Skip to content

Conversation

NateRadebaugh
Copy link

@NateRadebaugh NateRadebaugh commented May 16, 2023

I'm not 100% sure how to test this or if other files need to be updated, but getting this PR out there.

JSZip changelog:

v3.10.1 2022-08-02

  • Add sponsorship files.
    • If you appreciate the time spent maintaining JSZip then I would really appreciate your sponsorship.
  • Consolidate metadata types and expose OnUpdateCallback #851 and #852
  • use const instead var in example from README.markdown #828
  • Switch manual download link to HTTPS #839

Internals:

  • Replace jshint with eslint #842
  • Add performance tests #834

v3.10.0 2022-05-20

v3.9.1 2022-04-06

  • Fix recursive definition of InputFileFormat introduced in 3.9.0.

v3.9.0 2022-04-04

  • Update types JSZip#loadAsync to accept a promise for data, and remove arguments from new JSZip() (see #752)
  • Update types for compressionOptions to JSZipFileOptions and JSZipGeneratorOptions (see #722)
  • Add types for generateInternalStream (see #774)

v3.8.0 2022-03-30

  • Santize filenames when files are loaded with loadAsync, to avoid "zip slip" attacks. The original filename is available on each zip entry as unsafeOriginalName. See the documentation. Many thanks to McCaulay Hudson for reporting.

--

Closes #1254

gitbrent added a commit that referenced this pull request May 20, 2023
@gitbrent gitbrent added this to the 3.13.0 milestone May 20, 2023
@gitbrent
Copy link
Owner

Thanks @NateRadebaugh !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

SECURITY BUG: PptxGenJS depends on vulnerable version of jszip Extremely slow performance of generateAsync with 3.2.X JSZip versions
2 participants