build(deps-dev): bump @zip.js/zip.js from 2.8.34 to 2.8.39 - #63260

Sourced from @​zip.js/zip.js's releases.

v2.8.39

What's Changed in v2.8.39

Bug fixes

• Reading split zip files and ZipCrypto-encrypted entries no longer depends on Array.prototype.at, which was raising the minimum supported versions for these features to Chrome 92, Firefox 90 and Safari 15.4

Full Changelog: gildas-lormeau/zip.js@v2.8.38...v2.8.39

v2.8.38

What's Changed in v2.8.38

This release makes zip.js resilient to environments without "deflate-raw" support in Compression Streams and to web workers failing silently (e.g. in browser extensions), detects archives with an encrypted central directory, and improves the fidelity of written zip files with other tools.

New features

• New workerStartupTimeout option in configure(): if a newly created web worker does not respond within this delay (5 seconds by default), it is terminated and the task runs inline transparently. This recovers from workers failing silently without any error event, e.g. worker scripts blocked by the Content Security Policy. Error events raised by workers which have never responded now also trigger the inline fallback instead of making the task fail. As part of this change, streams are only transferred to workers which have proven responsive, workers post a ready message as soon as their script is loaded, and terminateWorkers() re-enables the detection of web worker support
• New ERR_ENCRYPTED_CENTRAL_DIRECTORY error: ZipReader now detects archives with an encrypted central directory (PKWARE SES, e.g. produced by SecureZIP with filename encryption enabled) via the zip64 end of central directory record or the archive extra data record, and throws a clear error instead of failing with a misleading one
• Entries encrypted with the strong encryption feature of PKWARE (bit 6 of the general purpose bit flag) are now rejected with ERR_UNSUPPORTED_ENCRYPTION instead of ERR_INVALID_PASSWORD when reading

Bug fixes

• The automatic fallback on the embedded deflate/inflate implementation did not work when Compression Streams were unavailable or did not support the "deflate-raw" format (e.g. Chromium <= 102, Firefox <= 112, older versions of Node.js), unless useCompressionStream was set to false (#669). The WebAssembly module is now initialized when needed, and its initialization is skipped for entries which do not need it (stored entries and entries using a custom codec)
• Explicitly passed externalFileAttributes values are now written verbatim, including 0 on directory entries. The msDosCompatible and unix mode options (unixMode, setuid, setgid, sticky) now only override the bits they represent and preserve the other bits (bits 8 to 15 of the DOS attributes were previously dropped when a unix mode was recomposed)

Behavior changes

• Last modification dates with an odd number of seconds are now rounded up to the next even second in the DOS date/time fields instead of being truncated, consistently with Info-ZIP, 7-Zip, ditto and Windows. The extended timestamp and NTFS extra fields still store the exact date

Full Changelog: gildas-lormeau/zip.js@v2.8.37...v2.8.38

v2.8.37

What's Changed in v2.8.37

This release adds support for third-party csutom compression codecs such as Zstandard, reduces the size of written zip files by storing the NTFS extra field only when necessary, and fixes several issues found by @​danny0838.

New features

• New registerCodec(definition) and unregisterCodec(compressionMethod) APIs to plug custom compression methods into ZipWriter and ZipReader. A CodecDefinition associates a compression method ID and format name with CompressionStream/DecompressionStream classes, provided directly or lazy-loaded in workers via codecURI, with an optional versionNeeded. This enables reading and writing entries compressed with Zstandard (method 93), for example with the fzstd library. New errors: ERR_INVALID_CODEC_DEFINITION, ERR_RESERVED_COMPRESSION_METHOD, ERR_INVALID_CODEC_MODULE
• New ntfsTimestamp option (#666): the NTFS extra field is now written only when it preserves information the extended timestamp extra field cannot represent, i.e. a last modification date outside its supported range or explicit lastAccessDate/creationDate values. This saves 72 bytes per entry in the common case. Set it to true to always write the field (previous behavior) or false to never write it

Bug fixes

• Compressing an empty file with a non-default level produced an invalid entry (compressedSize equal to 0) with the "native" variant using the JavaScript port of zlib (#667)
• The maximum last modification date when extendedTimestamp is disabled is now clamped to 2107-12-31 23:59:58 instead of 2107-12-31 00:00:00, and the documentation no longer mentions the nonexistent date "November 31, 2107" (#665)
• Entries with a malformed AES encryption strength (outside 1–3) are now rejected when reading instead of only when the strength is missing
• Trailing junk after the compressed data is now ignored when decompressing with the JavaScript port of zlib, consistently with the native implementations

Behavior changes

... (truncated)

• 68b6623 bump up version
• 318283c avoid array at calls to support older browsers
• bff178c move "Bundle size" section into the documentation
• baaddb7 bump up version
• cc7c9ce update doc
• 6a2b06e fall back to inline codecs when web workers fail silently
• ebff21a simplify compression stream fallback and skip zlib init when unused
• e19f11e fix typo
• 0d3a5f6 initialize zlib module when deflate-raw is not supported
• 2a4ea6f add securezip fixtures and strong encryption detection
• Additional commits viewable in compare view