Bump rubyzip from 3.2.2 to 3.6.0

[dependabot]

Bumps rubyzip from 3.2.2 to 3.6.0.

Release notes

Sourced from rubyzip's releases.

v3.6.0

Version 3.6.0

The 3.6.x line lazy-loads OpenSSL only when really needed (for faster start-up times) and clamps internal (DOS-based) dates and times to the allowed range. See README.md for details.

⚠️ There are breaking changes in the 3.x series ⚠️

Please see the README and Updating to version 3.x in the wiki for help upgrading from version 2.4.x to version 3.x.

v3.5.0

Version 3.5.0

The 3.5.x line adds the ability to set a Decrypter per-Entry as opposed to only per-InputStream. See README.md for details.

⚠️ There are breaking changes in the 3.x series ⚠️

Please see the README and Updating to version 3.x in the wiki for help upgrading from version 2.4.x to version 3.x.

v3.4.1

Version 3.4.1

The 3.4.x line adds lib/rubyzip.rb to make including rubyzip in your Gemfile easier. See README.md for details.

⚠️ There are breaking changes in the 3.x series ⚠️

Please see the README and Updating to version 3.x in the wiki for help upgrading from version 2.4.x to version 3.x.

v3.4.0

Version 3.4.0

3.4.0 adds lib/rubyzip.rb to make including rubyzip in your Gemfile easier. See README.md for details.

⚠️ There are breaking changes in the 3.x series ⚠️

Please see the README and Updating to version 3.x in the wiki for help upgrading from version 2.4.x to version 3.x.

v3.3.1

Version 3.3.1

The 3.3.x line ensures that Zip::InputStream behaves more like standard Ruby IO classes.

⚠️ There are breaking changes in the 3.x series ⚠️

Please see the README and Updating to version 3.x in the wiki for help upgrading from version 2.4.x to version 3.x.

v3.3.0

Version 3.3.0

The 3.3.x line ensures that Zip::InputStream behaves more like standard Ruby IO classes.

... (truncated)

Changelog

Sourced from rubyzip's changelog.

3.6.0 (2026-09-01)

• Forward options from OutputStream.open without a block. #674
• Clamp DOS date and time to the range the fields can hold. #671

Tooling/internal:

• Unix owner ids no longer default to 0 (root).
• Legacy Unix owner ids no longer default to 0 (root).
• Handle short reads in copy_stream_n. #675
• Retain required Zip64 offset fields. #676
• Load openssl only when AES encryption is used. #672

3.5.0 (2026-08-18)

• Fix the link to Ruby doc in README to the latest version. #670
• Support passing decrypter to encrypted entry via get_input_stream. #667

3.4.1 (2026-06-27)

• Fixed DecryptedIo to only perform integrity once. #665

3.4.0 (2026-06-14)

• Prevent entries from being extracted outside specified directory. #664. Thanks to @​connorshea for additional reporting on this.
• Use SecureRandom in place of insecure Random.
• Stop reading the central directory on first error.
• Add a check on number of declared entries in a zip file. Thanks to @​connorshea for reporting this.
• Add note to README re reporting security issues privately.
• Add lib/rubyzip.rb for Bundler auto-require. #660

Tooling/internal:

• Replace the test Excel spreadsheet fixture.
• Use assert_silent shorthand when expecting no output from a test.
• Clean up CentralDirectory instance variables.
• Add Ruby 4.0 to the Windows CI and update CI matrix in the README.
• List ZIP docs that we store here and link to online versions. #657

3.3.1 (2026-05-30)

• Reinstate default param for InputStream#sysread. #663

3.3.0 (2026-05-02)

• Refactor InputStream and AbstractInputStream. #661

Tooling/internal:

... (truncated)

Commits

• a31f40c Update Changelog for release.
• defb7bf Unix owner ids no longer default to 0 (root).
• bb755dd Legacy Unix owner ids no longer default to 0 (root).
• abc248c Handle short reads in copy_stream_n
• 045062d Retain required Zip64 offset fields
• c2ea155 Test blockless output stream options
• 0600350 Forward options from OutputStream.open without a block
• 096d2f4 Bump minor version number due to latest changes.
• 17474a1 Clamp DOS date and time to the range the fields can hold
• 6362d8a Stop RUBYOPT leaking into the require test subprocesses
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)