build(deps-dev): bump the npm-dev group with 3 updates

[dependabot]

Bumps the npm-dev group with 3 updates: @types/node, @zip.js/zip.js and eslint-plugin-jsdoc.

Updates @types/node from 24.13.3 to 24.13.4

Commits

• See full diff in compare view

Updates @zip.js/zip.js from 2.13.1 to 2.14.0

Release notes

Sourced from @​zip.js/zip.js's releases.

v2.14.0

What's Changed in v2.14.0

New features

• AES encryption and decryption run 3.5× faster on every build. sjcl is replaced by a small AES-CTR/HMAC-SHA1 engine working on typed arrays and fed whole chunks instead of 16 bytes at a time: a stored AES-256 entry goes from 26 to 91 MB/s on Node.js, from 17 to 55 MB/s in Firefox and from 22 to 77 MB/s in Chrome
• The WebAssembly builds run that engine as a kernel linked into the module they already load, which brings Firefox to 87 MB/s, Chrome to 99 MB/s and Node.js to 111 MB/s. The JavaScript engine stays in the bundle and takes over whenever the module cannot load, e.g. under a Content Security Policy without 'wasm-unsafe-eval', so nothing that encrypted before stops encrypting. The default bundle grows by 2 KB gzipped; the native and core builds carry the JavaScript engine only

Bug fixes

• terminateWorkers() now waits for the codecs running without a web worker, which is what useWebWorkers: false and every worker fallback give. It used to resolve while such a codec was still running, so the WebAssembly builds reset the module underneath it and the entry being written failed with an internal TypeError instead of completing
• A folder or empty entry of a ZipCrypto archive no longer carries a data descriptor. It holds no encrypted data, so it needs none, and a pass-through re-export of such an archive is now byte-identical to its source
• The duplicates option of the file system API applies to two directory records claiming the same node: "keep-last" replaces the record held by the node and keeps the entries already imported below it. A directory record claiming a node created implicitly by the entries below it is the record that node was missing, not a collision
• HttpReader and HttpRangeReader with combineSizeEocd now fetch, with the request that gives the size, the whole tail the end of central directory scan can need, so listing the entries of an archive that carries a comment costs one request instead of falling back to more. A response covering another range than the one asked for is no longer served as if it were that range

Documentation

• The import methods of ZipFS and ZipDirectoryEntry declare the array of every ZipFileEntry and ZipDirectoryEntry the import created, the directories created for the path components included, instead of a one-element tuple
• WritableWriter#size states when it advances: the bytes of a section are added once that section is written, so an instance reading it from its own write() sees the total of the sections already finished. The instances yielded by a generator of split disks are the exception and advance on every chunk
• The duplicates option documents the one collision that also drops entries that did not collide: a file claiming a node holding a directory, where "keep-last" replaces the directory and the entries below it go with it, and "keep-first" keeps them and ignores the file
• BENCHMARKS.md gains an encryption section comparing the two engines and the previous release on Node.js, Bun, Deno, Firefox and Chrome, with the harness to reproduce it
• The CommonJS declarations are rebuilt from index.d.ts, which they had fallen behind

Tests and continuous integration

• The AES engine is pinned by the RFC 2202 and RFC 6070 vectors, cross-checked against Web Crypto where it exists, and driven through the library with sizes around every block and chunk boundary; the fallbacks to JavaScript key derivation and to the JavaScript engine are exercised, and the WebAssembly engine is checked byte for byte against the JavaScript one
• The custom engine tests fail when the engine they install is not the one used, two crypto tests no longer depend on the clock or on chance, and the Deno resource sanitizer is re-enabled on sixteen tests

Full Changelog: gildas-lormeau/zip.js@v2.13.1...v2.14.0

Commits

• 843cbed bump up version
• 79b7507 measure the aes engines in benchmarks.md
• ab457b0 await the module helper in supportsDeflate
• 107a083 load the module once per entry through an explicit helper
• 528fc16 run aes entries on the wasm module when it loads
• c75a1df tolerate chrome lacking aes-192 in the web crypto check
• 629910c replace sjcl with a typed-array aes engine
• 7ca1cfe feed whole chunks to the aes cipher and hmac
• 4e52698 skip the data descriptor for folders in zipcrypto archives
• e542418 rebuild the commonjs declarations
• Additional commits viewable in compare view

Updates eslint-plugin-jsdoc from 64.3.6 to 64.3.8

Release notes

Sourced from eslint-plugin-jsdoc's releases.

v64.3.8

64.3.8 (2026-09-09)

Bug Fixes

• getJsdocProcessorPlugin: key positions by file; drop suggestions (1b3c339)

v64.3.7

64.3.7 (2026-09-09)

Bug Fixes

• no-undefined-types: recognize sibling class members from a property's JSDoc (5cac70a), closes #1760

Commits

• 1b3c339 fix(getJsdocProcessorPlugin): key positions by file; drop suggestions
• 5cac70a fix(no-undefined-types): recognize sibling class members from a property's ...
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
eslint-plugin-jsdoc	[>= 54.0.0.a, < 54.0.1]
eslint-plugin-jsdoc	[>= 54.1.a, < 54.2]
eslint-plugin-jsdoc	[>= 55.1.2.a, < 55.1.3]
eslint-plugin-jsdoc	[>= 58.1.0.a, < 58.1.1]
eslint-plugin-jsdoc	[>= 61.1.3.a, < 61.1.4]
@types/node	[>= 25.a, < 26]
@types/node	[>= 26.a, < 27]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions