What changed in JSZip from 2 to 3
13 releases numbered after 2.7.0 up to and including 3.10.1, stable releases only. 2.7.0 and 3.10.1 are the newest stable releases of 2 and 3 we track; this page follows them as new ones ship.
22 changes across 13 releases
Added 4
Changed 10
- Consolidate metadata types
- Use const instead of var in README examples
- Switch manual download link to HTTPS
- Replace setimmediate dependency with a more efficient one
- Update types of currentFile metadata to include null
- Update types JSZip#loadAsync to accept a promise for data and remove arguments from new JSZip()
- Update types for compressionOptions to JSZipFileOptions and JSZipGeneratorOptions
- Code using prototype methods on the files property of a zip object, such as zip.files.toString(), may break
- Add null to return types of functions in TypeScript definitions that may return null
- Change browser module resolution to support Angular packager
Fixed 7
- Build of dist files to include changes from 3.7.0
- Use a null prototype object for the files property to prevent files in the zip from overriding object methods
- redirect main to dist on browsers
- duplicate require DataLengthProbe, utils
- small error in read_zip.md
- Fix 'End of data reached' error when file extra field is invalid
- Correct nodeStream's type in TypeScript definitions
Security 1
- Sanitize filenames when files are loaded with loadAsync to avoid zip slip attacks, with the original filename available on each zip entry as unsafeOriginalName
3 releases in the range carry no categorized changes yet: 3.9.13.2.23.2.1. Their original notes, where the vendor published any, are below.
Original release notes, newest first
The list above is our reading of these notes; the originals from Stuart Knightley are here, one fold per release.
3.10.1
- Add sponsorship files.
- If you appreciate the time spent maintaining JSZip then I would really appreciate your sponsorship.
- Consolidate metadata types and expose OnUpdateCallback #851 and #852
- use
constinsteadvarin example from README.markdown #828 - Switch manual download link to HTTPS #839
Internals:
3.10.0
- Change setimmediate dependency to more efficient one. Fixes https://github.com/Stuk/jszip/issues/617 (see #829)
- Update types of
currentFilemetadata to includenull(see #826)
3.9.1
- Fix recursive definition of
InputFileFormatintroduced in 3.9.0.
3.9.0
3.8.0
- Santize filenames when files are loaded with
loadAsync, to avoid "zip slip" attacks. The original filename is available on each zip entry asunsafeOriginalName. See the documentation. Many thanks to McCaulay Hudson for reporting.
3.7.1
- Fix build of
distfiles.- Note: this version ensures the changes from 3.7.0 are actually included in the
distfiles. Thanks to Evan W for reporting.
- Note: this version ensures the changes from 3.7.0 are actually included in the
3.7.0
- Fix: Use a null prototype object for this.files (see #766)
- This change might break existing code if it uses prototype methods on the
.filesproperty of a zip object, for examplezip.files.toString(). This approach is taken to prevent files in the zip overriding object methods that would exist on a normal object.
- This change might break existing code if it uses prototype methods on the
3.6.0
3.5.0
3.4.0
- Add Typescript type definitions (see #601).
3.3.0
- Change browser module resolution to support Angular packager (see #614).
3.2.2
- No public changes, but a number of testing dependencies have been updated.
- Tested browsers are now: Internet Explorer 11, Chrome (most recent) and Firefox (most recent). Other browsers (specifically Safari) are still supported however testing them on Saucelabs is broken and so they were removed from the test matrix.
3.2.1
- Corrected built dist files