chore: update dependency fflate to v0.8.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
fflate (source)	0.8.2 → 0.8.3

---

fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

CVE-2026-45820 / GHSA-px8p-9vwx-vf98

More information

Details

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

Severity

• CVSS Score: 6.6 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-45820
• https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714
• https://github.com/101arrowz/fflate/commit/e6d5e6e1076892f72770ac732d83c81da9f3316e
• https://github.com/101arrowz/fflate/releases/tag/v0.8.3
• https://github.com/advisories/GHSA-px8p-9vwx-vf98

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

101arrowz/fflate (fflate)

v0.8.3

Compare Source

• Fix buffer over-read for Zip64 extra fields
• Support sync flushes (Z_SYNC_FLUSH in zlib)
  • Allows for immediate decompression of all pushed bytes
  • Enables DEFLATE stream concatenation
• Fix zip/zipSync when using cross-realm Uint8Array
• Improve Zip64 support for streamed or undersized archives
• Update performance estimates in README
• Fix typings for TypeScript v5.7+
• Reduce memory consumption after compression stream completion

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[J-Sek]

we only zip code for playground link hash

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (^0.8.2). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.