfx] snippet)
Fixed: (rc3) print() with transparent colour followed by a memcpy to non-video memory area causes +0x10 on each value 
Fixed: (rc3) underline doesn't respect draw palette colour mapping
Fixed: (rc4) p8scii \^x, \^y values are clamped to 8 when drawing background (e.g. ?"\#5\^yafoo" background is too short)
Fixed: (rc4) cstore(..., "foo.p8.rom") is stored as a png named .p8.rom

Fabulous update. love the config.txt option to default to splore. Also this caching is great! Also love the new favorites and likes feature. Still trying to figure out how to manage it so that I can get quick access to my favorites. Probably use favorites for all my carts and Likes for my ultra favorites.

Time to go shave off a few tokens with rrect ;)

Thank you for the Update itself and the better Splore Cache and Fav Functions 🦍🖖🏼💋

Very cool, looking forward to using rrect.

corner radius all day!!

Thanks for an awesome update! Rrect seems like a great addition as well.

What kind of output is expected in splore when searching fav:<username>? I come up with a spinning activity icon but then no results and no error

Will this update download all carts in multi-cart games right on load or do we still need to pull those manually or have games load them?

Really great update

Awesome update!!! I still hope pico 8 will be available on iPadOS

@buckysrevenge try again now -- I fixed a server-side bug that was causing the public favourites settings flag to be ignored. You should get a list of carts that is the same as this one: https://www.lexaloffle.com/bbs/?uid=1&mode=carts&list=user_favourites#m

@aloven yeah, prefetching only applies to the listed carts so multi-cart games still need to be run while online first.

@buckysrevenge For me, it came back with my favorites list pretty quickly when I did fav:2bitchuck in Splore on my RGB30.

rrect! w and h params!!

@zep that did the trick, thanks!

Awesome to get a new update, feels like forever ago that the previous update come out. I wonder if we'll ever reach a 1.0 update...

"This feature was needed for Picotron but I think also feels at home in PICO-8 / Voxatron."

Is there finally going to be a Voxatron update?

Psyched to have more text formatting options!

Oh nice, the cartdata limit is on the number of unique ids, not the number of calls! This means you could have 4 save slots, for instance, each with their own cartdata() id, and switch between them freely. Or maybe a tool to move data between ids?

I cached a lot of carts yesterday at home, but now when I'm offline the cache is empty and I get "Could not connect to BBS". I have a lot of .p8.png files under pico-8\carts, if that is the location of cache?

I'm using 0.2.7 Arm on an RG353P. Initially WiFi was enabled but not connected here at work today but I've switched it off and get the same result.

Am I misunderstanding how this should work, or is my config wrong? I replaced all of the files with those from the zip.

First the release of debian 13 and now a Pico-8 update... Gorgeous!
Thank you very much for all your hard work.

Liked rrect and outline options! Great job.

please say the code: thanks for alarm

@zep I have been moving, and totally missed the sandbox escape that was posted to the subreddit. I’m the only mod in practice right now, and it’s gotten so large, but I can’t believe this went by my radar.

I saw the poster removed it, and since the exploit is now patched, I don’t think I need to lock or remove the thread. (You did link to it here after all). That said, if this happens in the future please give me a shout if I’m not on the ball fast enough. If you want that thread locked though, I would happy to do it but I really doubt that it would be necessary at this point.

Thank you for all the wonderful features this update, and I don’t know when you announced that 0.3 would be the API freeze, but that’s amazing news for me! The Piconomicon has been mostly on hiatus until I could be certain no more major updates would come in, and the book has reached encyclopedic proportions already, but it’s exciting to see a light at the end of the tunnel for the engine and for my own knowledge that yes, I will be able to publish it eventually.

PICO-8 has given me so much more than a way to make games, and I am ever grateful to you for its design and for the gravitational pull that attracted such a fantastic community around it.

I apologize for the joke in advance…

rrect-em? I barely know him!

Finally, I'm waitting for this update a long Time!

@zep I can't seem to see my folders in the local tab in Splore. Only the carts and the .p8 files.
Did the update remove the ability to go down into directories via Splore?

Hmm, interesting. I'm currently on version 0.2.5 and trying to figure out how to upgrade. Either way, this is an awesome update filled with many useful tools for aspiring Pico-8 devs such as myself. Looking forward to the next update!

@zep Just updated and I'm not able to see my folders in Splore (which I very heavily rely on to keep things tidy.) I'm guessing this is a bug because your prefetch example gif in this post shows a Demos folder...
(Running Windows 10 Home, 22H2)

Any chance that a pocketchip build of 0.2.7 will ever appear?
My pocketchip is still working (even if I have to try it 20 times while charging to get it to boot!!)
I would gladly try running 0.2.7 to see if it runs OK on the pocketchip.

Good Update, but any plans to complete the "login" command?

I feel like I've been out of the Pico8 ecosystem for a while. I booted up my PowKiddy360 and noticed it wanted an update of Pico8. Always great to see this great system continue to inspire and create such great games.

@zep just noticed this Pico-8 0.2.7 windows zip update but like a couple of other commenters pointed out, the local folder splore browsing seems to be broken compared to 0.2.6b and earlier behavior.

i tried deleting the W11 23h2 profile folder for pico-8 to test from scratch. ran the console install demos and games commands. folders with content are made as expected. carousel for root just shows option below labeled cache, and fails to show anything with selecting refresh. even after shutdown and reopen splore, does not show sub-folders under root as expected.

using console and cd to demos or games sub-folder then start splore, carousel shows contents of that folder, instead of starting from empty root. navigating from the sub-folder back up to root just goes back to showing empty view without sub-folders for demos or games again.

(also is there a way to get notified of just version updates? the site email subscription to threads does not seem to be specific enough for this, or i haven't found the proper thread. tricky enough to notice the kinda hidden blog link that could mention updates, only found from landing page, since it doesn't have a similar link on the navbar between bbs and superblog.)

Hello,

I have tried 0.2.7 for raspi on my PocketCHIP, and it works, but without Sound, why?
I think, it is not compiled for the PocketCHIP! But it works :-)

Now I‘am waiting for the port for the CHIP!

THX!

Greetings

Joel Kind

Oh wow, I can't believe you're still supporting the CHIP! That's amazing. I didn't even think to check.

I recently resurrected mine. The whole thing needed reflashing which isn't easy these days what with bitrot and all.

I'll update the CHIP at the weekend! Thanks @zep.

UPDATE: I updated v0.2.6b on the CHIP and it works like a dream, I managed to install Pico Valley and Undune and they both work.

Oddly, once a cart is running, the Escape key no longer brings up the pause menu that can exit the cart and drop back to the console. I don't know if this is a known issue?

Thanks once again for being an absolute boss and supporting the Chip for as long as you have.

UPDATE 2: The reason that esc doesn't work is because the keys were remapped. D'uh.