[SalesForce] Which external Javascript libraries work with Lightning Locker Service

The latest version of Chartjs should work fine but there is a known issue with D3 that make it not entirely strict mode compliant. There is a trivial chance to d3.js you can make that fixes this and we are working with D3 to get the fix into their codebase.

The CLI needs to be hinted using eslint annotations to suppress the errors it logs for unknown global symbols. The CLI and the linter it uses are not part of LockerService's implementation and its reported results are overly strict currently. The real answer is to run your components under locker and test them. The linter is only a starting point tool that helps highlight areas in bulk that might require attention.

You just forgotten to declare the variable zipFile, change the line

zipFile = new JSZip();

to this line:

var zipFile = new JSZip();

also I will recommend you to use the Salesforce Lightning CLI to check this kind of issues, its a heroku command line tool that check for this errors.

Follow this steps to install Salesforce Lightning CLI: https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/cli_intro.htm

UPDATE: In my personal org I tested the code you provided with a few modifications in an aura application and it worked fine. Here is the code:

App:

<aura:application >
    <ltng:require scripts="/resource/jszip/jszip.min.js" afterScriptsLoaded="{!c.onPress}"/>
</aura:application>

Js controller:

  ({
        onPress : function(component) {
            var packageXml = '<?xml version="1.0" encoding="UTF-8"?>' + 
                '<Package xmlns="http://soap.sforce.com/2006/04/metadata">' +
                '<version>35.0</version>' +
                '</Package>' ;

            var zipFile = new JSZip();
            zipFile.file('package.xml',packageXml,{base64: 'true'});
            var data = zipFile.generateAsync();
            alert(data);
        }
    })

I downloaded the last version (3.0.0) of jszip from their site and had the issue that the method generate() is deprecated, so I changed it to generateAsync() as is suggested in the upgrade guide.