[stable32] build(deps-dev): bump @zip.js/zip.js from 2.8.34 to 2.8.37

[dependabot]

Bumps @zip.js/zip.js from 2.8.34 to 2.8.37.

Release notes

Sourced from @​zip.js/zip.js's releases.

v2.8.37

What's Changed in v2.8.37

This release adds support for third-party csutom compression codecs such as Zstandard, reduces the size of written zip files by storing the NTFS extra field only when necessary, and fixes several issues found by @​danny0838.

New features

• New registerCodec(definition) and unregisterCodec(compressionMethod) APIs to plug custom compression methods into ZipWriter and ZipReader. A CodecDefinition associates a compression method ID and format name with CompressionStream/DecompressionStream classes, provided directly or lazy-loaded in workers via codecURI, with an optional versionNeeded. This enables reading and writing entries compressed with Zstandard (method 93), for example with the fzstd library. New errors: ERR_INVALID_CODEC_DEFINITION, ERR_RESERVED_COMPRESSION_METHOD, ERR_INVALID_CODEC_MODULE
• New ntfsTimestamp option (#666): the NTFS extra field is now written only when it preserves information the extended timestamp extra field cannot represent, i.e. a last modification date outside its supported range or explicit lastAccessDate/creationDate values. This saves 72 bytes per entry in the common case. Set it to true to always write the field (previous behavior) or false to never write it

Bug fixes

• Compressing an empty file with a non-default level produced an invalid entry (compressedSize equal to 0) with the "native" variant using the JavaScript port of zlib (#667)
• The maximum last modification date when extendedTimestamp is disabled is now clamped to 2107-12-31 23:59:58 instead of 2107-12-31 00:00:00, and the documentation no longer mentions the nonexistent date "November 31, 2107" (#665)
• Entries with a malformed AES encryption strength (outside 1–3) are now rejected when reading instead of only when the strength is missing
• Trailing junk after the compressed data is now ignored when decompressing with the JavaScript port of zlib, consistently with the native implementations

Behavior changes

• The usdz option now stores entries uncompressed by default (unless level or compressionMethod is set explicitly) and throws the new ERR_UNSUPPORTED_ENCRYPTION_USDZ error when a password is set, in accordance with the USDZ specification which mandates zero compression and no encryption

Full Changelog: gildas-lormeau/zip.js@v2.8.36...v2.8.37

v2.8.36

Fix missing commits in v2.8.35

Full Changelog: gildas-lormeau/zip.js@v2.8.35...v2.8.36

What's Changed in v2.8.36

This release focuses on streaming I/O: readers can now hand over a native stream instead of being read chunk by chunk, which removes a copy for blobs and a whole series of HTTP requests for remote archives read with range requests. It also fixes several zip64 and split-archive issues, and replaces the hand-maintained list of property names protected from minification with a derived one checked at build time.

New features

• Reader#createReadable(options), introduced internally in 2.8.31, is now part of the documented API, with the new CreateReadableOptions type (offset, size, chunkSize). Custom readers can override it to return a stream provided natively by the underlying data source instead of relying on readUint8Array(). It also accepts a byte range, and no longer takes a diskNumberStart option: split readers now use linear disk offsets
• BlobReader now returns blob.stream(), or blob.slice(offset, end).stream() for a range, instead of reading the data in chunkSize slices through readUint8Array()
• When range requests are used, i.e. with HttpRangeReader or with the useRangeHeader and forceRangeRequests options of HttpReader, the data of an entry is now read with range requests of 16MB at most whose response bodies are streamed, instead of one range request per chunkSize bytes. Reading a 4GB entry sends 256 requests instead of 65536, and no request is ever sized after the entry. This requires fetch, the useXHR option still reads the data chunk by chunk

... (truncated)

Commits

• cb76cd0 bump up version
• 0e7bdd0 update github actions to node 24 versions
• bb1934d update markdown doc
• 6fc5ad9 update built files
• a907d66 use const
• fe6644f update markdown doc
• ee7e869 update built files
• 944a6b5 store data uncompressed and reject encryption when usdz is set
• 019496c update built files
• 6e76dab fix empty entry deflate producing invalid data (fix #667)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)