From 0a29c2ed3dea803231cd2dc7402a3f11bfb1bbb8 Mon Sep 17 00:00:00 2001
From: Ryan Baier <moonlitforgeandtrades@gmail.com>
Date: Fri, 15 May 2026 17:36:09 -0700
Subject: [PATCH] fix(review): replace JSZip with fflate to eliminate dynamic
 script elements

JSZip's bundled immediate/setImmediate polyfills contain IE9-era
fallbacks that call document.createElement("script"). The branches
never run in Obsidian's Electron runtime, but Obsidian's review
scanner statically flags them as 4 dynamic script-element creations.

fflate is a modern, zero-dependency ZIP library with no such
polyfills. The swap also cuts the production bundle from ~315KB
to ~174KB.

Bump version to 0.1.2.
---
 CHANGELOG.md           |   5 ++
 manifest.json          |   2 +-
 package-lock.json      | 106 ++++-------------------------------------
 package.json           |   4 +-
 src/ui/import-modal.ts |  18 +++----
 versions.json          |   3 +-
 6 files changed, 26 insertions(+), 112 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9104e0e..e103073 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.2
+
+### Fixes
+- Replace JSZip with fflate for ZIP extraction. JSZip bundled IE-era setImmediate polyfills that dynamically create `<script>` elements, which Obsidian's security review flags. fflate has no such fallbacks and roughly halves the plugin bundle size.
+
 ## 0.1.1
 
 ### Fixes
diff --git a/manifest.json b/manifest.json
index ee435ea..2580f4f 100644
--- a/manifest.json
+++ b/manifest.json
@@ -1,7 +1,7 @@
 {
 	"id": "chat-splitter",
 	"name": "Chat Splitter",
-	"version": "0.1.1",
+	"version": "0.1.2",
 	"minAppVersion": "1.4.10",
 	"description": "Split long AI chat transcripts into organized, topic-specific notes.",
 	"author": "Ryan Baier",
diff --git a/package-lock.json b/package-lock.json
index 6dc7fb9..0c7bbab 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,15 +1,15 @@
 {
 	"name": "obsidian-chat-splitter",
-	"version": "0.1.0",
+	"version": "0.1.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "obsidian-chat-splitter",
-			"version": "0.1.0",
+			"version": "0.1.1",
 			"license": "MIT",
 			"dependencies": {
-				"jszip": "^3.10.1"
+				"fflate": "^0.8.3"
 			},
 			"devDependencies": {
 				"@types/node": "^22.0.0",
@@ -1496,12 +1496,6 @@
 			"dev": true,
 			"license": "MIT"
 		},
-		"node_modules/core-util-is": {
-			"version": "1.0.3",
-			"resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
-			"integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
-			"license": "MIT"
-		},
 		"node_modules/crelt": {
 			"version": "1.0.6",
 			"resolved": "https://registry.npmjs.org/crelt/-/crelt-1.0.6.tgz",
@@ -2696,6 +2690,12 @@
 				}
 			}
 		},
+		"node_modules/fflate": {
+			"version": "0.8.3",
+			"resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.3.tgz",
+			"integrity": "sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==",
+			"license": "MIT"
+		},
 		"node_modules/file-entry-cache": {
 			"version": "8.0.0",
 			"resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
@@ -3051,12 +3051,6 @@
 				"node": ">= 4"
 			}
 		},
-		"node_modules/immediate": {
-			"version": "3.0.6",
-			"resolved": "https://registry.npmjs.org/immediate/-/immediate-3.0.6.tgz",
-			"integrity": "sha512-XXOFtyqDjNDAQxVfYxuF7g9Il/IbWmmlQg2MYKOH8ExIT1qg6xc4zyS3HaEEATgs1btfzxq15ciUiY7gjSXRGQ==",
-			"license": "MIT"
-		},
 		"node_modules/import-fresh": {
 			"version": "3.3.1",
 			"resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz",
@@ -3084,12 +3078,6 @@
 				"node": ">=0.8.19"
 			}
 		},
-		"node_modules/inherits": {
-			"version": "2.0.4",
-			"resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-			"integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-			"license": "ISC"
-		},
 		"node_modules/internal-slot": {
 			"version": "1.1.0",
 			"resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.1.0.tgz",
@@ -3487,12 +3475,6 @@
 				"url": "https://github.com/sponsors/ljharb"
 			}
 		},
-		"node_modules/isarray": {
-			"version": "1.0.0",
-			"resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
-			"integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
-			"license": "MIT"
-		},
 		"node_modules/isexe": {
 			"version": "2.0.0",
 			"resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
@@ -3672,18 +3654,6 @@
 				"node": ">=4.0"
 			}
 		},
-		"node_modules/jszip": {
-			"version": "3.10.1",
-			"resolved": "https://registry.npmjs.org/jszip/-/jszip-3.10.1.tgz",
-			"integrity": "sha512-xXDvecyTpGLrqFrvkrUSoxxfJI5AH7U8zxxtVclpsUtMCq4JQ290LY8AW5c7Ggnr/Y/oK+bQMbqK2qmtk3pN4g==",
-			"license": "(MIT OR GPL-3.0-or-later)",
-			"dependencies": {
-				"lie": "~3.3.0",
-				"pako": "~1.0.2",
-				"readable-stream": "~2.3.6",
-				"setimmediate": "^1.0.5"
-			}
-		},
 		"node_modules/keyv": {
 			"version": "4.5.4",
 			"resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
@@ -3708,15 +3678,6 @@
 				"node": ">= 0.8.0"
 			}
 		},
-		"node_modules/lie": {
-			"version": "3.3.0",
-			"resolved": "https://registry.npmjs.org/lie/-/lie-3.3.0.tgz",
-			"integrity": "sha512-UaiMJzeWRlEujzAuw5LokY1L5ecNQYZKfmyZ9L7wDHb/p5etKaxXhohBcrw0EYby+G/NA52vRSN4N39dxHAIwQ==",
-			"license": "MIT",
-			"dependencies": {
-				"immediate": "~3.0.5"
-			}
-		},
 		"node_modules/locate-path": {
 			"version": "6.0.0",
 			"resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
@@ -4055,12 +4016,6 @@
 				"url": "https://github.com/sponsors/sindresorhus"
 			}
 		},
-		"node_modules/pako": {
-			"version": "1.0.11",
-			"resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
-			"integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==",
-			"license": "(MIT AND Zlib)"
-		},
 		"node_modules/parent-module": {
 			"version": "1.0.1",
 			"resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
@@ -4134,12 +4089,6 @@
 				"node": ">= 0.8.0"
 			}
 		},
-		"node_modules/process-nextick-args": {
-			"version": "2.0.1",
-			"resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
-			"integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
-			"license": "MIT"
-		},
 		"node_modules/prop-types": {
 			"version": "15.8.1",
 			"resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.8.1.tgz",
@@ -4169,21 +4118,6 @@
 			"dev": true,
 			"license": "MIT"
 		},
-		"node_modules/readable-stream": {
-			"version": "2.3.8",
-			"resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
-			"integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
-			"license": "MIT",
-			"dependencies": {
-				"core-util-is": "~1.0.0",
-				"inherits": "~2.0.3",
-				"isarray": "~1.0.0",
-				"process-nextick-args": "~2.0.0",
-				"safe-buffer": "~5.1.1",
-				"string_decoder": "~1.1.1",
-				"util-deprecate": "~1.0.1"
-			}
-		},
 		"node_modules/reflect.getprototypeof": {
 			"version": "1.0.10",
 			"resolved": "https://registry.npmjs.org/reflect.getprototypeof/-/reflect.getprototypeof-1.0.10.tgz",
@@ -4333,6 +4267,7 @@
 			"version": "5.1.2",
 			"resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
 			"integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+			"dev": true,
 			"license": "MIT"
 		},
 		"node_modules/safe-push-apply": {
@@ -4449,12 +4384,6 @@
 				"node": ">= 0.4"
 			}
 		},
-		"node_modules/setimmediate": {
-			"version": "1.0.5",
-			"resolved": "https://registry.npmjs.org/setimmediate/-/setimmediate-1.0.5.tgz",
-			"integrity": "sha512-MATJdZp8sLqDl/68LfQmbP8zKPLQNV6BIZoIgrscFDQ+RsvK/BxeDQOgyxKKoh0y/8h3BqVFnCqQ/gd+reiIXA==",
-			"license": "MIT"
-		},
 		"node_modules/shebang-command": {
 			"version": "2.0.0",
 			"resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
@@ -4568,15 +4497,6 @@
 				"node": ">= 0.4"
 			}
 		},
-		"node_modules/string_decoder": {
-			"version": "1.1.1",
-			"resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
-			"integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
-			"license": "MIT",
-			"dependencies": {
-				"safe-buffer": "~5.1.0"
-			}
-		},
 		"node_modules/string.prototype.matchall": {
 			"version": "4.0.12",
 			"resolved": "https://registry.npmjs.org/string.prototype.matchall/-/string.prototype.matchall-4.0.12.tgz",
@@ -5028,12 +4948,6 @@
 				"punycode": "^2.1.0"
 			}
 		},
-		"node_modules/util-deprecate": {
-			"version": "1.0.2",
-			"resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-			"integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
-			"license": "MIT"
-		},
 		"node_modules/w3c-keyname": {
 			"version": "2.2.8",
 			"resolved": "https://registry.npmjs.org/w3c-keyname/-/w3c-keyname-2.2.8.tgz",
diff --git a/package.json b/package.json
index f94b7e5..9aa7237 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "obsidian-chat-splitter",
-	"version": "0.1.1",
+	"version": "0.1.2",
 	"description": "Split long AI chat transcripts into organized, topic-specific notes.",
 	"main": "main.js",
 	"scripts": {
@@ -38,6 +38,6 @@
 		"typescript": "5.9.3"
 	},
 	"dependencies": {
-		"jszip": "^3.10.1"
+		"fflate": "^0.8.3"
 	}
 }
diff --git a/src/ui/import-modal.ts b/src/ui/import-modal.ts
index 7f144e1..fbc49fc 100644
--- a/src/ui/import-modal.ts
+++ b/src/ui/import-modal.ts
@@ -1,5 +1,5 @@
 import { Modal, Setting, Notice, type App } from 'obsidian';
-import JSZip from 'jszip';
+import { unzipSync, strFromU8 } from 'fflate';
 import type { ParsedConversation, Segment, ImportConfig, ChatSplitterSettings, SpeakerStyle } from '../types';
 import { GRANULARITY_PRESETS } from '../types';
 import { parseInput, detectFormat, listConversations, type InputFormat, type ParseOptions } from '../parsers';
@@ -204,26 +204,20 @@ export class ImportModal extends Modal {
 
 	private async extractZip(file: File): Promise<string> {
 		const buffer = await file.arrayBuffer();
-		const zip = await JSZip.loadAsync(buffer);
-		const jsonFiles: string[] = [];
-
-		zip.forEach((relativePath: string, entry: JSZip.JSZipObject) => {
-			if (!entry.dir && relativePath.endsWith('.json')) {
-				jsonFiles.push(relativePath);
-			}
-		});
+		const entries = unzipSync(new Uint8Array(buffer));
+		const jsonFiles = Object.keys(entries).filter(name => !name.endsWith('/') && name.endsWith('.json'));
 
 		if (jsonFiles.length === 0) {
 			throw new Error('No JSON files found in ZIP archive');
 		}
 
 		const targetFile = jsonFiles.find(f => f.includes('conversations')) || jsonFiles[0];
-		const content = await zip.file(targetFile)?.async('string');
-		if (!content) {
+		const bytes = entries[targetFile];
+		if (!bytes) {
 			throw new Error(`Could not read ${targetFile} from ZIP archive`);
 		}
 
-		return content;
+		return strFromU8(bytes);
 	}
 
 	private checkMultiConversation(badge: HTMLElement): void {
diff --git a/versions.json b/versions.json
index 993f719..d178a46 100644
--- a/versions.json
+++ b/versions.json
@@ -1,4 +1,5 @@
 {
 	"0.1.0": "1.4.10",
-	"0.1.1": "1.4.10"
+	"0.1.1": "1.4.10",
+	"0.1.2": "1.4.10"
 }