# What changed in fflate

> 7 changes in fflate 0.8 from its official release notes, upgrade guides and advisories: 2 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/fflate/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## fflate 0.8

### Security

- fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives (0.8.3) — [security advisory](https://github.com/advisories/GHSA-PX8P-9VWX-VF98)
- Fixes buffer over-reads when processing Zip64 extra fields. (0.8.3) — [release notes](https://github.com/101arrowz/fflate/releases/tag/v0.8.3)

### New APIs and options

- Adds sync flush support, allowing immediate decompression of pushed bytes and DEFLATE stream concatenation. (0.8.3) — [release notes](https://github.com/101arrowz/fflate/releases/tag/v0.8.3)

### Performance

- Reduces memory consumption after compression streams complete. (0.8.3) — [release notes](https://github.com/101arrowz/fflate/releases/tag/v0.8.3)

### Fixes and other changes

- Fixes typings for TypeScript 5.7 and later. (0.8.3) — [release notes](https://github.com/101arrowz/fflate/releases/tag/v0.8.3)
- Fixes zip and zipSync handling when given Uint8Array instances from another realm. (0.8.3) — [release notes](https://github.com/101arrowz/fflate/releases/tag/v0.8.3)
- Improves handling of streamed or undersized Zip64 archives. (0.8.3) — [release notes](https://github.com/101arrowz/fflate/releases/tag/v0.8.3)