fix(deps): update dependency jszip to v3.8.0 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
jszip	3.1.5 -> 3.8.0

GitHub Vulnerability Alerts

CVE-2021-23413

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.

CVE-2022-48285

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.

---

Release Notes

Stuk/jszip (jszip)

v3.8.0

Compare Source

• Santize filenames when files are loaded with loadAsync, to avoid "zip slip" attacks. The original filename is available on each zip entry as unsafeOriginalName. See the documentation. Many thanks to McCaulay Hudson for reporting.

v3.7.1

Compare Source

• Fix build of dist files.
  • Note: this version ensures the changes from 3.7.0 are actually included in the dist files. Thanks to Evan W for reporting.

v3.7.0

Compare Source

• Fix: Use a null prototype object for this.files (see #​766)
  • This change might break existing code if it uses prototype methods on the .files property of a zip object, for example zip.files.toString(). This approach is taken to prevent files in the zip overriding object methods that would exist on a normal object.

v3.6.0

Compare Source

• Fix: redirect main to dist on browsers (see #​742)
• Fix duplicate require DataLengthProbe, utils (see #​734)
• Fix small error in read_zip.md (see #​703)

v3.5.0

Compare Source

• Fix 'End of data reached' error when file extra field is invalid (see #​544).
• Typescript definitions: Add null to return types of functions that may return null (see #​669).
• Typescript definitions: Correct nodeStream's type (see #​682)
• Typescript definitions: Add string output type (see #​666)

v3.4.0

Compare Source

• Add Typescript type definitions (see #​601).

v3.3.0

Compare Source

• Change browser module resolution to support Angular packager (see #​614).

v3.2.2

Compare Source

• No public changes, but a number of testing dependencies have been updated.
• Tested browsers are now: Internet Explorer 11, Chrome (most recent) and Firefox (most recent). Other browsers (specifically Safari) are still supported however testing them on Saucelabs is broken and so they were removed from the test matrix.

v3.2.1

Compare Source

• Corrected built dist files

v3.2.0

Compare Source

• Update dependencies to reduce bundle size (see #​532).
• Fix deprecated Buffer constructor usage and add safeguards (see #​506).

---

Configuration

📅 Schedule: Branch creation - "" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.