@depup/file-type 22.0.1-depup.0 → 22.1.0-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/file-type
 
 | Field | Value |
 |-------|-------|
-| Original | [file-type](https://www.npmjs.com/package/file-type) @ 22.0.1 |
-| Processed | 2026-04-09 |
+| Original | [file-type](https://www.npmjs.com/package/file-type) @ 22.1.0 |
+| Processed | 2026-09-11 |
 | Smoke test | passed |
 | Deps updated | 0 |
 

package/changes.json

@@ -1,5 +1,5 @@
 {
   "bumped": {},
-  "timestamp": "2026-04-09T16:36:38.247Z",
+  "timestamp": "2026-09-11T16:12:02.029Z",
   "totalUpdated": 0
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/file-type",
-  "version": "22.0.1-depup.0",
+  "version": "22.1.0-depup.0",
   "description": "Detect the file type of a file, stream, or data (with updated dependencies)",
   "license": "MIT",
   "repository": "sindresorhus/file-type",
@@ -236,7 +236,8 @@
     "dat",
     "key",
     "numbers",
-    "pages"
+    "pages",
+    "iso"
   ],
   "dependencies": {
     "@tokenizer/inflate": "^0.4.1",
@@ -283,8 +284,8 @@
     "changes": {},
     "depsUpdated": 0,
     "originalPackage": "file-type",
-    "originalVersion": "22.0.1",
-    "processedAt": "2026-04-09T16:36:52.873Z",
+    "originalVersion": "22.1.0",
+    "processedAt": "2026-09-11T16:12:10.970Z",
     "smokeTest": "passed"
   }
 }

package/readme.md

@@ -306,6 +306,9 @@ They allow support for uncommon file types, non-binary formats, or customized de
 Detectors can be added via the constructor options or by directly modifying `FileTypeParser#detectors`.
 Detectors provided through the constructor are executed before the default ones.
 
+> [!NOTE]
+> Not safe for concurrent use. Create a new instance per call if you need concurrency.
+
 ### Example adding a detector
 
 ```js
@@ -461,6 +464,7 @@ MIME media subtypes prefixed with `x-ft-` are custom and defined by us. They are
 - [`ico`](https://en.wikipedia.org/wiki/ICO_(file_format)) - Windows icon file
 - [`ics`](https://en.wikipedia.org/wiki/ICalendar#Data_format) - iCalendar
 - [`indd`](https://en.wikipedia.org/wiki/Adobe_InDesign#File_format) - Adobe InDesign document
+- [`iso`](https://en.wikipedia.org/wiki/ISO_9660) - ISO 9660 disc image
 - [`it`](https://wiki.openmpt.org/Manual:_Module_formats#The_Impulse_Tracker_format_.28.it.29) - Audio module format: Impulse Tracker
 - [`j2c`](https://en.wikipedia.org/wiki/JPEG_2000) - JPEG 2000
 - [`jar`](https://en.wikipedia.org/wiki/JAR_(file_format)) - Java archive
@@ -575,6 +579,8 @@ MIME media subtypes prefixed with `x-ft-` are custom and defined by us. They are
 - [`zip`](https://en.wikipedia.org/wiki/Zip_(file_format)) - Archive file
 - [`zst`](https://en.wikipedia.org/wiki/Zstandard) - Archive file
 
+ISO 9660 requires random-access input or `fileTypeStream()` with `sampleSize >= 32_774`; `fileTypeFromStream()` is unsupported.
+
 *[Pull requests](.github/pull_request_template.md) are welcome for additional commonly used file types.*
 
 The following file types will not be accepted, but most of them are supported by [third-party detectors](#available-third-party-file-type-detectors).

package/source/detectors/zip.js

@@ -53,12 +53,17 @@ async function decompressDeflateRawWithLimit(data, {maximumLength = maximumZipEn
 
 			totalLength += value.length;
 			if (totalLength > maximumLength) {
-				await reader.cancel();
+				await reader.cancel().catch(() => {});
 				throw new Error(`ZIP entry decompressed data exceeds ${maximumLength} bytes`);
 			}
 
 			chunks.push(value);
 		}
+	} catch (error) {
+		// A ZIP entry with a data descriptor has an unknown compressed size, so the buffered data can contain bytes that follow the deflate stream. Node.js 24 rejects those, unlike other versions. The data decompressed so far is still valid and enough for detection.
+		if (error.code !== 'ERR_TRAILING_JUNK_AFTER_STREAM_END') {
+			throw error;
+		}
 	} finally {
 		reader.releaseLock();
 	}

package/source/index.d.ts

@@ -238,6 +238,9 @@ This method can be handy to put in a stream pipeline, but it comes with a price.
 */
 export function fileTypeStream(webStream: AnyWebReadableStream<Uint8Array>, options?: StreamOptions & FileTypeOptions): Promise<AnyWebReadableByteStreamWithFileType>;
 
+/**
+Not safe for concurrent use. Create a new instance per call if you need concurrency.
+*/
 export declare class FileTypeParser {
 	/**
 	File type detectors.

package/source/index.js

@@ -25,7 +25,7 @@ import {detectPng} from './detectors/png.js';
 import {detectAsf} from './detectors/asf.js';
 
 export const reasonableDetectionSizeInBytes = 4100; // A fair amount of file-types are detectable within this range.
-const maximumMpegOffsetTolerance = reasonableDetectionSizeInBytes - 2;
+const maximumMpegOffsetTolerance = reasonableDetectionSizeInBytes - 4; // Keep room for the 4 bytes of the frame header at the deepest scanned offset.
 const maximumNestedGzipDetectionSizeInBytes = maximumUntrustedSkipSizeInBytes;
 const maximumNestedGzipProbeDepth = 1;
 const unknownSizeGzipProbeTimeoutInMilliseconds = 100;
@@ -64,7 +64,7 @@ function getKnownFileSizeOrMaximum(fileSize) {
 
 // Keep the specifier non-literal at the call site so browser bundlers do not try to resolve Node-only imports.
 function importAtRuntime(specifier) {
-	return import(specifier);
+	return import(/* @vite-ignore */ /* webpackIgnore: true */ specifier);
 }
 
 // Wrap stream in an identity TransformStream to avoid BYOB readers.
@@ -1689,6 +1689,33 @@ export class FileTypeParser {
 				mime: 'application/pgp-encrypted',
 			};
 		}
+
+		// ISO 9660 optical disc image: the Volume Descriptor Set starts at sector 16 (2048-byte
+		// sectors). Every descriptor in that set carries the 5-byte standard identifier `CD001`
+		// at offset 1, regardless of descriptor type, so checking the first one is sufficient.
+		// Only attempted for random-access inputs (buffer/file/blob, or a stream sampled with a
+		// large enough `sampleSize`): on an unknown-size stream this offset is far past what's
+		// reasonable to buffer just to rule out one format, so it's left undetected there.
+		const isoStandardIdentifierOffset = 32_769;
+		const isoStandardIdentifierLength = 5;
+		if (
+			tokenizer.supportsRandomAccess()
+			&& tokenizer.fileInfo.size >= (isoStandardIdentifierOffset + isoStandardIdentifierLength)
+		) {
+			const isoStandardIdentifier = new Uint8Array(isoStandardIdentifierLength);
+			await tokenizer.peekBuffer(isoStandardIdentifier, {
+				position: isoStandardIdentifierOffset,
+				length: isoStandardIdentifierLength,
+				mayBeLess: true,
+			});
+
+			if (checkBytes(isoStandardIdentifier, stringToBytes('CD001'))) {
+				return {
+					ext: 'iso',
+					mime: 'application/x-iso9660-image',
+				};
+			}
+		}
 	};
 	// Detections with limited supporting data, resulting in a higher likelihood of false positives
 	detectImprecise = async tokenizer => {
@@ -1729,11 +1756,11 @@ export class FileTypeParser {
 			};
 		}
 
-		// Adjust buffer to `mpegOffsetTolerance`
-		await tokenizer.peekBuffer(this.buffer, {length: Math.min(2 + this.options.mpegOffsetTolerance, fileSize), mayBeLess: true});
+		// Adjust buffer to `mpegOffsetTolerance`, plus the 4 bytes of the frame header itself
+		await tokenizer.peekBuffer(this.buffer, {length: Math.min(4 + this.options.mpegOffsetTolerance, fileSize), mayBeLess: true});
 
 		// Check MPEG 1 or 2 Layer 3 header, or 'layer 0' for ADTS (MPEG sync-word 0xFFE)
-		if (this.buffer.length >= (2 + this.options.mpegOffsetTolerance)) {
+		if (this.buffer.length >= (4 + this.options.mpegOffsetTolerance)) {
 			for (let depth = 0; depth <= this.options.mpegOffsetTolerance; ++depth) {
 				const type = this.scanMpeg(depth);
 				if (type) {
@@ -1865,22 +1892,34 @@ export class FileTypeParser {
 	*/
 	scanMpeg(offset) {
 		if (this.check([0xFF, 0xE0], {offset, mask: [0xFF, 0xE0]})) {
+			// Both (ADTS) MPEG-2 and MPEG-4 are AAC
 			if (this.check([0x10], {offset: offset + 1, mask: [0x16]})) {
-				// Check for (ADTS) MPEG-2
-				if (this.check([0x08], {offset: offset + 1, mask: [0x08]})) {
-					return {
-						ext: 'aac',
-						mime: 'audio/aac',
-					};
-				}
-
-				// Must be (ADTS) MPEG-4
 				return {
 					ext: 'aac',
 					mime: 'audio/aac',
 				};
 			}
 
+			// An MPEG-1 Layer I header with CRC protection enabled is byte-identical to a UTF-16 LE BOM, so text files cannot be told apart from audio. `file(1)` disables MPEG-1 Layer I detection completely for this reason; we only drop the colliding variant.
+			if (this.check([0xFF, 0xFE], {offset})) {
+				return;
+			}
+
+			// Reject the reserved MPEG version `01`
+			if (this.check([0x08], {offset: offset + 1, mask: [0x18]})) {
+				return;
+			}
+
+			// Reject the `bad` (`1111`) bitrate index
+			if (this.check([0xF0], {offset: offset + 2, mask: [0xF0]})) {
+				return;
+			}
+
+			// Reject the reserved sampling frequency `11`
+			if (this.check([0x0C], {offset: offset + 2, mask: [0x0C]})) {
+				return;
+			}
+
 			// MPEG 1 or 2 Layer 3 header
 			// Check for MPEG layer 3
 			if (this.check([0x02], {offset: offset + 1, mask: [0x06]})) {

package/source/supported.js

@@ -184,6 +184,7 @@ export const extensions = [
 	'key',
 	'numbers',
 	'pages',
+	'iso',
 ];
 
 export const mimeTypes = [
@@ -365,4 +366,5 @@ export const mimeTypes = [
 	'application/vnd.apple.keynote',
 	'application/vnd.apple.numbers',
 	'application/vnd.apple.pages',
+	'application/x-iso9660-image',
 ];