• #11582 33c81f991f1013653444d6819107b2b356563f57 Thanks @shadcn! - add private repository support to GitHub registries via GitHub CLI credentials or GH_TOKEN.

• #11248 b4f2023b1d5c733db67d4e90eb9485a95c5ed480 Thanks @rbadillap! - add npx shadcn migrate base-color to switch a project's base color.

Full Changelog: https://github.com/zumerlab/snapdom/compare/v2.24.3...v2.24.7

• New ERR_UNDEFINED_COMPRESSION_METHOD error constant

The two passThrough rules below change what the option accepts. Code that copies entries between archives by passing the compression method of the source entry, which is what the filesystem API does, is unaffected.

• Writing an entry with the passThrough option now requires the compressionMethod option, and throws the new ERR_UNDEFINED_COMPRESSION_METHOD when it is missing. The data is copied as-is, so that option selects no codec, it declares how the data is already compressed and is written into the headers of the entry verbatim. It used to fall back to Deflate whatever the data was, so copying a stored entry without setting it produced an archive announcing Deflate over stored bytes, which no reader can decompress. Copying an entry read with ZipReader is a matter of passing its compressionMethod along. The entries with no content, e.g. the directories, ignore the option, as they ignore passThrough itself
• The level option is now ignored for the entries written with passThrough. The data is never compressed, so the option describes nothing, and yet level set to 0 used to select the compression method written in the headers, stored instead of Deflate, and any level used to set the level bits of the general purpose bit flag. Set compressionMethod to declare how the data is compressed. level keeps applying to the other entries of the same archive, so exporting a filesystem with level set and passThrough set in the reader options still compresses the entries that were added to it and copies the entries that came from a zip file
• The decryptCentralDirectory callback now receives the encrypted central directory alone. It used to be given the whole declared range of the directory, which also holds the digital signature record when the archive is signed, so the callback was handed bytes it cannot decrypt. The length is taken from the encryption header of the zip64 end of central directory record when it declares one, and falls back to the declared length of the directory. The callback has been given the whole range since it was introduced in v2.8.47

• Reading an archive whose central directory is encrypted no longer moves the directory somewhere else. The reader checks that the offset declared in the end of central directory record points at a central file header, and an encrypted directory carries no such signature, so the check failed and the offset was reconciled to another position. The offset is now trusted as well when the encryption header declares the size of the encrypted directory, and when the bytes at the offset look like an encrypted directory
• The extensible data sector of the zip64 end of central directory record is now counted in the length of that record. The sector holds the encryption header of an encrypted central directory, and the reader subtracted the fixed length of the record only, so the computed end of the central directory sat past its real end by the length of the sector, and every offset derived from it was wrong
• ZipReader#digitalSignature is now defined on an archive whose central directory is encrypted. The digital signature record follows the encrypted directory, so it is not part of what the decryption returns, and the reader looked for it in the decrypted bytes only
• The local file headers masked by PKWARE strong encryption no longer make FileEntry#getData() throw ERR_AMBIGUOUS_ARCHIVE. When the central directory is encrypted, the local file header of an entry carries a placeholder filename and a zeroed checksum and sizes, and says so with bit 13 of its general purpose bit flag. The comparison against the central directory record that became the default in v2.8.53 rejected those archives. The filename, the checksum and the sizes are now left out of the comparison for those entries, the general purpose bit flag and the compression method are still compared
• The published bundles no longer set the level bits of the general purpose bit flag on the entries written with the default compression level. index.min.js and the files of dist/ announced "super fast" on every Deflate entry whose level option was left unset, where the sources announce nothing. The minifier was configured with unsafe_comps, enabled in February 2022, which rewrites a comparison into its negation: !(0 > level) is true for an undefined level where level >= 0 is false. Those bits are advisory and no reader decompresses differently because of them, but an archive written by a bundle differed from the same archive written from the sources. The option is dropped from both minifier configurations, which costs 40 bytes on index.min.js

• ZipReader#digitalSignature now describes what the signature covers: the records of the central directory, read at ZipReader#directoryOffset, never including the digital signature record itself. zip.js does not verify signatures
• ZipReader#directoryLength now warns that some writers, e.g. SecureZIP, count the digital signature record in the length they declare, so verifying the whole declared range can never succeed. Subtract 6 + digitalSignature.length from it when the record is stored inside the declared range
• The passThrough option now describes how level and compressionMethod are treated, and states that the compression method is written into the headers as-is instead of selecting a codec
• ZipReaderStream now states that it reads its input entirely into a Blob before it emits the first entry, since a zip file stores its central directory at the end. It is a convenience wrapper around ZipReader for stream sources, it does not extract the entries while the data is still arriving

• New fixtures written by SecureZIP cover the strong encryption formats: AES-128, AES-192 and AES-256, stored and Deflate64 entries, an encrypted central directory, a certificate-based archive, a signed archive and an archive mixing encrypted and clear entries. They are read by the tests of decryptCentralDirectory and by the SecureZIP archive tests
• A new fixture written by a third-party tool covers a zip64 entry whose sizes are stored in a data descriptor
• The zip64 fixture of the HTTP test is rebuilt with real zip64 records, the previous one carried none although the test was named after them
• The writer backpressure test now registers a codec that never signals backpressure on its writable side, instead of forcing the native one. It measured the invariant on Bun only, where the native CompressionStream behaved that way, and stopped measuring anything once Bun 1.4.0 fixed it. The registered codec keeps the test meaningful on every runtime
• A new test locks the two passThrough rules above: the compression method is required, the level is ignored, and the level keeps applying to the other entries of the archive

• Ads: Don't enable the skip button before the ad's own media loads (#10447) (1314ef6), closes #10418
• Avoid quadratic copying of prefetched segment data (#10448) (8844a03), closes #10446
• net: Abort pending retry delays immediately (#10443) (e7cd651), closes #10413
• Normalize Opus codec when multiplexed (#10464) (7458fe9)
• offline: Close the database when another connection needs it (#10435) (153551e)
• offline: Don't leak an IndexedDB connection (#10434) (e551ac3)
• test: Skip Widevine tests on Edge with a revoked device certificate (#10449) (69cf789), closes #10442
• UI: Center the seek bar time on the pointer when there are no thumbnails (#10457) (4980ba2), closes #10452
• UI: isolate keyboard shortcuts and fullscreen detection per player instance (#10436) (025be7e), closes #10429
• UI: Prevent playback rate menu jitter when dragging the slider (#10458) (03710af)
• UI: Preview time/thumbnails when seeking with keys (#10465) (478a6f5)

• Ads: Don't enable the skip button before the ad's own media loads (#10447) (3ef7ed3), closes #10418
• Avoid quadratic copying of prefetched segment data (#10448) (da98f07), closes #10446
• net: Abort pending retry delays immediately (#10443) (be23bab), closes #10413
• offline: Close the database when another connection needs it (#10435) (4f2386d)
• offline: Don't leak an IndexedDB connection (#10434) (5141f6b)
• test: Skip Widevine tests on Edge with a revoked device certificate (#10449) (359cf4d), closes #10442
• UI: isolate keyboard shortcuts and fullscreen detection per player instance (#10436) (d64e40f), closes #10429
• UI: Preview time/thumbnails when seeking with keys (#10465) (af95fd1)

• 20aa3e2: - fix events dispatched at the paper container itself being guarded as portaled content

• Avoid quadratic copying of prefetched segment data (#10448) (24700b4), closes #10446
• offline: Close the database when another connection needs it (#10435) (ad6e3ad)
• offline: Don't leak an IndexedDB connection (#10434) (2f74c36)
• test: Skip Widevine tests on Edge with a revoked device certificate (#10449) (fc23a2f), closes #10442

• Avoid quadratic copying of prefetched segment data (#10448) (40e50ce), closes #10446
• offline: Close the database when another connection needs it (#10435) (3587ec3)
• offline: Don't leak an IndexedDB connection (#10434) (e1a18ce)
• test: Skip Widevine tests on Edge with a revoked device certificate (#10449) (58fb31c), closes #10442

• 25235c1: Sustained key repeat against a fast document no longer risks React's maximum update depth guard; state notifications yield to a task when a notification-wave streak goes unbroken.
  • @docx-editor.dev/i18n@2.7.0

• @docx-editor.dev/i18n@2.7.0