build(deps-dev): bump @zip.js/zip.js from 2.8.34 to 2.8.36

[dependabot]

Bumps @zip.js/zip.js from 2.8.34 to 2.8.36.

Release notes

Sourced from @​zip.js/zip.js's releases.

v2.8.36

Fix missing commits in v2.8.35

Full Changelog: gildas-lormeau/zip.js@v2.8.35...v2.8.36

What's Changed in v2.8.36

This release focuses on streaming I/O: readers can now hand over a native stream instead of being read chunk by chunk, which removes a copy for blobs and a whole series of HTTP requests for remote archives read with range requests. It also fixes several zip64 and split-archive issues, and replaces the hand-maintained list of property names protected from minification with a derived one checked at build time.

New features

• Reader#createReadable(options), introduced internally in 2.8.31, is now part of the documented API, with the new CreateReadableOptions type (offset, size, chunkSize). Custom readers can override it to return a stream provided natively by the underlying data source instead of relying on readUint8Array(). It also accepts a byte range, and no longer takes a diskNumberStart option: split readers now use linear disk offsets
• BlobReader now returns blob.stream(), or blob.slice(offset, end).stream() for a range, instead of reading the data in chunkSize slices through readUint8Array()
• When range requests are used, i.e. with HttpRangeReader or with the useRangeHeader and forceRangeRequests options of HttpReader, the data of an entry is now read with range requests of 16MB at most whose response bodies are streamed, instead of one range request per chunkSize bytes. Reading a 4GB entry sends 256 requests instead of 65536, and no request is ever sized after the entry. This requires fetch, the useXHR option still reads the data chunk by chunk
• Add the maximumRangeSize option to HttpReader and HttpRangeReader to tune the size of these range requests, e.g. to lower it behind a proxy closing long-lived responses
• These two changes only affect how the bytes are obtained: the chunks emitted by the platform are still normalized to chunkSize before reaching the codec, and the chunks received by writers are unchanged
• Add the closeDisk() method to SplitDataWriter to close the disk being written, the next disk being opened when more data is written
• Add the checkResourceChanges option to HttpRangeOptions and the ERR_HTTP_RESOURCE_CHANGED error constant: range requests now detect a resource modified while being read by comparing the ETag, Last-Modified and total size headers against the ones returned by the first request
• Add resetConfiguration() to restore the default configuration of zip.js

Behavior changes

• checkResourceChanges defaults to true, so reading an HTTP resource that changes mid-read now throws ERR_HTTP_RESOURCE_CHANGED instead of silently producing corrupt data. Headers missing from the responses are ignored; note that Access-Control-Expose-Headers must include them when the resource is fetched cross-origin
• Entries requiring no codec work at all, i.e. no compression, no CRC-32 and no encryption, now always bypass web workers. They previously went through a worker when transferStreams was enabled, i.e. by default. In practice this covers reading stored entries without the checkSignature option, and passThrough transfers; entries needing the CRC-32, which includes every entry written by add() without passThrough, still go through a worker

... (truncated)

Commits

• 69b9926 bump up version
• be250bb update doc
• e4091a9 update built files
• 35838b6 keep the chunk size guard effective in minified builds
• 1f3be0b update built files
• d245b20 add maximumRangeSize option to http readers
• 8f41e3e update built files
• 03da64a bound http range requests to 16MB windows
• cdcf4eb bump up version
• 63bfe7d update doc
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
prose-reader-demo	Ready	Preview	Aug 12, 2026 1:07am
prose-reader-front	Ready	Preview	Aug 12, 2026 1:07am