• create-app: Default manual setup to npm  -  by @NgoQuocViet2001 and @antfu in https://github.com/slidevjs/slidev/issues/2703 (22b96)

• New checkLocalDirectory option in the reader options. It compares the local file header of an entry against its central directory record when FileEntry#getData() is called, and throws ERR_AMBIGUOUS_ARCHIVE when the two disagree. true compares the filename, the general purpose bit flag, the compression method, the CRC-32 checksum and the sizes, like strictness set to "strict"; false compares nothing, like "tolerant". Setting it explicitly always wins over strictness, whether strictness was passed to the constructor of ZipReader or to the call, so it is the way to ask for this one check without the archive-level checks of checkAmbiguity, and the way to drop it without giving up the other checks strictness performs. It is also the only way to validate the local file headers of a self-extracting archive, since checkAmbiguity rejects prepended data outright
• The local file header of an entry now reports the two records the reader had already read and dropped. LocalDirectory#rawFilename holds the filename stored in the local file header, which is allowed to differ from EntryMetaData#rawFilename, and is defined when strictness is "strict" or checkLocalDirectory is true. LocalDirectory#dataDescriptor holds the data descriptor record written after the content, described by the new LocalDataDescriptor interface, and is defined when checkOverlappingEntry or checkOverlappingEntryOnly is set. It carries the CRC-32 checksum and the sizes stored in the record, each of which is allowed to differ from the central directory, and a signature flag telling whether the record is preceded by its optional signature. That signature is not part of the original format, it is a later convention writers are free to follow. When the four bytes look like the signature but the values behind them disagree with the central directory, the flag is false and the record is read as starting at those four bytes instead
• The parsed extra field records are now typed instead of being declared as the bare EntryExtraField. EntryExtraFieldZip64, EntryExtraFieldNTFS, EntryExtraFieldExtendedTimestamp and EntryExtraFieldUnix describe the members the reader fills in, EntryExtraFieldUnicode gains version, filename and comment, and EntryExtraFieldAES gains compressionMethod, the real compression method of the entry, next to originalCompressionMethod, which is the 99 a WinZip AES header is required to carry in its place
• SplitDataReader now accepts an array of Reader instances, of ReadableReader instances or of ReadableStream instances. The last two were declared in the TypeScript definitions and worked nowhere: reading a split archive requires the size of every disk to map a global offset onto one of them, so an element that only provides a stream is now buffered when the reader is initialized. This applies wherever an array of readers is accepted, i.e. the constructor of ZipReader, ZipWriter#add(), ZipWriter#prependZip(), ZipDirectoryEntry#importZip() and the reader property of a ZipFileEntry instance
• ZipWriter#prependZip() now accepts a reader that only provides a ReadableStream. It reads the central directory of the archive it prepends before piping it, so passing a stream used to fail with TypeError: ReadableStream is already locked. The stream is buffered once, like the disks above
• New ERR_INVALID_COMMENT_TYPE error constant

• The local file header of an entry is now compared against its central directory record by default, except for the filename. strictness set to "balanced", the default, used to trust the central directory record entirely; getData() now throws ERR_AMBIGUOUS_ARCHIVE when the general purpose bit flag, the compression method, the CRC-32 checksum or the sizes disagree. getEntries() is unaffected, the local file header is only read when the data is. This costs nothing: every one of those fields is read from the local file header anyway to locate the entry data. Only the filename is left out, because comparing it reads the filename bytes as well, which costs one extra read per entry whenever the local file header carries no extra field, the common case. "strict" still compares the filename too, "tolerant" still compares nothing, and checkLocalDirectory set to false restores the previous behavior. The new default was verified against 458,000 entries of real archives, where it rejects none of them
• An explicit checkAmbiguity now wins over an inherited strictness. checkAmbiguity is the boolean form of strictness, true meaning "strict", and the two used to be resolved without regard to where they came from, so a checkAmbiguity passed to getEntries() or to getData() could not relax a strictness passed to the constructor of ZipReader. A value passed to the call now wins over a value passed to the constructor, and strictness still wins over checkAmbiguity when both are passed to the same one. checkAmbiguity set to false means "not strict" rather than "trust everything", so it downgrades an inherited "strict" to "balanced" and leaves an inherited "tolerant" alone; pass strictness set to "tolerant" to compare nothing. Code that passes strictness and never checkAmbiguity resolves exactly as before
• The platform byte of the "Version made by" field is now forced instead of being merged into the value given by the versionMadeBy option. It is set to Unix (3) when the entry carries Unix metadata, i.e. when uid, gid, unixMode or unixExtraFieldType is set, and to MS-DOS (0) when msdosAttributes or msdosAttributesRaw is set. Only the lower byte of the given value survives in both cases. It used to be combined with the byte already present, so a versionMadeBy carrying another platform produced a value belonging to neither
• ZipWriter#close() now throws the new ERR_INVALID_COMMENT_TYPE error when the comment it is given is not a Uint8Array. Passing a string, the natural mistake, used to fail deep inside the writer with TypeError: Cannot read properties of undefined (reading 'byteLength'), after the entries had been written. getExportedSize() performs the same check on the globalComment option

• The Unix user and group ids are now read from the local file header when the central directory has none. The Info-ZIP Unix type 2 extra field (0x7855) stores them in the local file header only and leaves a zero-length copy in the central directory, so uid and gid were undefined on every archive written by Info-ZIP. They are filled in when the data of the entry is read: they are still undefined after getEntries() and appear once getData() has run, since that is when the local file header is read, and they are also readable on EntryMetaData#localDirectory. A value read from the central directory is never overwritten by the local file header, since the type 2 field truncates the ids to 16 bits while the New Unix field (0x7875) does not
• An empty Info-ZIP Unix type 2 extra field no longer hides the ids of the Info-ZIP New Unix extra field next to it. The reader looked at 0x7875 only when 0x7855 was absent, so an entry carrying both, which is what Info-ZIP writes, reported no ids at all although 0x7875 held them
• EntryMetaData#rawLastAccessDate and EntryMetaData#rawCreationDate are now filled from the NTFS extra field. They were declared but never set: the raw FILETIME values were stored on the extra field record only. EntryMetaData#rawLastModDate is unaffected, it remains the MS-DOS date and time stored in the header
• The entries returned by ZipReader#getEntries() now carry rawBitFlag, filenameLength, extraFieldLength and unixExternalUpper. The four properties were declared on EntryMetaData and read from the central directory, they were simply dropped when the entry object was built
• unixExternalUpper is now the upper half of the externalFileAttributes the entry was written with, on the entry returned by ZipWriter#add(). It was computed before the unixMode option and the Unix file type were folded in, so it reported the default 0o644 for every entry, whatever the mode: an entry written with 0o120777 disagreed both with its own externalFileAttributes and with what the reader reports for it
• A worker that fails to load now falls back to the main scope instead of throwing a TypeError. The codec pool builds the worker and its interface, then calls it back one turn later; when the error event of the worker arrived in that interval, the error was dropped and the pool went on to post a message to a worker it had already discarded, which failed with Cannot read properties of null (reading 'postMessage'). The designed fallback now runs in that case too, with the error of the worker as the reason. This affects the engines where a worker cannot be started at all, e.g. Firefox extensions using manifest v2 and Chromium 76 to 79
• The entry returned by ZipWriter#add() now defines the same members as the entries returned by ZipReader#getEntries(): zip64, symlink, encrypted, zipCrypto and msDosCompatible were left undefined instead of false on one side or the other, and the deprecated internalFileAttribute and externalFileAttribute aliases were missing from it

• The strictness option now lists the fields each level compares, and states which of them are read from the local file header anyway
• The versionMadeBy, msDosCompatible and unixMode options now describe how the platform byte and the Unix file type are chosen, including the fact that a folder entry is always written with S_IFDIR whatever type the mode carries
• The symlink property now points at the option that writes a symbolic link, since there is no option of that name: the file type goes in unixMode, i.e. 0o120777 with the path of the target as the content of the entry
• Several documented defaults disagreed with the code and were corrected: maxWorkers falls back to 2 when the environment provides no navigator.hardwareConcurrency, workerURI points at the worker of the build that was imported, the four CompressionStream and DecompressionStream options default to the global implementations or to the one embedded in the entry point, lastAccessDate and creationDate have no default at all so that the entries do not carry a meaningless time, and versionMadeBy defaults to 768 rather than 20
• preventHeadRequest now states that leaving it unset is not the same as setting it to false when useRangeHeader or forceRangeRequests is set: the size is then read from a ranged GET request, and only an explicit false restores the HEAD request
• rawLastModDate now states that it is the MS-DOS date and time of the header and is not replaced by the value of the NTFS extra field, unlike lastModDate

• A workflow step rebuilds the project on every push and fails when the committed build output differs. The release workflow publishes the committed files as they are, it never rebuilds, so a stale dist/ or index.min.js at a tag would ship to npm and JSR. Pull requests are exempt, asking outside contributors to commit build output would add an unreviewable diff to every change
• The release workflow now publishes only when the test suite passed on the released commit
• A new audit compares the shapes of the objects the library builds at runtime against the interfaces declared in index.d.ts, in addition to the audit of the read and write surfaces added in v2.8.52. It is what found the members left undefined and the extra field records declared as the bare EntryExtraField
• A regression test covers the backpressure of the writer on the web worker path
• The browser runner restarts the browser and runs the suite again when the session is lost, and its --headful option was renamed to --headed
• The Safari job runs on macOS 15 instead of macOS latest, where the browser loses its window or its session in the middle of the suite more often
• The workers are terminated between the tests in the Node.js, Deno and Bun runners, and the Bun runner sets its own timeout
• A test reproduces the ordering that made a failing worker throw instead of falling back, i.e. the error of the worker arriving before the pool sends it its first message

• Claude (Opus 5) contributed to every change listed above

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.8.52...v2.8.53

HLS.js v1.6.19 includes bug fixes and improvements over the last release.

https://github.com/video-dev/hls.js/compare/v1.6.18...v1.6.19

• Fix permanent stall in encrypted low-latency streams (#7976) @zaki699-blip
• Workaround for macOS and iOS 27 beta regression in ManagedMediaSource "startstreaming" (cherry-pick of #7984) @robwalch

https://392c003f.hls-js-dev.pages.dev/demo/

Please provide feedback via Issues in GitHub. For more details on how to contribute to HLS.js, see our CONTRIBUTING guide.

• style(examples): remove redundant justify-content declaration: #97222
• docs: rename Vercel Edge Config to Global Config in redirecting guide: #97456
• fix: improve form accessibility by associating labels with inputs: #96335
• [docs] fix: grammar typos in linking and navigating guide: #95544
• fix(examples): correct error message typo: #97223
• docs: fix typos in example links: #97149
• Model prerenders as render candidates: #97431
• Turbopack: support character class ranges in regex: #97502
• docs: warn when catching permanentRedirect: #97496
• Remove the development debug channel persistence: #97510
• Stop the browser from restoring stale pages in development: #97505
• Turbopack: gracefully handle outputFileTracingIncludes matching a symlink: #97507
• docs: mention Valibot as validation library option in forms guides: #97468

Huge thanks to @niketchandivade, @molebox, @seanbeirnes, @0ldh, @gnoff, @mischnic, @DavidIlie, @unstubbable, and @fabian-hiller for helping!

• Fixed DevTools popup and context menus not appearing when DevTools is hosted in a custom window via webContents.setDevToolsWebContents(). #52937 ^{(Also in 44)}
• Fixed registerFileProtocol and registerHttpProtocol returning readable responses to cross-origin no-cors fetches; they now return opaque responses like protocol.handle. #52853 ^{(Also in 41, 42, 44)}
• Fixed a WebContentsView staying blank after its window is shown when setBackgroundThrottling(false) was called while the window was hidden. #52864 ^{(Also in 42, 44)}
• Fixed a crash in systemPreferences.promptTouchID(reason) when an invalid reason value is passed. #52782 ^{(Also in 42, 44)}
• Fixed a crash when resolving a path inside a malformed ASAR archive that contains cyclic link entries. #52857 ^{(Also in 42, 44)}
• Fixed a crash with app.setLoginItemSettings if a non-UTF8 service name is used. #52944 ^{(Also in 44)}
• Fixed a memory leak when creating BrowserWindows. #52892 ^{(Also in 42, 44)}
• Fixed a possible crash (SIGABRT) during process exit when the process had loaded tls/https shortly before exiting, affecting app.exit() before ready and short-lived ELECTRON_RUN_AS_NODE / child_process.fork() scripts. #52870 ^{(Also in 44)}
• Fixed a possible main process crash at quit when a session was created from JavaScript that runs during shutdown. #52925 ^{(Also in 44)}
• Fixed a potential crash in contentTracing.stopRecording() when the trace file could not be written to the requested path. #52795 ^{(Also in 42, 44)}
• Fixed a rare crash in the main process when DevTools were opened and a garbage collection ran before the DevTools frontend finished loading. #52903 ^{(Also in 44)}
• Fixed a regression preventing from transparent frameless windows from being resized on Linux. #52947 ^{(Also in 44)}
• Fixed an npm install failure with no recovery path when the OS blocked the native zip extractor from loading (for example, Windows Smart App Control). #52845 ^{(Also in 44)}
• Fixed an issue on Windows where the app process could fail to exit after app.quit() while a shell.openExternal() or shell.openPath() call was still waiting on a system "Open with" dialog. #52897 ^{(Also in 41, 44)}
• Fixed crash in sharedTexture module when GPU context becomes unavailable. #52938 ^{(Also in 44)}
• Fixed custom V8 snapshots (electron-mksnapshot, and the loadBrowserProcessSpecificV8Snapshot fuse) having no effect in the main process on macOS arm64, Linux x64 and Windows x64. #52877 ^{(Also in 42, 44)}
• Fixed downloading files that live inside an asar archive, including saving a packed PDF from the built-in PDF viewer. #52826 ^{(Also in 42, 44)}
• Fixed the built-in PDF viewer not rendering documents in in-memory sessions (partitions without the persist: prefix). #52835 ^{(Also in 44)}
• Fixed windows opened by a sandboxed top-level frame not inheriting the opener's sandbox restrictions. #52848 ^{(Also in 41, 42, 44)}
• <webview> and window.open now inherit nodeIntegrationInWorker from the embedder, consistent with the other Node and sandbox preferences. #52830 ^{(Also in 41, 42, 44)}

• Backported fix for 524628213. #52868
• Backported fixes for 542224257, 542025190. #52842
• Backported fixes from upstream Chromium and V8. #52778
• Fixed Tray icons not appearing (and their menus not opening) on Linux desktops that address the StatusNotifierItem by its unique D-Bus name or via the org.freedesktop.StatusNotifierItem interface, such as GNOME with the AppIndicator extension, Cinnamon and XFCE. #52952
• Fixed an issue on macOS where a page's first use of speechSynthesis could block the main process for several hundred milliseconds. #52814
• Reduced idle main-process CPU wakeups caused by Node.js timers and immediates. #52905 ^{(Also in 44)}

I am pleased to announce the release of officeParser v7.8.0! Embeds were the one construct in the Markdown dialect with no borrowed convention and the worst degrade: a YouTube video could only be written as an invented <div data-youtube-video> block that renders as an invisible empty box on GitHub, and a raw <iframe> was escaped into a wall of literal text. This release gives embeds a real, selectable Markdown form, adds a safe path for capturing untrusted iframes, and fixes an HTML round-trip whitespace bug.

Everything here follows the same rule as recent releases: no regression on any consumer. Every change is additive, a genuine bug fix, or non-standard becoming standard; where a default would move, the old behavior stays and is deprecated. The default embed output is byte-identical to 7.7.0.

Choose how an embed node is written:

• 'html' (default): the <div data-youtube-video> / <iframe> single-line block this library has always emitted and re-reads.
• 'directive': a remark-directive leaf, ::youtube[Label]{id=… width=… align=…} / ::embed[Label]{src=… …}, both parsed and generated. An editor round-trip form (GitHub renders it verbatim rather than as a player, so it is not a GitHub-interop format).
• 'link': a plain [YouTube](url) / [Embed](url).
• 'thumbnail': a YouTube-only clickable preview [![Label](…/vi/ID/…)](watch), the best GitHub degrade.

::youtube parses unconditionally (rendered from a validated id via a fixed template). ::embed carries an arbitrary src, so it is gated behind preserveIframes (the trust input) and stays literal text otherwise. Unknown ::names stay literal, with no catch-all.

Off by default. When on, a generic (non-YouTube) iframe embed is emitted as an inert <div data-embed-gated data-embed-src> placeholder that never auto-loads its src. An editor renders a click-to-load control from it, and HtmlParser reads it back to the same embed node. The src is scheme-checked on emit. The default output (a live <iframe>) is unchanged. Combined with the existing preserveIframes gate, untrusted input is never escaped-as-text and never auto-rendered.

Off by default. When on, a standalone Obsidian image whose URL is a YouTube link (![](…watch?v=ID)) and a clickable thumbnail-link ([![](…/vi/ID/…)](watch)) import as safe YouTube embeds. Off by default because auto-upgrading an image or link is a heuristic that could mangle a genuinely-intended image link. The unambiguous forms are always recognized regardless of this flag.

The human label of a ::youtube[Label] / ::embed[Label] directive (and a gated embed's caption). It round-trips through the directive form, the generic gated data-embed-label, and the YouTube editor-HTML shape.

fallbackToHtml.embeds (boolean). Use mdConfig.dialect.embeds instead, which also selects the 'directive' and 'thumbnail' forms. While dialect.embeds is unset the boolean is still honored (true maps to 'html', false to 'link'). It will be removed in the next major.

The Markdown parser read a YouTube <iframe> as a generic 'iframe' embed with no videoId, and only under preserveIframes, while the HTML parser read it as 'youtube' unconditionally. Both parsers now detect a YouTube src the same way, before the preserveIframes gate, so the same input yields the same 'youtube' embed. The youtube-via-iframe HTML path now also carries the iframe's width/height.

HtmlGenerator appended a readability blank line after every node, including inline text and link runs, so See this [video](url). emitted a paragraph with \n\n around the <a>, which reparsed as a stray space before the punctuation. The blank line is now added only after block-level nodes; inline runs concatenate directly. This is a whitespace-only change to generated HTML (semantically identical), and it makes the md → HTML → md round trip correct.

npm install officeparser@7.8.0

🔗 Full Changelog: View v7.8.0 details 🔗 Documentation & Visualizer: officeparser.harshankur.com

更新内容请查看CHANGELOG。 Please refer to CHANGELOG for details.

Full Changelog: https://github.com/zumerlab/snapdom/compare/v2.24.0...v2.24.3