Node 24.16.0: extract-zip hangs extracting

[SynRJ]

Version

v24.16.0

Platform

Linux, Docker image `node:24.16.0-slim`

Subsystem

No response

What steps will reproduce the bug?

#!/usr/bin/env bash
set -euo pipefail

for NODE_VERSION in 24.15.0 24.16.0; do
  echo "### Testing Node ${NODE_VERSION}"

  docker run --rm "node:${NODE_VERSION}-slim" sh -lc '
    set -eu
    apt-get update >/dev/null
    apt-get install -y curl >/dev/null

    mkdir -p /repro /tmp/out-node
    cd /repro

    npm init -y >/dev/null 2>&1
    npm install extract-zip@2.0.1 >/dev/null 2>&1

    curl -fsSL -o chrome.zip https://storage.googleapis.com/chrome-for-testing-public/134.0.6998.35/linux64/chrome-linux64.zip

    node --input-type=module -e "import extract from \"extract-zip\"; await extract(\"chrome.zip\", { dir: \"/tmp/out-node\" }); console.log(\"extract-zip done\")"

    test -x /tmp/out-node/chrome-linux64/chrome
    echo "extract-zip: PASS"
  '
done

How often does it reproduce? Is there a required condition?

Always with v24.16.0, never with v24.15.0

What is the expected behavior? Why is that the expected behavior?

Both Node versions should complete extraction successfully

What do you see instead?

### Testing Node 24.15.0
debconf: delaying package configuration, since apt-utils is not installed
extract-zip done
extract-zip: PASS
### Testing Node 24.16.0
debconf: delaying package configuration, since apt-utils is not installed
Warning: Detected unsettled top-level await at file:///repro/[eval1]:1
import extract from "extract-zip"; await extract("chrome.zip", { dir: "/tmp/out-node" }); console.log("extract-zip done")

Seems like extract-zip started extracting, but its async operation got stuck in a state where Node thinks there is nothing left to wait for. And the extraction remains incomplete.

Additional information

When this happens through Puppeteer / @puppeteer/browsers, the install appears to leave a partial extraction. For example, only a few files exist:

/tmp/out-node/chrome-linux64/ABOUT
/tmp/out-node/chrome-linux64/MEIPreload/manifest.json
/tmp/out-node/chrome-linux64/MEIPreload/preloaded_data.pb
/tmp/out-node/chrome-linux64/PrivacySandboxAttestationsPreloaded/manifest.json
/tmp/out-node/chrome-linux64/PrivacySandboxAttestationsPreloaded/privacy-sandbox-attestations.dat
/tmp/out-node/chrome-linux64/WidevineCdm/LICENSE

But the expected executable is missing:

/tmp/out-node/chrome-linux64/chrome

Chrome and Puppeteer versions are all fixed on our side and we didn't change them.

Thanks :)

[pvdstel]

Running into something similar here. We run Playwright in a sharded GitLab CI job, and then we have a final job that merges the different outputs (which are zip files) together. For this process, Playwright attempts to unzip the files, but simply stops, leaving no reports.

Job output in node:24.15.0-alpine (digest node@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f):

$ pnpm playwright merge-reports ./blob-report --reporter html
merging reports from /builds/floriday/sites/suppliers-portal/blob-report
extracting: blob-report/report-chromium-firefox-1.zip
extracting: blob-report/report-chromium-firefox-2.zip
merging events
processing test events
building final report
finished building report

Job output in node:24.16.0-alpine (digest node@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14):

$ pnpm playwright merge-reports ./blob-report --reporter html
merging reports from /builds/floriday/sites/suppliers-portal/blob-report
extracting: blob-report/report-chromium-firefox-1.zip

(There is no further output from this command.) It appears that the Playwright report merge process simply exits once it attempts to unzip anything.

Edit: seems that updating Playwright to v1.60 fixed this, however.

[robjackstewart]

Can confirm that I am also experiencing this with cypress when running npx cypress install to install the binary. The process actually exists earlier than it should with a zero exit code.

[MikeMcC399]

@robjackstewart - You've already linked this. Just for other readers:

For Cypress, there is already a related PR cypress-io/cypress#33887 to work around the change

Cypress generally has a 2 week cadence between releases, so I'd expect a fix to be out soon for this.

[MikeMcC399]

extract-zip@2.0.1 (current latest), released Jun 10, 2020 and depends on "yauzl": "^2.10.0"

There is a related issue max-mapper/extract-zip#154

https://github.com/thejoshwolfe/yauzl#change-history shows a fix in yauzl@3.3.1

[MikeMcC399]

It doesn't look like the issue max-mapper/extract-zip#154 is getting any attention, and the latest release of extract-zip is already 6 years old.

Cypress has solved the issue by migrating to yauzl@3.3.1 and adding some additional coding.