Full Changelog: v0.6.0...v0.6.1

• Updated dev dependencies
• Fixed uncaught crash in async decompression on malformed DEFLATE data
• Fixed addLocalFolder following symlinks out of the archived folder
• Stripped setuid/setgid/sticky bits from extracted file permissions
• Enforced the decompression size cap on the async path and for size 0
• Rejected archives with duplicate entry names
• Blocked extraction from writing through symlinks inside the target
• Routed malformed-header parse errors through the async callback
• Rejected zip entries whose declared data extent runs past the buffer
• Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
• Fixed addLocalFolderAsync2 mangling local paths on Windows

Full Changelog: v0.5.18...v0.6.0

This release fixes a security vulnerability (CVE-2026-39244), resolves several long-standing bugs, ships built-in TypeScript types, and includes two behavior changes worth reading before you upgrade.

• extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files). (#306)
• Extraction no longer fails when the modification time can't be set — utimes is now best-effort. (#379)
• Minimum Node.js is now 14 (the code already required it; engines was incorrectly >=12).
• CVE-2026-39244 — a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process; allocation is now bounded by the data actually present. Reported by Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (#568)
• Hardened entry-name lookup against object injection (proto names). Prototype-less table.
• Data-descriptor regression rejecting valid archives (#548, #533, #554)
• Directory permissions not restored on extract (#530)
• Infinite recursion on symlink loops in addLocalFolder (#541)
• Uncaught process crash in writeFileToAsync on write failure (#470, #459, #402)
• Empty name on directory entries (#466)
• test() always returned false for archives with files
• ~6× faster entry sorting for large archives
• Built-in TypeScript definitions (types.d.ts) — you can drop @types/adm-zip

What's Changed

• Bump js-yaml from 4.1.1 to 4.3.0 by @dependabot[bot] in #566
• Fix corrupted zip when round-tripping entries with a data descriptor (#555) by @JohnJunior in #564
• prevent crashes when process.versions is an empty object by @matt-fidd in #551
• support for writing zip64 by @mielverkerken in #562
• Fix Archive Utility failure on zips with empty directories (#558) by @JohnJunior in #563

New Contributors

• @JohnJunior made their first contribution in #564
• @matt-fidd made their first contribution in #551
• @mielverkerken made their first contribution in #562

Full Changelog: v0.5.17...v0.5.18

What's Changed

• entryHeader time setter more tolerant by @thomasheritage in #540
• Add check for local desc flag in crc check by @issacgerges in #543
• Create only if the directory does not exist by @DennisHill in #557
• Fix issue with absolute paths by @kwolfy in #559

New Contributors

• @thomasheritage made their first contribution in #540
• @issacgerges made their first contribution in #543
• @DennisHill made their first contribution in #557
• @kwolfy made their first contribution in #559

Full Changelog: v0.5.16...v0.5.17

What's Changed

• Fixing preserving linux file permissions by @NickAllmakerOpsCompass in #531
• fix: totalEntries is not defined by @sidartaveloso in #535

New Contributors

• @NickAllmakerOpsCompass made their first contribution in #531
• @sidartaveloso made their first contribution in #535

Full Changelog: v0.5.15...v0.5.16

What's Changed

• Fix utils canonical to valid posix by @skoniks in #499
• addFile backslash test by @5saviahv in #500
• added addLocalFolderAsync2 by @5saviahv in #501
• fixed windows paths by @roosipuu in #503
• Add Windows build by @5saviahv in #504
• inital "decoder" functionality by @5saviahv in #505
• Bump braces from 3.0.2 to 3.0.3 by @dependabot in #506
• Write out Electron original-fs auto loading by @5saviahv in #502
• using writeZip() twice throws "Invalid LOC header (bad signature)" error by @5saviahv in #507
• Descriptor check & Main Header locating by @5saviahv in #508
• House keeping by @5saviahv in #509
• typo by @5saviahv in #510
• Allow interoperability files with non-UTF-8 (bit 11 = 0) name by @yfdyh000 in #450
• package lock update by @5saviahv in #511
• small updates by @5saviahv in #513
• CodeQL check by @5saviahv in #514
• Keep local extra data by @5saviahv in #515
• Update old test by @5saviahv in #516
• make all errors a function by @5saviahv in #517
• Update date time functions by @5saviahv in #518
• Add a length check when extra field parsed by @code-sunbo in #520
• deleteFile is too eager by @5saviahv in #525

New Contributors

• @skoniks made their first contribution in #499
• @roosipuu made their first contribution in #503
• @code-sunbo made their first contribution in #520

Full Changelog: v0.5.14...v0.5.15

Fixed an issue introduced on version 0.5.13 requiring a new mandatory parameter on the inflater on nodejs version >= 15

• Fixed extractAllToAsync callback @5saviahv
• Fixed issue with "toAsyncBuffer" where after that command all entries are gone @5saviahv
• Minor fixes (tests, typos etc) @5saviahv
• Added a an option to specificy the maximum expectedLength of the file to protect against zip bombs or limit memory usage @undefined-moe
• Add check for invalid large disk entries @criyle

Fixed extraction error

• Add support for Info-Zip password check spec for ZipCrypto @lukemalcolm
• Extraction of password protected zip entries @Santa77
• Fixed unnecessary scanning a local file headers (except in the case of corrupted archives) @likev
• Added GitHub actions @kibertoad
• Fixed cases when extra data was lost @yfdyh000
• Fixed throw empty error in extractAllToAsync on operation done @Autokaka