chore(deps-dev): bump @zip.js/zip.js from 2.8.26 to 2.8.31

[dependabot]

Bumps @zip.js/zip.js from 2.8.26 to 2.8.31.

Release notes

Sourced from @​zip.js/zip.js's releases.

v2.8.31

New features

• Accept a non-constructable reader (a factory function, not only a Reader class) as the Reader of a ZipFileEntry/ZipDirectoryEntry; the reader is now invoked with or without new depending on whether it exposes a prototype.
• Export the ERR_ITERATOR_COMPLETED_TOO_SOON and ERR_WRITER_NOT_INITIALIZED error constants.

Bug fixes

• Add a dedicated index.d.cts so TypeScript resolves the correct types for the CommonJS entry point instead of falling back to the ESM declarations.
• Fix invalid entries in the MIME type table: drop the bogus x-font/pcf.Z and duplicate video/avif entries, correct the mis-keyed application/x-ms-installer (msi), and map image/avif to both avif and avifs.
• Align the JavaScript zlib module with the windowBits: -16 raw-stream convention.

Performance

• Build the MIME type map lazily from a compact JSON payload, so the table is only parsed when a MIME type is actually requested.
• Shrink the WebAssembly zlib module by ~8 KB (~16%) by merging the deflate64 path into the inflate code and generating the deflate trees at runtime.
• Reduce bundle size by mangling internal property names and shipping inline worker payloads deflate-compressed.

v2.8.30

New features

• Add the strictness option ("strict" | "balanced" | "tolerant", default "balanced") and maxAppendedDataSize option to ZipReader, controlling how appended data, prepended stubs, and ambiguous end-of-central-directory records are handled. checkAmbiguity: true is now an alias for "strict".
• Add createOPFSTempStream() and the createTempStream writer option to spill large buffered entries to the OPFS instead of memory, with an optional dispose() hook released on every exit path.
• Add FS#exportFileSystemHandle() and ZipDirectoryEntry#exportFileSystemHandle() to write an entry tree out to a FileSystemDirectoryHandle.

Security: End-of-central-directory selection

• Select the last end-anchored record that points to a central directory instead of the first signature scanned from the end; refuse genuine comment-cloak polyglots with ERR_AMBIGUOUS_ARCHIVE.
• Rank record reachability so empty or saturated bytes at the end of a comment can no longer forge a second record; genuine empty and zip64 archives still open.
• Prefer the reconciled central-directory offset over a stale one, so an identical-layout append remnant exposes the appended directory rather than the previous one.
• Apply the reachability check to the fallback scan, so a stray signature in appended data no longer hijacks recovery under tolerant. Security
• Bound the reachability probes to prevent a comment stuffed with unreachable records from amplifying into thousands of (potentially remote) reads on random-access readers such as HttpRangeReader.

Performance

• Speed up CRC-32 with a slice-by-8 implementation and by harvesting the CRC from the gzip trailer on the native CompressionStream.

v2.8.29

Bug fixes

• Bounded memory when streaming large entries. The compression path now applies backpressure through the codec, pacing the input to the rate the compressor consumes it. Previously, writing a large entry could grow memory in proportion to the entry size — a 256 MB file peaked around 390 MB — because the platform's native CompressionStream does not apply writable backpressure in Node.js and Bun. Peak memory is now flat regardless of entry size (~99 MB for that same 256 MB file), with no throughput cost. (d18f4e3a)

• A provided zlib codec is no longer discarded when the WASM module is unavailable. If you supply a self-contained CompressionStreamZlib / DecompressionStreamZlib (e.g. the pure-JS port) with useCompressionStream: false and no WASM module (wasmURI: null, or a failed load), the library used to silently fall back to the native CompressionStream. Your codec is now honored; the native fallback applies only when the codec that would actually run depends on the WASM module. (a67c54e1)

Other

• Added a reproducible benchmark suite (benchmarks/) and BENCHMARKS.md comparing @zip.js/zip.js against jszip, fflate and archiver across compression, decompression and disk-to-disk streaming. (65178e72)
• Tests: the crypto error-path tests opt out of Deno's resource sanitizer, working around a Deno bug where cancelling a transferred, still-open ReadableStream leaks a MessagePort (reported upstream — denoland/deno#36015). (454f79ec)

v2.8.28

What's Changed

... (truncated)

Commits

• da7e2bd bump up vrsion
• 7ed62c8 update doc
• 7c729fa update built files
• 8ecf43b pass read window and chunkSize as createReadable args
• ca4520a update built files
• 9a47a43 update js zlib module with windowBits -16 convention
• ac42767 update built files
• 00c882e update zlib wasm module with runtime deflate trees
• 8e7296b update built files
• 891ab83 update zlib wasm module with merged deflate64 inflate
• Additional commits viewable in compare view

[AndyScherzinger]

@dependabot recreate