chore(deps-dev): bump @zip.js/zip.js from 2.8.26 to 2.8.33

[dependabot]

Bumps @zip.js/zip.js from 2.8.26 to 2.8.33.

Release notes

Sourced from @​zip.js/zip.js's releases.

v2.8.33

Performance

• Updated the JavaScript zlib streams module.

v2.8.32

New Features

• Added createBlobTempStream, a ready-made createTempStream factory that spills the data of buffered entries into a Blob instead of keeping it in memory. Memory is bounded in Chromium browsers; in other engines and non-browser runtimes the Blob is held in memory, so createOPFSTempStream or a file-backed implementation is preferable there.
• Added createSyncAccessHandleTempStream, an OPFS-backed createTempStream factory built on FileSystemSyncAccessHandle. It offers the same options and bounded-memory profile as createOPFSTempStream but writes roughly 2.5× faster in Chromium and Firefox and reads back several times faster in Firefox and Safari, making disk-backed staging nearly as fast as the in-memory default (worker-only variant).

Bug Fixes

• Codec worker now copies chunks that do not own their underlying buffer before transferring them, preventing data corruption when a chunk's ArrayBuffer is shared or externally owned.

v2.8.31

New features

• Accept a non-constructable reader (a factory function, not only a Reader class) as the Reader of a ZipFileEntry/ZipDirectoryEntry; the reader is now invoked with or without new depending on whether it exposes a prototype.
• Export the ERR_ITERATOR_COMPLETED_TOO_SOON and ERR_WRITER_NOT_INITIALIZED error constants.

Bug fixes

• Add a dedicated index.d.cts so TypeScript resolves the correct types for the CommonJS entry point instead of falling back to the ESM declarations.
• Fix invalid entries in the MIME type table: drop the bogus x-font/pcf.Z and duplicate video/avif entries, correct the mis-keyed application/x-ms-installer (msi), and map image/avif to both avif and avifs.
• Align the JavaScript zlib module with the windowBits: -16 raw-stream convention.

Performance

• Build the MIME type map lazily from a compact JSON payload, so the table is only parsed when a MIME type is actually requested.
• Shrink the WebAssembly zlib module by ~8 KB (~16%) by merging the deflate64 path into the inflate code and generating the deflate trees at runtime.
• Reduce bundle size by mangling internal property names and shipping inline worker payloads deflate-compressed.

v2.8.30

New features

• Add the strictness option ("strict" | "balanced" | "tolerant", default "balanced") and maxAppendedDataSize option to ZipReader, controlling how appended data, prepended stubs, and ambiguous end-of-central-directory records are handled. checkAmbiguity: true is now an alias for "strict".
• Add createOPFSTempStream() and the createTempStream writer option to spill large buffered entries to the OPFS instead of memory, with an optional dispose() hook released on every exit path.
• Add FS#exportFileSystemHandle() and ZipDirectoryEntry#exportFileSystemHandle() to write an entry tree out to a FileSystemDirectoryHandle.

Security: End-of-central-directory selection

• Select the last end-anchored record that points to a central directory instead of the first signature scanned from the end; refuse genuine comment-cloak polyglots with ERR_AMBIGUOUS_ARCHIVE.
• Rank record reachability so empty or saturated bytes at the end of a comment can no longer forge a second record; genuine empty and zip64 archives still open.
• Prefer the reconciled central-directory offset over a stale one, so an identical-layout append remnant exposes the appended directory rather than the previous one.
• Apply the reachability check to the fallback scan, so a stray signature in appended data no longer hijacks recovery under tolerant. Security
• Bound the reachability probes to prevent a comment stuffed with unreachable records from amplifying into thousands of (potentially remote) reads on random-access readers such as HttpRangeReader.

Performance

• Speed up CRC-32 with a slice-by-8 implementation and by harvesting the CRC from the gzip trailer on the native CompressionStream.

... (truncated)

Commits

• 9d3e16b bump up version
• eb0a28f bump up version
• be47350 update doc
• 430b26a update built files
• 6746a0e update zlib js module
• 014d877 copy chunks not owning their buffer before worker transfer
• 62a8c12 add sync access handle temp stream helper
• 9a17b6e warn against blob temp stream in safari
• dffd25d document per-engine blob temp stream memory behavior
• d86eba5 clarify blob temp stream memory cost outside chromium
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)