v2.8.50

What's Changed in v2.8.50

New features

• New filenameValidation option in ZipReader and getEntries(). It rejects entry names that do not map safely to a file path. It accepts "strict", "balanced" and "tolerant", and defaults to the value of the strictness option. Rejected names throw the new ERR_UNSAFE_FILENAME error, which carries the offending name in its filename property
• New normalizeFilename option in ZipReader and getEntries(). It is called with the decoded name of each entry and its result replaces that name. It runs after decoding and before validation, so repairing a name is enough to make it pass filenameValidation. Returning undefined keeps the decoded name. The filesystem API inherits the option from ZipReaderConstructorOptions
• The decodeText and encodeText options now receive the type of the text they handle, "filename" or "comment", as their last argument. Hooks declaring fewer parameters keep working
• exportFileSystemHandle() now reports what happened when an export fails. The new entryName property of EntryError holds the name of the entry that failed, relative to the exported entry. The new exportedEntryNames property lists the files that were completely written before the failure. Every other file of the export is either missing or empty, so this is the only way to tell a file the export completed from one it created but never filled
• exportFileSystemHandle() called with concurrent set to true now collects every failure instead of reporting only the first one. The other failures are listed in the new entryErrors property of EntryError. Failures raised deeper in the tree are flattened into that list
• New ERR_INVALID_LEVEL, ERR_INVALID_PASSWORD_TYPE, ERR_INVALID_STRICTNESS, ERR_INVALID_FILENAME_VALIDATION and ERR_INVALID_MAX_APPENDED_DATA_SIZE error constants

Breaking changes

• Entry names containing a .. path component, or starting with /, with a drive letter like C:, or with \\, are now rejected when reading an archive. They throw ERR_UNSAFE_FILENAME. Set filenameValidation to "tolerant" to restore the previous behavior. This default was verified against a corpus of 572 archives holding 257,333 entries. None of them was rejected, so the new default costs nothing on real archives. A backslash is never treated as a path separator. It is legal on UNIX file systems, and it also occurs as the trail byte of double-byte filenames in Shift-JIS, Big5 and GBK, where converting it would corrupt the name
• The strictness option set to "strict" now also rejects empty and . path components, e.g. a//b.txt and ./cur.txt
• Invalid option values now throw instead of falling back silently to a default. A level outside the integers 0 to 9 throws ERR_INVALID_LEVEL, and used to disable compression entirely when it was negative or not a number. A password that is not a string, or a rawPassword that is not a Uint8Array, throws ERR_INVALID_PASSWORD_TYPE. A value of another type used to produce an unencrypted archive, and a rawPassword passed as a string used to produce an archive that its equivalent password cannot open. An unknown strictness or filenameValidation throws instead of behaving as "balanced". An invalid maxAppendedDataSize throws instead of being accepted. A non-integer encryptionStrength, uid, gid or unixMode is now rejected by the guard whose message already announced it. Values meaning "no password", i.e. undefined, null, an empty string and an empty Uint8Array, keep working as before. Numeric options also keep accepting the strings that represent them, e.g. level set to "9", because form controls, query strings and environment variables all yield strings
• The filesystem API now ignores empty and . path components when importing an archive. Names such as a//b.txt and ./cur.txt no longer create entries with an empty name or named .
• When reading an entry fails, the writable of the writer is now aborted with the error instead of being closed. A custom writer used to observe a successful close although the data was truncated

Bug fixes

• Errors raised by addFileSystemHandle() and exportFileSystemHandle() are now rethrown unmodified instead of being wrapped. Their message is comparable to the exported ERR_* constants again, and their entryName property identifies the handle or the entry that failed
• exportFileSystemHandle() called with concurrent set to true now cancels the entries that have not started yet when an entry fails, instead of letting the rest of the export run to completion

Build and packaging

• Web worker support is now tree-shakable. The web worker backend was moved to a separate module which registers itself when imported. Custom builds that do not import it no longer include the web worker plumbing and run codecs inline. The standard entry points import it, so the published builds are unaffected
• The most frequently used globals are destructured in the intro of the bundles, which reduces the size of the minified builds

Full Changelog: v2.8.49...v2.8.50