[dependabot]

Bumps zip from 8.6.0 to 9.0.5.

Release notes

Sourced from zip's releases.

v9.0.5

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#1079)

v9.0.4

🐛 Bug Fixes

• enclosed_name rejects a separator inside one verbatim path component (#1066)
• return Ok(None) when read_zipfile_from_stream is called on an empty archive (#1063)

⚙️ Miscellaneous Tasks

• Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#1065)
• update lzma-rust2 and ppmd-rust dependencies (#1060)

v9.0.3

🐛 Bug Fixes

• Preserve directories' read-only status when extracting on non-Unix systems (#1054)

v9.0.1

🐛 Bug Fixes

• set_permissions was still following symlinks in non-streaming extraction (#1038)
• two arithmetic overflows in the implode decoder (#1028)
• reject an empty archive whose central directory offset is past the EOCD (#1025)
• don't panic when two entries extract to the same path (#1023)
• fail reads that exceed the declared uncompressed size (#1022)
• shrink decoder skipped LZW code 8191 (#1029)
• write only the sentinel-marked values in a central ZIP64 field (#1027)

v9.0.0

🚀 Features

• add ZipFileBuilder for parallelizing compression (#911)
• add method by_index_with_data_descriptor (#994)
• add len, is_empty and entry to ZipArchiveMetadata (#1015)
• read data descriptor from binary (#990)
• add comment and test for ZipStreamReader and symlinks (#985)
• (write) add ZipWriter::hide_file for in-place entry deletion (#924)
• add compression (#948)
• add test to in place modification (#945)
• move CustomExtraField to own file (#941)
• add a test on enum size (#939)

... (truncated)

Changelog

Sourced from zip's changelog.

9.0.5 - 2026-10-17

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#1079)

9.0.4 - 2026-10-16

🐛 Bug Fixes

• enclosed_name rejects a separator inside one verbatim path component (#1066)
• return Ok(None) when read_zipfile_from_stream is called on an empty archive (#1063)

⚙️ Miscellaneous Tasks

• Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#1065)
• update lzma-rust2 and ppmd-rust dependencies (#1060)

9.0.3 - 2026-10-13

🐛 Bug Fixes

• Preserve directories' read-only status when extracting on non-Unix systems (#1054)

9.0.2 - 2026-10-11

🐛 Bug Fixes

• additional bug fixes for symlink extraction

9.0.1 - 2026-10-10

🐛 Bug Fixes

• set_permissions was still following symlinks in non-streaming extraction (#1038)
• two arithmetic overflows in the implode decoder (#1028)
• reject an empty archive whose central directory offset is past the EOCD (#1025)
• don't panic when two entries extract to the same path (#1023)
• fail reads that exceed the declared uncompressed size (#1022)
• shrink decoder skipped LZW code 8191 (#1029)
• write only the sentinel-marked values in a central ZIP64 field (#1027)

9.0.0 - 2026-10-08

🚀 Features

... (truncated)

Commits

• 0123ed1 chore: release v9.0.5 (#1093)
• 00cf82b docs: Repeal policy of yanking versions with known vulnerabilities, add menti...
• 52165b9 chore: Enable release-plz on backport branches in future (#1079)
• ca51e64 docs: Remove doc links that break when doc build doesn't enable all features ...
• 6639687 fix: use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• 5e06fa8 fix(write): prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)
• b6f9fb8 Merge commit from fork
• ea2ccfe Merge commit from fork
• 8068ab4 Merge commit from fork
• 0b51128 doc: Clarifications to security policy (#1074)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Bumps zip from 8.6.0 to 9.0.5 in /src-tauri, the first major release since 8.x. The update pulls in several security and correctness fixes: symlink extraction no longer follows symlinks, reads that exceed the declared uncompressed size now fail, and two arithmetic overflows in the implode decoder are fixed.

Dependencies

• Also updates transitive dependencies lzma-rust2, ppmd-rust, zstd, and constant_time_eq.

^{Written for commit 1da3c3f. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d0760ffa-f39f-42a8-b49d-cb1c309c2768

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[github-actions]

Thanks for your first pull request! Please make sure you've gone through this checklist:

• cargo fmt --manifest-path src-tauri/Cargo.toml --check passes
• npx oxlint . passes
• All tests pass (cargo test and npx vitest run)
• CHANGELOG.md updated under [Unreleased]

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​zip@​8.6.0 ⏵ 9.0.5	+1	+75	+6

View full report