Lua library for MDZip: pure Lua, no dependencies

November 6, 2026 · Announcement

Lua logo and the MDZip mark

MDZip's fifth core library is for Lua. mdzip-core-lua reads, writes and validates .mdz files, and passes the same shared conformance tests from the specification as the .NET, JavaScript, Python and Rust libraries. A file written in Lua opens the same way in every other MDZip tool.

luarocks install mdzip-core-lua

local mdzip = require("mdzip")

assert(mdzip.create_file("trip.mdz", {
  files = {
    { path = "index.md", text = "# Trip notes\n\n![Beach](images/beach.png)\n" },
    { path = "images/beach.png", data = png },
  },
}))

local archive = assert(mdzip.open_file("trip.mdz"))
local text = assert(archive:read_text(assert(archive:entry_point())))   -- index.md

Pure Lua, nothing to compile

The library is plain Lua 5.3 or 5.4 with no C modules and no dependencies. ZIP, DEFLATE, CRC-32, JSON and Unicode normalization are all built in, so it installs the same way on every platform and runs in hosts that can't load C modules, such as Pandoc's built-in Lua.

What it does

Write conforming files. Every archive gets the manifest.json the specification requires, with the main document recorded, so other tools open the right file.
Change files safely. Updating an archive keeps everything you didn't touch, including images, files your app doesn't know about and manifest fields other apps wrote. If the change would break the archive, nothing is written.
Open untrusted files safely. Unsafe paths, ZIP bombs and symbolic links are rejected or ignored, with a stable error code. Functions that can fail return nil, err, the usual Lua convention.

LuaJIT and Lua 5.1, which Neovim and several game engines use, aren't supported yet.

What's next

A Pandoc reader and writer built on this library is in progress, for converting .mdz to and from Word, EPUB, HTML and the other formats Pandoc supports.

If you're adding .mdz support to an app, Core libraries compares all five, and Works with MDZip shows everything that reads and writes it today.

Lua on LuaRocks · Source and API reference · Release notes

Comment on GitHub

This post renders from 2026-11-06-lua-library-for-mdzip-pure-lua-no-dependencies.mdz (MDZip, ~24 KB) — one self-contained file. Download it, open it in the web editor, or read how these pages are made.