Zip.js Files

What's Changed in v2.14.0

New features

• AES encryption and decryption run 3.5× faster on every build. sjcl is replaced by a small AES-CTR/HMAC-SHA1 engine working on typed arrays and fed whole chunks instead of 16 bytes at a time: a stored AES-256 entry goes from 26 to 91 MB/s on Node.js, from 17 to 55 MB/s in Firefox and from 22 to 77 MB/s in Chrome
• The WebAssembly builds run that engine as a kernel linked into the module they already load, which brings Firefox to 87 MB/s, Chrome to 99 MB/s and Node.js to 111 MB/s. The JavaScript engine stays in the bundle and takes over whenever the module cannot load, e.g. under a Content Security Policy without 'wasm-unsafe-eval', so nothing that encrypted before stops encrypting. The default bundle grows by 2 KB gzipped; the native and core builds carry the JavaScript engine only

Bug fixes

• terminateWorkers() now waits for the codecs running without a web worker, which is what useWebWorkers: false and every worker fallback give. It used to resolve while such a codec was still running, so the WebAssembly builds reset the module underneath it and the entry being written failed with an internal TypeError instead of completing
• A folder or empty entry of a ZipCrypto archive no longer carries a data descriptor. It holds no encrypted data, so it needs none, and a pass-through re-export of such an archive is now byte-identical to its source
• The duplicates option of the file system API applies to two directory records claiming the same node: "keep-last" replaces the record held by the node and keeps the entries already imported below it. A directory record claiming a node created implicitly by the entries below it is the record that node was missing, not a collision
• HttpReader and HttpRangeReader with combineSizeEocd now fetch, with the request that gives the size, the whole tail the end of central directory scan can need, so listing the entries of an archive that carries a comment costs one request instead of falling back to more. A response covering another range than the one asked for is no longer served as if it were that range

Documentation

• The import methods of ZipFS and ZipDirectoryEntry declare the array of every ZipFileEntry and ZipDirectoryEntry the import created, the directories created for the path components included, instead of a one-element tuple
• WritableWriter#size states when it advances: the bytes of a section are added once that section is written, so an instance reading it from its own write() sees the total of the sections already finished. The instances yielded by a generator of split disks are the exception and advance on every chunk
• The duplicates option documents the one collision that also drops entries that did not collide: a file claiming a node holding a directory, where "keep-last" replaces the directory and the entries below it go with it, and "keep-first" keeps them and ignores the file
• BENCHMARKS.md gains an encryption section comparing the two engines and the previous release on Node.js, Bun, Deno, Firefox and Chrome, with the harness to reproduce it
• The CommonJS declarations are rebuilt from index.d.ts, which they had fallen behind

Tests and continuous integration

• The AES engine is pinned by the RFC 2202 and RFC 6070 vectors, cross-checked against Web Crypto where it exists, and driven through the library with sizes around every block and chunk boundary; the fallbacks to JavaScript key derivation and to the JavaScript engine are exercised, and the WebAssembly engine is checked byte for byte against the JavaScript one
• The custom engine tests fail when the engine they install is not the one used, two crypto tests no longer depend on the clock or on chance, and the Deno resource sanitizer is re-enabled on sixteen tests

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.13.1...v2.14.0