⬆️ bump adm zip to 0.5.16 #5019

matt-fidd · 2025-05-18T06:42:31Z

I've split this out from #5015 because adm-zip requires patching.

I've had a PR up there (cthackers/adm-zip#551) for quite a while but no response yet so this is the only way to update without changing the dependency over.

adm-zip (0.5.10 → 0.5.16)

v0.5.16: Fixed Linux file permissions preservation and undefined totalEntries
v0.5.15: Fixed Windows paths handling, added async folder functionality, and improved decoder
v0.5.14: Fixed inflater issue on Node.js >= 15
v0.5.13: Fixed extractAllToAsync and added zip bomb protection
v0.5.12-11: Extraction improvements and password protection support

netlify · 2025-05-18T06:42:36Z

✅ Deploy Preview for actualbudget ready!

Name	Link
🔨 Latest commit	`df39ff2`
🔍 Latest deploy log	https://app.netlify.com/projects/actualbudget/deploys/682a5cafce77ac00081c669e
😎 Deploy Preview	https://deploy-preview-5019.demo.actualbudget.org
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

github-actions · 2025-05-18T06:44:46Z

Bundle Stats — desktop-client

Hey there, this message comes from a GitHub action that helps you and reviewers to understand how these changes affect the size of this project's bundle.

As this PR is updated, I'll keep you updated on how the bundle size is impacted.

Total

Files count	Total bundle size	% Changed
18	9.69 MB	0%

Changeset

No files were changed

View detailed bundle breakdown

Added

No assets were added

Removed

No assets were removed

Bigger

No assets were bigger

Smaller

No assets were smaller

Unchanged

Asset	File Size	% Changed
static/js/index.js	6.56 MB	0%
static/js/de.js	120.53 kB	0%
static/js/en-GB.js	5.93 kB	0%
static/js/en.js	116.35 kB	0%
static/js/es.js	68.91 kB	0%
static/js/fr.js	124.09 kB	0%
static/js/nl.js	100.82 kB	0%
static/js/pt-BR.js	117.2 kB	0%
static/js/uk.js	121.43 kB	0%
static/js/indexeddb-main-thread-worker-e59fee74.js	12.94 kB	0%
static/js/workbox-window.prod.es5.js	5.64 kB	0%
static/js/resize-observer.js	18.37 kB	0%
static/js/BackgroundImage.js	122.29 kB	0%
static/js/ReportRouter.js	1.71 MB	0%
static/js/narrow.js	391.1 kB	0%
static/js/wide.js	113.64 kB	0%
static/js/AppliedFilters.js	10.92 kB	0%
static/js/useAccountPreviewTransactions.js	3.14 kB	0%

github-actions · 2025-05-18T06:44:47Z

Bundle Stats — loot-core

Hey there, this message comes from a GitHub action that helps you and reviewers to understand how these changes affect the size of this project's bundle.

As this PR is updated, I'll keep you updated on how the bundle size is impacted.

Total

Files count	Total bundle size	% Changed
1	2.29 MB → 2.3 MB (+7.42 kB)	+0.32%

Changeset

File	Δ	Size
`node_modules/adm-zip/util/decoder.js`	🆕 +130 B	0 B → 130 B
`node_modules/adm-zip/util/errors.js`	📈 +982 B (+52.07%)	1.84 kB → 2.8 kB
`node_modules/adm-zip/util/utils.js`	📈 +2.59 kB (+34.16%)	7.58 kB → 10.17 kB
`node_modules/adm-zip/zipEntry.js`	📈 +3.57 kB (+30.56%)	11.68 kB → 15.25 kB
`node_modules/adm-zip/util/index.js`	📈 +47 B (+26.26%)	179 B → 226 B
`node_modules/adm-zip/adm-zip.js`	📈 +7.02 kB (+23.14%)	30.34 kB → 37.36 kB
`node_modules/adm-zip/methods/inflater.js`	📈 +210 B (+22.44%)	936 B → 1.12 kB
`node_modules/adm-zip/zipFile.js`	📈 +2.1 kB (+15.72%)	13.33 kB → 15.42 kB
`node_modules/adm-zip/methods/zipcrypto.js`	📈 +351 B (+6.43%)	5.33 kB → 5.67 kB
`node_modules/adm-zip/headers/entryHeader.js`	📈 +711 B (+6.26%)	11.09 kB → 11.78 kB
`node_modules/adm-zip/headers/mainHeader.js`	📉 -10 B (-0.22%)	4.35 kB → 4.34 kB
`node_modules/adm-zip/util/fattr.js`	📉 -71 B (-3.62%)	1.92 kB → 1.85 kB
`node_modules/adm-zip/util/fileSystem.js`	🔥 -353 B (-100%)	353 B → 0 B

View detailed bundle breakdown

Added

No assets were added

Removed

No assets were removed

Bigger

Asset	File Size	% Changed
kcab.worker.js	2.29 MB → 2.3 MB (+7.42 kB)	+0.32%

Smaller

No assets were smaller

Unchanged

No assets were unchanged

matt-fidd · 2025-05-18T06:47:47Z

This is annoying when the Netlify build gets stuck. Maybe #5014 will help

2:42:59 AM: ! Corepack is about to download https://repo.yarnpkg.com/4.7.0/packages/yarnpkg-cli/bin/yarn.js
2:42:59 AM: /opt/buildhome/.nvm/versions/node/v20.19.2/lib/node_modules/corepack/dist/lib/corepack.cjs:21623
2:42:59 AM:     throw new Error(
2:42:59 AM:           ^
2:42:59 AM: Error: Server answered with HTTP 429 when performing the request to https://repo.yarnpkg.com/4.7.0/packages/yarnpkg-cli/bin/yarn.js;

coderabbitai · 2025-05-18T06:54:40Z

Walkthrough

The dependency "adm-zip" in the loot-core package.json file was updated from version 0.5.10 to a patched version 0.5.16 using Yarn's patch protocol. This change replaces the direct version reference with a reference to a local patch file for version 0.5.16. No other dependencies or configurations were modified, and there were no changes to exported or public entities.

Suggested labels

:sparkles: merged

Suggested reviewers

MikesGlitch

Note

⚡️ AI Code Reviews for VS Code, Cursor, Windsurf

CodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback.
Learn more here.

Note

⚡️ Faster reviews with caching

CodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure Review - Disable Cache at either the organization or repository level. If you prefer to disable all data retention across your organization, simply turn off the Data Retention setting under your Organization Settings.
Enjoy the performance boost—your workflow just got faster.

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4ceca68 and df39ff2.

⛔ Files ignored due to path filters (2)

.yarn/patches/adm-zip-npm-0.5.16-4556fea098.patch is excluded by !**/.yarn/**
yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

packages/loot-core/package.json (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

packages/loot-core/package.json

⏰ Context from checks skipped due to timeout of 90000ms (14)

GitHub Check: Functional Desktop App
GitHub Check: Wait for Netlify build to finish
GitHub Check: api
GitHub Check: typecheck
GitHub Check: Analyze
GitHub Check: test
GitHub Check: server
GitHub Check: build (macos-latest)
GitHub Check: lint
GitHub Check: web
GitHub Check: build (windows-latest)
GitHub Check: build (ubuntu-latest)
GitHub Check: crdt
GitHub Check: compare

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

coderabbitai

Actionable comments posted: 0

🧹 Nitpick comments (1)

package.json (1)

75-75: Document patch-package usage for contributors
Including patch-package (^8.0.0) is on point. Consider updating CONTRIBUTING.md or developer docs to explain how to create, apply, and update patches under patches/.

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 0dca849 and afb1793.

⛔ Files ignored due to path filters (2)

upcoming-release-notes/5019.md is excluded by !**/*.md
yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (3)

package.json (2 hunks)
packages/loot-core/package.json (1 hunks)
patches/adm-zip+0.5.16.patch (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms (5)

GitHub Check: Visual regression
GitHub Check: Functional
GitHub Check: build (windows-latest)
GitHub Check: build (macos-latest)
GitHub Check: build (ubuntu-latest)

🔇 Additional comments (4)

packages/loot-core/package.json (2)

26-26: Bump adm-zip to latest patch version
Updating adm-zip from ^0.5.10 to ^0.5.16 incorporates critical fixes (Linux permissions, Windows path handling, async folder support, zip bomb protection, etc.) as intended by this PR.

26-26: Verify integration after the bump
Please run the suite of unit/integration tests—or add new ones—to confirm zip-related functionality in loot-core behaves correctly with the new version and applied patch.

package.json (1)

53-55: Ensure patch-package postinstall runs smoothly
Adding "postinstall": "patch-package" applies local fixes automatically. Verify this hook executes correctly under Yarn v4 (Plug’n’Play) and doesn’t conflict with existing lifecycle scripts (e.g., prepare).

patches/adm-zip+0.5.16.patch (1)

7-7: Adopt optional chaining and nullish coalescing
Switching to process?.versions?.node ?? "" guards against undefined process or versions, preventing runtime errors. This aligns with modern JS best practices given our Node ≥20 target.

package.json

matt-fidd added the dependencies Pull requests that update a dependency file label May 18, 2025

actual-github-bot bot changed the title ~~⬆️ bump adm zip to 0.5.16~~ [WIP] ⬆️ bump adm zip to 0.5.16 May 18, 2025

actual-github-bot bot added the 🚧 WIP label May 18, 2025

matt-fidd force-pushed the bump-adm-zip branch from 73d56aa to afb1793 Compare May 18, 2025 06:51

matt-fidd changed the title ~~[WIP] ⬆️ bump adm zip to 0.5.16~~ ⬆️ bump adm zip to 0.5.16 May 18, 2025

actual-github-bot bot added 🔍 ready for review and removed 🚧 WIP labels May 18, 2025

coderabbitai bot reviewed May 18, 2025

View reviewed changes

matt-fidd force-pushed the bump-adm-zip branch from afb1793 to e02b3de Compare May 18, 2025 18:25

matt-fidd added 2 commits May 18, 2025 16:52

bump adm-zip to 0.5.16

4ad77a6

note

4ceca68

matt-fidd force-pushed the bump-adm-zip branch from e02b3de to 4ceca68 Compare May 18, 2025 20:52

MatissJanis reviewed May 18, 2025

View reviewed changes

package.json Outdated Show resolved Hide resolved

move to native yarn patch

df39ff2

MatissJanis approved these changes May 18, 2025

View reviewed changes

actual-github-bot bot added ✅ approved and removed 🔍 ready for review labels May 18, 2025

matt-fidd merged commit 188cd21 into actualbudget:master May 18, 2025
22 checks passed

actual-github-bot bot added ✨ merged and removed ✅ approved labels May 18, 2025

matt-fidd deleted the bump-adm-zip branch May 18, 2025 22:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

⬆️ bump adm zip to 0.5.16 #5019

⬆️ bump adm zip to 0.5.16 #5019

Uh oh!

matt-fidd commented May 18, 2025 •

edited

Loading

Uh oh!

netlify bot commented May 18, 2025 •

edited

Loading

Uh oh!

github-actions bot commented May 18, 2025 •

edited

Loading

Uh oh!

github-actions bot commented May 18, 2025 •

edited

Loading

Uh oh!

matt-fidd commented May 18, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented May 18, 2025 •

edited

Loading

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

⬆️ bump adm zip to 0.5.16 #5019

⬆️ bump adm zip to 0.5.16 #5019

Uh oh!

Conversation

matt-fidd commented May 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

adm-zip (0.5.10 → 0.5.16)

Uh oh!

netlify bot commented May 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for actualbudget ready!

Uh oh!

github-actions bot commented May 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle Stats — desktop-client

Uh oh!

github-actions bot commented May 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle Stats — loot-core

Uh oh!

matt-fidd commented May 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented May 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Suggested labels

Suggested reviewers

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

matt-fidd commented May 18, 2025 •

edited

Loading

netlify bot commented May 18, 2025 •

edited

Loading

github-actions bot commented May 18, 2025 •

edited

Loading

github-actions bot commented May 18, 2025 •

edited

Loading

matt-fidd commented May 18, 2025 •

edited

Loading

coderabbitai bot commented May 18, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)