Zip.js Files

What's Changed in v2.14.1

New features

• AES encryption and decryption run faster on every build. The JavaScript engine unrolls the AES rounds and the SHA-1 steps: a stored AES-256 entry goes from 91 to 114 MB/s on Node.js, from 55 to 68 MB/s in Firefox and from 77 to 100 MB/s in Chrome. The WebAssembly builds ship zlib-streams 1.2.1, whose AES-CTR/HMAC-SHA1 kernel got the same treatment from @xqdoo00o: 111 to 131 MB/s on Node.js, 87 to 96 MB/s in Firefox and 99 to 118 MB/s in Chrome. The default bundle grows by 3.5 KB gzipped, the native build by 1.5 KB and the core build by 1 KB

Bug fixes

• checkOverlappingEntry compares the range of an entry with its two neighbours by offset instead of with every entry read before it, so reading an archive with the check on is no longer quadratic in its entry count: 16,000 entries take 75 ms instead of 551 ms. The check is meant for untrusted archives, where the entry count is the attacker's choice
• checkOverlappingEntryOnly no longer opens the entry data. On HttpRangeReader it issued a range request for the whole compressed payload of every entry it checked, and never read the response
• Every terminateWorkers() call made while a codec runs is resolved when the codec ends. A second call on the same busy codec used to replace the resolver of the first one, so the first promise never settled, and the WebAssembly builds have awaited it since 2.14.0
• The WebAssembly codec wrapper copies each produced chunk straight out of the module memory instead of through a 64 KB staging buffer allocated per stream

Documentation

• BENCHMARKS.md is rewritten from measurements on 2.14.0: every table names the codec each library runs, the zip.js rows cover CompressionStream, the WebAssembly zlib and the pure-JavaScript port, a runtime harness compares Node.js, Bun and Deno, jszip streams in the disk-to-disk comparison, and the 7-Zip and library-picking sections are gone
• The encryption tables are re-measured with the new engines, and the decompression section explains the memory gap between the backends on 5,000 small entries: the three zip.js rows allocate the same 800 MB of stream objects, and the higher peaks of the WebAssembly and pure-JavaScript rows come from V8's incremental marking on a codec running on the JavaScript thread

Tests and continuous integration

• The three fixes are pinned: the overlap-only check is counted in range requests, the overlap check reads adjacent entries out of order and twice, and two terminations race a running codec. tests/README.md gains a fifth trap, the Promise.race timer Deno's sanitizer reports as a leak

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.14.0...v2.14.1

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com