fix(deps): update dependency yazl to v3 - autoclosed - #132
Closed
renovate[bot] wants to merge 1 commit into
Closed
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the
Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
renovate
Bot
force-pushed
the
renovate/yazl-3.x
branch
from
February 3, 2026 07:24
7af52b4 to
294eee3
Compare
renovate
Bot
force-pushed
the
renovate/yazl-3.x
branch
from
March 8, 2026 12:08
294eee3 to
b81f576
Compare
renovate
Bot
force-pushed
the
renovate/yazl-3.x
branch
from
April 13, 2026 13:50
b81f576 to
50324b0
Compare
fengmk2
added a commit
that referenced
this pull request
Aug 5, 2026
….3.1 (#145) Fixes the Node 26 CI failure on master, and moves both zip dependencies to their upstream, maintained versions. ## yauzl: the Node 26 fix `@eggjs/yauzl` depends on `fd-slicer2`, whose `ReadStream` loses data when piped on Node 26. Any zip entry over the 64 KiB `highWaterMark` delivers roughly the first chunk and then stalls, with no `end`, no `error`, no `close`. That is why `zip.uncompress()` hangs until the 60s timeout on Node 26 while passing on 18 through 24. Not our code: released 2.1.1 reproduces it identically. Reported upstream at node-modules/yauzl#3. `yauzl@3.4.0` dropped `fd-slicer` entirely (only dependency is now `pend`) and does not have the bug. The fork was adopted for `decodeStrings: false` so absolute paths survive `validateFileName`. I checked that still holds against the `contain-absolute-path.zip` fixture rather than assuming: | | @eggjs/yauzl 2.11.0 | upstream 3.4.0 | | --- | --- | --- | | entries | 31 | 31 | | `fileName` is Buffer | 31 | 31 | | `externalFileAttributes` present | 31 | 31 | | files read | 21 | 21 | | leading `/` entry | preserved | preserved | Only visible difference: yauzl 3 capitalises the "End of central directory record signature not found" message, so that assertion is now case-insensitive. ## yazl 3 and the early-finalize bug it exposed yazl 3 turns "add entries after calling `end()`" from a tolerated no-op into a thrown error, and compressing trips it immediately. `_onEntryFinish()` finalizes as soon as the entry queue is momentarily empty. For zip the finish callback runs synchronously, so a caller doing: ```js zipStream.addEntry(streamA, ...); zipStream.addEntry(bufferB, ...); ``` closed the archive after the first entry, and the second threw. Tar avoids it only because its `fs.stat` makes the callback async, which lets the later entries queue first. Worth being precise about the old behaviour: **yazl 2 did not drop those entries.** I checked, and the produced archive contained all of them. So this was latent, not a live data-loss bug. Fix is to finalize on the next tick and skip it if an entry arrived meanwhile. Verified the produced archive still contains every entry. Residual limitation, unchanged in spirit from before: entries added after a longer async gap still finalize early. That is the existing drain heuristic, and giving the stream an explicit "done adding" call would be an API change worth doing separately. ## Result **171 passing on both Node 24 and Node 26**, lint and `tsc` clean. On Node 26 the zip suite finishes in ~495ms where it previously hung for 60s. The symlink cases from #140 were re-checked through the new zip path and still block. Drops `fd-slicer2` and `buffer-crc32` from the tree. Supersedes #132.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^2.4.2→^3.0.0Release Notes
thejoshwolfe/yazl (yazl)
v3.3.1Compare Source
v3.3.0Compare Source
v3.2.1Compare Source
v3.2.0Compare Source
v3.1.0Compare Source
v3.0.1Compare Source
v3.0.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.