From a4a67f2cdd91ddde9dd9ec97bed3478bbd849440 Mon Sep 17 00:00:00 2001
From: Tom Moor <tom@getoutline.com>
Date: Wed, 27 May 2026 20:33:33 -0400
Subject: [PATCH] fix: Upgrade yauzl, improve stream close handling

---
 package.json              |  2 +-
 server/utils/ZipHelper.ts | 25 +++++++++++++++++++++++--
 yarn.lock                 | 10 +++++-----
 3 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/package.json b/package.json
index e58a5cf2a6..e53b4c3631 100644
--- a/package.json
+++ b/package.json
@@ -270,7 +270,7 @@
     "y-indexeddb": "^9.0.12",
     "y-prosemirror": "^1.3.7",
     "y-protocols": "^1.0.7",
-    "yauzl": "^3.2.1",
+    "yauzl": "^3.3.1",
     "yazl": "^3.3.1",
     "yjs": "^13.6.30",
     "zod": "^4.3.6"
diff --git a/server/utils/ZipHelper.ts b/server/utils/ZipHelper.ts
index f54faebef2..7a735bf3cc 100644
--- a/server/utils/ZipHelper.ts
+++ b/server/utils/ZipHelper.ts
@@ -151,6 +151,7 @@ export default class ZipHelper {
                     }
                     const chunks: Buffer[] = [];
                     let bytesRead = 0;
+                    let settled = false;
                     readStream.on("data", (chunk: Buffer) => {
                       bytesRead += chunk.length;
                       if (bytesRead > maxSize) {
@@ -161,8 +162,28 @@ export default class ZipHelper {
                       }
                       chunks.push(chunk);
                     });
-                    readStream.on("end", () => res(Buffer.concat(chunks)));
-                    readStream.on("error", rej);
+                    readStream.on("end", () => {
+                      if (!settled) {
+                        settled = true;
+                        res(Buffer.concat(chunks));
+                      }
+                    });
+                    readStream.on("error", (err) => {
+                      if (!settled) {
+                        settled = true;
+                        rej(err);
+                      }
+                    });
+                    readStream.on("close", () => {
+                      if (!settled) {
+                        settled = true;
+                        rej(
+                          new Error(
+                            `Stream closed before completing read of ${fileName}`
+                          )
+                        );
+                      }
+                    });
                   });
                 }),
             };
diff --git a/yarn.lock b/yarn.lock
index a658d57e87..1946f529ba 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -15365,7 +15365,7 @@ __metadata:
     y-indexeddb: "npm:^9.0.12"
     y-prosemirror: "npm:^1.3.7"
     y-protocols: "npm:^1.0.7"
-    yauzl: "npm:^3.2.1"
+    yauzl: "npm:^3.3.1"
     yazl: "npm:^3.3.1"
     yjs: "npm:^13.6.30"
     zod: "npm:^4.3.6"
@@ -20868,13 +20868,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"yauzl@npm:^3.2.1":
-  version: 3.3.0
-  resolution: "yauzl@npm:3.3.0"
+"yauzl@npm:^3.3.1":
+  version: 3.3.1
+  resolution: "yauzl@npm:3.3.1"
   dependencies:
     buffer-crc32: "npm:~0.2.3"
     pend: "npm:~1.2.0"
-  checksum: 10c0/935e32054171104bdf8a4091180f61b5698d8b90ee64552bb643c2176f815d4215d0764e3f41e0d9a1e4525b37602bf145ec5fd39dd014f0be7290851ce3acce
+  checksum: 10c0/e396b070abb0c528cd4df3b86907142f72e09d5bc1edac262cebbff5b045e3091528a5e54e10a9a7209b031ba94bdcb1ad1ec6d85eecd69ad428bcb4a5c914ae
   languageName: node
   linkType: hard