@zip.js/zip.js 2.18.2 on Node.js NPM

What's Changed in v2.18.2

With checkOverlappingEntry set, a data descriptor whose CRC-32 disagrees with the central directory, a corrupt CRC-32 for instance, is now reported in localDirectory.dataDescriptor with its own fields, its CRC-32 differing from entry.crc32 as LocalDataDescriptor#crc32 documents. Until now the signed layout was kept only when its CRC-32 and sizes agreed with the central directory, since 2.18.1 among 4- or 8-byte sizes, and otherwise the record was read at the width the Zip64 extra field of either record announces without the signature, i.e. at a layout known not to match, so a signed descriptor with a corrupt CRC-32 came back with signature false, the signature bytes as crc32 and its sizes shifted by four bytes. The layout is now the one whose sizes agree with the central directory, its CRC-32 breaking ties when the central directory stores one; when no layout agrees, the record is read at the announced width as before, with the signature when it starts with one. The tie-break applies to AES entries that store a CRC-32 (AE-1, what WinZip writes for most files) like to any other entry; the CRC-32 of an AES entry used to be ignored. Reading the data of the entry is unchanged, and reading without checkOverlappingEntry never consulted the descriptor

The remarks of LocalDataDescriptor#signature and LocalDataDescriptor#zip64 describe how the layout is chosen

The data descriptor width test now reads a signed descriptor whose CRC-32 alone is corrupt and one whose compressed size is corrupt, and a new test writes an AE-2 entry with a signed data descriptor, patches it into an AE-1 entry with a disagreeing and then an agreeing descriptor CRC-32, and checks the layout reported for each and for the AE-2 entry

Full Changelog: v2.18.1...v2.18.2

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com