file-type 22.0.0 → 22.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "file-type",
-	"version": "22.0.0",
+	"version": "22.0.2",
 	"description": "Detect the file type of a file, stream, or data",
 	"license": "MIT",
 	"repository": "sindresorhus/file-type",
@@ -241,6 +241,7 @@
 		"@types/node": "^25.5.0",
 		"ava": "^7.0.0",
 		"commonmark": "^0.31.2",
+		"esbuild": "^0.28.0",
 		"get-stream": "^9.0.1",
 		"tsd": "^0.33.0",
 		"xo": "^2.0.2"

package/readme.md

@@ -306,6 +306,9 @@ They allow support for uncommon file types, non-binary formats, or customized de
 Detectors can be added via the constructor options or by directly modifying `FileTypeParser#detectors`.
 Detectors provided through the constructor are executed before the default ones.
 
+> [!NOTE]
+> Not safe for concurrent use. Create a new instance per call if you need concurrency.
+
 ### Example adding a detector
 
 ```js

package/source/detectors/zip.js

@@ -53,12 +53,17 @@ async function decompressDeflateRawWithLimit(data, {maximumLength = maximumZipEn
 
 			totalLength += value.length;
 			if (totalLength > maximumLength) {
-				await reader.cancel();
+				await reader.cancel().catch(() => {});
 				throw new Error(`ZIP entry decompressed data exceeds ${maximumLength} bytes`);
 			}
 
 			chunks.push(value);
 		}
+	} catch (error) {
+		// A ZIP entry with a data descriptor has an unknown compressed size, so the buffered data can contain bytes that follow the deflate stream. Node.js 24 rejects those, unlike other versions. The data decompressed so far is still valid and enough for detection.
+		if (error.code !== 'ERR_TRAILING_JUNK_AFTER_STREAM_END') {
+			throw error;
+		}
 	} finally {
 		reader.releaseLock();
 	}

package/source/index.d.ts

@@ -238,6 +238,9 @@ This method can be handy to put in a stream pipeline, but it comes with a price.
 */
 export function fileTypeStream(webStream: AnyWebReadableStream<Uint8Array>, options?: StreamOptions & FileTypeOptions): Promise<AnyWebReadableByteStreamWithFileType>;
 
+/**
+Not safe for concurrent use. Create a new instance per call if you need concurrency.
+*/
 export declare class FileTypeParser {
 	/**
 	File type detectors.

package/source/index.js

@@ -25,7 +25,7 @@ import {detectPng} from './detectors/png.js';
 import {detectAsf} from './detectors/asf.js';
 
 export const reasonableDetectionSizeInBytes = 4100; // A fair amount of file-types are detectable within this range.
-const maximumMpegOffsetTolerance = reasonableDetectionSizeInBytes - 2;
+const maximumMpegOffsetTolerance = reasonableDetectionSizeInBytes - 4; // Keep room for the 4 bytes of the frame header at the deepest scanned offset.
 const maximumNestedGzipDetectionSizeInBytes = maximumUntrustedSkipSizeInBytes;
 const maximumNestedGzipProbeDepth = 1;
 const unknownSizeGzipProbeTimeoutInMilliseconds = 100;
@@ -62,6 +62,11 @@ function getKnownFileSizeOrMaximum(fileSize) {
 	return Math.max(0, fileSize);
 }
 
+// Keep the specifier non-literal at the call site so browser bundlers do not try to resolve Node-only imports.
+function importAtRuntime(specifier) {
+	return import(specifier);
+}
+
 // Wrap stream in an identity TransformStream to avoid BYOB readers.
 // Node.js has a bug where calling controller.close() inside a BYOB stream's
 // pull() callback does not resolve pending reader.read() calls, causing
@@ -258,8 +263,8 @@ export class FileTypeParser {
 		this.options.signal?.throwIfAborted();
 		// TODO: Remove this when `strtok3.fromFile()` safely rejects non-regular filesystem objects without a pathname race.
 		const [{default: fsPromises}, {FileTokenizer}] = await Promise.all([
-			import('node:fs/promises'),
-			import('strtok3'),
+			importAtRuntime('node:fs/promises'),
+			importAtRuntime('strtok3'),
 		]);
 		const fileHandle = await fsPromises.open(path, fsPromises.constants.O_RDONLY | fsPromises.constants.O_NONBLOCK);
 		const fileStat = await fileHandle.stat();
@@ -1724,11 +1729,11 @@ export class FileTypeParser {
 			};
 		}
 
-		// Adjust buffer to `mpegOffsetTolerance`
-		await tokenizer.peekBuffer(this.buffer, {length: Math.min(2 + this.options.mpegOffsetTolerance, fileSize), mayBeLess: true});
+		// Adjust buffer to `mpegOffsetTolerance`, plus the 4 bytes of the frame header itself
+		await tokenizer.peekBuffer(this.buffer, {length: Math.min(4 + this.options.mpegOffsetTolerance, fileSize), mayBeLess: true});
 
 		// Check MPEG 1 or 2 Layer 3 header, or 'layer 0' for ADTS (MPEG sync-word 0xFFE)
-		if (this.buffer.length >= (2 + this.options.mpegOffsetTolerance)) {
+		if (this.buffer.length >= (4 + this.options.mpegOffsetTolerance)) {
 			for (let depth = 0; depth <= this.options.mpegOffsetTolerance; ++depth) {
 				const type = this.scanMpeg(depth);
 				if (type) {
@@ -1860,22 +1865,34 @@ export class FileTypeParser {
 	*/
 	scanMpeg(offset) {
 		if (this.check([0xFF, 0xE0], {offset, mask: [0xFF, 0xE0]})) {
+			// Both (ADTS) MPEG-2 and MPEG-4 are AAC
 			if (this.check([0x10], {offset: offset + 1, mask: [0x16]})) {
-				// Check for (ADTS) MPEG-2
-				if (this.check([0x08], {offset: offset + 1, mask: [0x08]})) {
-					return {
-						ext: 'aac',
-						mime: 'audio/aac',
-					};
-				}
-
-				// Must be (ADTS) MPEG-4
 				return {
 					ext: 'aac',
 					mime: 'audio/aac',
 				};
 			}
 
+			// An MPEG-1 Layer I header with CRC protection enabled is byte-identical to a UTF-16 LE BOM, so text files cannot be told apart from audio. `file(1)` disables MPEG-1 Layer I detection completely for this reason; we only drop the colliding variant.
+			if (this.check([0xFF, 0xFE], {offset})) {
+				return;
+			}
+
+			// Reject the reserved MPEG version `01`
+			if (this.check([0x08], {offset: offset + 1, mask: [0x18]})) {
+				return;
+			}
+
+			// Reject the `bad` (`1111`) bitrate index
+			if (this.check([0xF0], {offset: offset + 2, mask: [0xF0]})) {
+				return;
+			}
+
+			// Reject the reserved sampling frequency `11`
+			if (this.check([0x0C], {offset: offset + 2, mask: [0x0C]})) {
+				return;
+			}
+
 			// MPEG 1 or 2 Layer 3 header
 			// Check for MPEG layer 3
 			if (this.check([0x02], {offset: offset + 1, mask: [0x06]})) {