chore(deps): bump fflate from 0.4.8 to 0.4.9

[dependabot]

Bumps fflate from 0.4.8 to 0.4.9.

Changelog

Sourced from fflate's changelog.

0.8.3

• Fix buffer over-read for Zip64 extra fields
• Support sync flushes (Z_SYNC_FLUSH in zlib)
  • Allows for immediate decompression of all pushed bytes
  • Enables DEFLATE stream concatenation
• Fix zip/zipSync when using cross-realm Uint8Array
• Improve Zip64 support for streamed or undersized archives
• Update performance estimates in README
• Fix typings for TypeScript v5.7+
• Reduce memory consumption after compression stream completion

0.8.2

• Fixed broken UMD build
• Fixed edge-case causing skipped data during streaming compression
• Fixed bug in GZIP streaming on member boundary
• Improved streaming performance on inconsistent chunk sizes
• Improved unzip performance on undercompressed archives
• Added flushing support into streaming API
• Added backpressure support into async streaming API
  • Use new ondrain handler and queuedSize

0.8.1

• Fixed reallocating on pre-supplied buffer in inflateSync and unzlibSync
• Minor documentation fixes

0.8.0

• BREAKING: synchronous decompression functions now take an options object rather than an output buffer as a second parameter
  • inflateSync(compressed, outBuf) is now inflateSync(compressed, { out: outBuf })
• Support dictionaries in compression and decompression
• Support multi-member files in GZIP streaming decompression
• Dramatically improved streaming performance
• Fixed missing error on certain malformed GZIP files

0.7.3

• Fix folder creation for certain operating system
  • Create 0-length "files" for each directory specified with "object" syntax"
  • Support empty folders
  • Add options for folders
• Fix minification in SWC
  • Remove instanceof, no-whitespace assumptions in async functions

0.7.2

• Fixed TypeScript typing for errors when using strictNullChecks
• Fixed failure to compress files above 64kB with { level: 0 }
• Fixed AMD module definition in UMD build

0.7.1

• Removed requirement for setTimeout
• Added support for unzip file filters (thanks to @​manucorporat: #67)
• Fixed streaming gunzip and unzlib bug causing corruption

0.7.0

• Improved errors
  • Now errors are error objects instead of strings
  • Check the error code to apply custom logic based on error type
• Made async operations always call callbacks asynchronously
• Fixed bug that caused errors to not appear in asynchronous operations in browsers

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
deriv-api-docs	Ready	Preview	Sep 3, 2026 6:14pm UTC

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 2 packages with OpenSSF Scorecard issues.

See the Details below.

OpenSSF Scorecard

Package	Version	Score	Details
npm/fflate	0.4.8	⚠️ 2	Details Check Score Reason Code-Review ⚠️ 0 Found 2/30 approved changesets -- score normalized to 0 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ -1 No tokens found Dangerous-Workflow ⚠️ -1 no workflows found Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ -1 no dependencies found CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/fflate	0.4.9	⚠️ 2	Details Check Score Reason Code-Review ⚠️ 0 Found 2/30 approved changesets -- score normalized to 0 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ -1 No tokens found Dangerous-Workflow ⚠️ -1 no workflows found Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ -1 no dependencies found CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Manifest Files

package-lock.json

• fflate@0.4.8
• fflate@0.4.9