# JSZip: what changed from 2 to 3

- Product: JSZip (https://whatsnew.fyi/product/jszip)
- Vendor: Stuart Knightley
- Range: changelog entries numbered after 2.7.0 up to and including 3.10.1, stable releases only
- Entries below: 13 releases (newest first)
- Resolved: 2 is 2.7.0 and 3 is 3.10.1, the newest stable release of each major we track
- Carrying security changes: 1 · CVEs mentioned: 0 · Mentioning breaking changes: 0 · Removing or deprecating something: 0
- Page: https://whatsnew.fyi/product/jszip/compare/2...3

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (22 changes, grouped by kind)

### Added

#### 3.10.1 (2022-08-02)

- Expose OnUpdateCallback type

#### 3.9.0 (2022-04-05)

- Add types for generateInternalStream

#### 3.5.0 (2020-06-14)

- Add string output type to TypeScript definitions

#### 3.4.0 (2020-04-19)

- Add TypeScript type definitions

### Changed

#### 3.10.1 (2022-08-02)

- Consolidate metadata types
- Use const instead of var in README examples
- Switch manual download link to HTTPS

#### 3.10.0 (2022-05-20)

- Replace setimmediate dependency with a more efficient one
- Update types of currentFile metadata to include null

#### 3.9.0 (2022-04-05)

- Update types JSZip#loadAsync to accept a promise for data and remove arguments from new JSZip()
- Update types for compressionOptions to JSZipFileOptions and JSZipGeneratorOptions

#### 3.7.0 (2021-07-23)

- Code using prototype methods on the files property of a zip object, such as zip.files.toString(), may break

#### 3.5.0 (2020-06-14)

- Add null to return types of functions in TypeScript definitions that may return null

#### 3.3.0 (2020-04-01)

- Change browser module resolution to support Angular packager

### Fixed

#### 3.7.1 (2021-08-05)

- Build of dist files to include changes from 3.7.0

#### 3.7.0 (2021-07-23)

- Use a null prototype object for the files property to prevent files in the zip from overriding object methods

#### 3.6.0 (2021-02-10)

- redirect main to dist on browsers
- duplicate require DataLengthProbe, utils
- small error in read_zip.md

#### 3.5.0 (2020-06-14)

- Fix 'End of data reached' error when file extra field is invalid
- Correct nodeStream's type in TypeScript definitions

### Security

#### 3.8.0 (2022-03-30)

- Sanitize filenames when files are loaded with loadAsync to avoid zip slip attacks, with the original filename available on each zip entry as unsafeOriginalName

_3 releases carry no categorized changes yet: 3.9.1, 3.2.2, 3.2.1._

## Release notes

### 3.10.1

- Date: 2022-08-02
- Version: 3.10.1
- Original notes: https://www.npmjs.com/package/jszip/v/3.10.1
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.10.1

- **added** — Expose OnUpdateCallback type
- **changed** — Consolidate metadata types
- **changed** — Use const instead of var in README examples
- **changed** — Switch manual download link to HTTPS

- Add sponsorship files.
    + If you appreciate the time spent maintaining JSZip then I would really appreciate [your sponsorship](https://github.com/sponsors/Stuk).
- Consolidate metadata types and expose OnUpdateCallback [#851](https://github.com/Stuk/jszip/pull/851) and [#852](https://github.com/Stuk/jszip/pull/852)
- use `const` instead `var` in example from README.markdown [#828](https://github.com/Stuk/jszip/pull/828)
- Switch manual download link to HTTPS [#839](https://github.com/Stuk/jszip/pull/839)

Internals:

- Replace jshint with eslint [#842](https://github.com/Stuk/jszip/pull/842)
- Add performance tests [#834](https://github.com/Stuk/jszip/pull/834)

### 3.10.0

- Date: 2022-05-20
- Version: 3.10.0
- Original notes: https://www.npmjs.com/package/jszip/v/3.10.0
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.10.0

- **changed** — Replace setimmediate dependency with a more efficient one
- **changed** — Update types of currentFile metadata to include null

- Change setimmediate dependency to more efficient one. Fixes https://github.com/Stuk/jszip/issues/617 (see [#829](https://github.com/Stuk/jszip/pull/829))
- Update types of `currentFile` metadata to include `null` (see [#826](https://github.com/Stuk/jszip/pull/826))

### 3.9.1

- Date: 2022-04-06
- Version: 3.9.1
- Original notes: https://www.npmjs.com/package/jszip/v/3.9.1
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.9.1

- Fix recursive definition of `InputFileFormat` introduced in 3.9.0.

### 3.9.0

- Date: 2022-04-05
- Version: 3.9.0
- Original notes: https://www.npmjs.com/package/jszip/v/3.9.0
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.9.0

- **changed** — Update types JSZip#loadAsync to accept a promise for data and remove arguments from new JSZip()
- **changed** — Update types for compressionOptions to JSZipFileOptions and JSZipGeneratorOptions
- **added** — Add types for generateInternalStream

- Update types JSZip#loadAsync to accept a promise for data, and remove arguments from `new JSZip()` (see [#752](https://github.com/Stuk/jszip/pull/752))
- Update types for `compressionOptions` to JSZipFileOptions and JSZipGeneratorOptions (see [#722](https://github.com/Stuk/jszip/pull/722))
- Add types for `generateInternalStream` (see [#774](https://github.com/Stuk/jszip/pull/774))

### 3.8.0

- Date: 2022-03-30
- Version: 3.8.0
- Original notes: https://www.npmjs.com/package/jszip/v/3.8.0
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.8.0

- **security** — Sanitize filenames when files are loaded with loadAsync to avoid zip slip attacks, with the original filename available on each zip entry as unsafeOriginalName

- Santize filenames when files are loaded with `loadAsync`, to avoid ["zip slip" attacks](https://snyk.io/research/zip-slip-vulnerability). The original filename is available on each zip entry as `unsafeOriginalName`. See the [documentation](https://stuk.github.io/jszip/documentation/api_jszip/load_async.html). Many thanks to McCaulay Hudson for reporting.

### 3.7.1

- Date: 2021-08-05
- Version: 3.7.1
- Original notes: https://www.npmjs.com/package/jszip/v/3.7.1
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.7.1

- **fixed** — Build of dist files to include changes from 3.7.0

- Fix build of `dist` files.
    + Note: this version ensures the changes from 3.7.0 are actually included in the `dist` files. Thanks to Evan W for reporting.

### 3.7.0

- Date: 2021-07-23
- Version: 3.7.0
- Original notes: https://www.npmjs.com/package/jszip/v/3.7.0
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.7.0

- **fixed** — Use a null prototype object for the files property to prevent files in the zip from overriding object methods
- **changed** — Code using prototype methods on the files property of a zip object, such as zip.files.toString(), may break

- Fix: Use a null prototype object for this.files  (see [#766](https://github.com/Stuk/jszip/pull/766))
    + This change might break existing code if it uses prototype methods on the `.files` property of a zip object, for example `zip.files.toString()`. This approach is taken to prevent files in the zip overriding object methods that would exist on a normal object.

### 3.6.0

- Date: 2021-02-10
- Version: 3.6.0
- Original notes: https://www.npmjs.com/package/jszip/v/3.6.0
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.6.0

- **fixed** — redirect main to dist on browsers
- **fixed** — duplicate require DataLengthProbe, utils
- **fixed** — small error in read_zip.md

- Fix: redirect main to dist on browsers (see [#742](https://github.com/Stuk/jszip/pull/742))
- Fix duplicate require DataLengthProbe, utils (see [#734](https://github.com/Stuk/jszip/pull/734))
- Fix small error in read_zip.md (see [#703](https://github.com/Stuk/jszip/pull/703))

### 3.5.0

- Date: 2020-06-14
- Version: 3.5.0
- Original notes: https://www.npmjs.com/package/jszip/v/3.5.0
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.5.0

- **fixed** — Fix 'End of data reached' error when file extra field is invalid
- **changed** — Add null to return types of functions in TypeScript definitions that may return null
- **fixed** — Correct nodeStream's type in TypeScript definitions
- **added** — Add string output type to TypeScript definitions

- Fix 'End of data reached' error when file extra field is invalid (see [#544](https://github.com/Stuk/jszip/pull/544)).
- Typescript definitions: Add null to return types of functions that may return null (see [#669](https://github.com/Stuk/jszip/pull/669)).
- Typescript definitions: Correct nodeStream's type (see [#682](https://github.com/Stuk/jszip/pull/682))
- Typescript definitions: Add string output type (see [#666](https://github.com/Stuk/jszip/pull/666))

### 3.4.0

- Date: 2020-04-19
- Version: 3.4.0
- Original notes: https://www.npmjs.com/package/jszip/v/3.4.0
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.4.0

- **added** — Add TypeScript type definitions

- Add Typescript type definitions (see [#601](https://github.com/Stuk/jszip/pull/601)).

### 3.3.0

- Date: 2020-04-01
- Version: 3.3.0
- Original notes: https://www.npmjs.com/package/jszip/v/3.3.0
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.3.0

- **changed** — Change browser module resolution to support Angular packager

- Change browser module resolution to support Angular packager (see [#614](https://github.com/Stuk/jszip/pull/614)).

### 3.2.2

- Date: 2019-07-03
- Version: 3.2.2
- Original notes: https://www.npmjs.com/package/jszip/v/3.2.2
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.2.2

- No public changes, but a number of testing dependencies have been updated.
- Tested browsers are now: Internet Explorer 11, Chrome (most recent) and Firefox (most recent). Other browsers (specifically Safari) are still supported however testing them on Saucelabs is broken and so they were removed from the test matrix.

### 3.2.1

- Date: 2019-03-22
- Version: 3.2.1
- Original notes: https://www.npmjs.com/package/jszip/v/3.2.1
- Permalink: https://whatsnew.fyi/product/jszip/releases/3.2.1

- Corrected built dist files