Skip to content

chore(deps): update rust crate zip to v9 - #3698

Merged
lucasfernog merged 3 commits into
v2from
renovate/zip-9.x
Oct 16, 2026
Merged

chore(deps): update rust crate zip to v9#3698
lucasfernog merged 3 commits into
v2from
renovate/zip-9.x

Conversation

@renovate

@renovate renovate Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending
zip dependencies major 4 → 9 9.0.3

Release Notes

zip-rs/zip2 (zip)

v9.0.2

Compare Source

🐛 Bug Fixes
  • additional bug fixes for symlink extraction

v9.0.1

Compare Source

🐛 Bug Fixes
  • set_permissions was still following symlinks in non-streaming extraction (#​1038)
  • two arithmetic overflows in the implode decoder (#​1028)
  • reject an empty archive whose central directory offset is past the EOCD (#​1025)
  • don't panic when two entries extract to the same path (#​1023)
  • fail reads that exceed the declared uncompressed size (#​1022)
  • shrink decoder skipped LZW code 8191 (#​1029)
  • write only the sentinel-marked values in a central ZIP64 field (#​1027)

v9.0.0

Compare Source

🚀 Features
  • add ZipFileBuilder for parallelizing compression (#​911)
  • add method by_index_with_data_descriptor (#​994)
  • add len, is_empty and entry to ZipArchiveMetadata (#​1015)
  • read data descriptor from binary (#​990)
  • add comment and test for ZipStreamReader and symlinks (#​985)
  • (write) add ZipWriter::hide_file for in-place entry deletion (#​924)
  • add compression (#​948)
  • add test to in place modification (#​945)
  • move CustomExtraField to own file (#​941)
  • add a test on enum size (#​939)
  • use ZipFileEntry instead of ZipStreamFileMetadata (#​935)
  • add ZipFileEntry with no Reader (#​933)
  • change aes_mode to aes_settings() in ZipFileData (#​925)
  • cleanup and harmonize extra fields (#​923)
  • Rewrite zip64 extra (#​913)
🐛 Bug Fixes
  • reading an empty AES entry again at EOF returns Ok(0) (#​1024)
  • reject ZIP64 sizes that overflow u64 when computing data end offsets (#​1036)
  • apply central directory metadata in ZipStreamReader, only to written entries (#​1030)
  • consume the whole extended timestamp field in the central header (#​1016)
  • parse the central header of the extended timestamp (#​1002)
  • don't pre-allocate the declared size in the legacy decoders (#​991)
  • Symlink with very large declared size could lead to out-of-memory panic (#​984)
  • copy extra fields in raw_copy_file (#​955) (#​982)
  • add unix_mode when copy_raw_file (#​981)
  • rewrite documentation of add_symlink_from_path (#​979)
  • ignore a ZIP64 extra field that no sentinel asked for (#​962)
  • do not set data descriptor if directory (#​973)
  • expose flags function for easier access (#​972)
  • preserve unix permission in raw_copy_file (#​956)
  • clippy warning on nightly (#​960)
  • remove extra alloc used to copy (#​938)
  • lazy allocation on error case (#​937)
  • fix data alignment (#​929)
🚜 Refactor
  • move extract to own file (#​1009)
  • cleanup permissions related code (#​961)
  • remove feature gate (#​949)
  • create ZipFileFlags to wrap flags (#​947)
  • remove unused trait (#​946)
  • access crate::format with zip::unstable::format (#​944)
  • harmonize functions to format/functions.rs (#​943)
  • rewrite make_reader() function (#​936)
  • simplify initialize_local_block (#​934)
  • move write options to write/options.rs (#​931)
  • move spec to format (#​932)
  • move Magic to format (#​930)
  • [breaking] Remove ZipFileData::extra_data_start field that is never read (#​926)
⚙️ Miscellaneous Tasks
  • Fix high-level symlink extraction logic, disable some tests in miri, and fix some typos (#​1035)
Fix
  • some permissions tests can only run on Unix (#​1000)

v8.6.0

Compare Source

🚀 Features
  • add compression not supported as enum error (#​774)
🐛 Bug Fixes
  • allow for [u8] as filename (#​775)
🚜 Refactor
  • mark ZipFlags as non-exhaustive and add test for HasZipMetadata (#​777)
  • use and simplify is_dir (#​776)

v8.5.1

Compare Source

🚜 Refactor
  • change magic finder to stack buffer (#​763)
  • simplify extra field parsing (#​764)

v8.5.0

Compare Source

🐛 Bug Fixes
  • remove zip64 comment and add zip64 extensible data sector (#​747)
🚜 Refactor
  • remove useless magic in struct (#​730)
  • change extra_field from Arc<Vec> to Arc<[u8]> (#​741)
⚙️ Miscellaneous Tasks

v8.4.0

Compare Source

🚀 Features
  • add a check for building benches (#​748)
🚜 Refactor
  • split part of read.rs for code readability (#​744)
  • remove unused allow (#​745)
⚡ Performance
  • skip BufReader for Stored files in make_reader (#​739)
⚙️ Miscellaneous Tasks
  • move pull request template to correct folder (#​749)

v8.3.1

Compare Source

🚜 Refactor
  • use AexEncryption::new (#​736)
  • update tests to add big endian miri check (#​735)
⚙️ Miscellaneous Tasks
  • cleanup repository files (#​743)

v8.3.0

Compare Source

🚀 Features
  • add must_use (#​727)
  • improve and fix extended timestamp extra field parsing (#​713)
  • add crc32 ignore option (#​710)
  • path related code in single file (#​712)
🐛 Bug Fixes
🚜 Refactor
  • refactor some imports (#​734)
  • move code to distinct file (datetime, FixedSizeBlock) (#​733)
  • move stream code to src/read/stream.rs (#​731)
  • remove zip64 extra field update (#​732)
  • improve part of the code with clippy help (#​725)
  • simplify code for unicode extra field and improve error message (#​724)
  • reorganize code (#​714)
Deps
  • avoid pulling in zeroize_derive (#​720)

v8.2.0

Compare Source

🚀 Features
  • allow custom salt (#​680)
  • Support compressing bzip2 when feature bzip2-rs is enabled, since bzip2/bzip2-sys now supports it (#​685)
  • enforce clippy in CI (#​674)
🐛 Bug Fixes
  • zip64 central header (issue 617) (#​629)
  • allow aes password as bytes (#​686)
  • handle extra field padding (#​682)
🚜 Refactor
  • Simplify 2 type conversions in src/write.rs (#​687)
⚡ Performance
  • AI tweaks for string type conversions in src/types.rs (#​670)

v8.1.0

Compare Source

🚀 Features
  • (writer) Allow getting underlying writer of ZipWriter (#​464)
  • add system to FileOption, so byte-for-byte identical archives can be created across platforms (#​660)
🐛 Bug Fixes
  • Bugs in extra-data length calculation in src/write.rs (#​662)

v8.0.0

Compare Source

🚀 Features
  • document zip flags as enum (#​639)
  • Migrate to Rust 2024 (#​650)
  • [breaking] Remove deprecated methods of DateTime (#​597)

v7.4.0

Compare Source

🚀 Features
  • Increase MSRV to 1.88 and update dependencies (#​626)

v7.3.0

Compare Source

🚀 Features
  • cleanup the benchmarks and Cargo.toml (#​606)
  • Add support for per-file comments (#​543)
🐛 Bug Fixes
  • Document feature unreserved and make the mapping of extra fields public (#​616)
  • Return an error if abort_file() fails when exceeding non-large-file limit (#​598)
⚙️ Miscellaneous Tasks
  • Bump version to 7.3.0 (semver checks fail if it's still 7.3.0-pre1)

v7.2.0

Compare Source

🚀 Features
  • add read_zipfile_from_stream_with_compressed_size (#​70)
  • Allow choosing bzip2 rust backend (#​329)
🐛 Bug Fixes
  • Need to include zip64 extra field in central directory (fix #​353) (#​360)
  • Fails to extract file which might or might not be malformed (#​376) (#​426)
  • (aes) Allow AES encryption while streaming (#​463)
  • Default "platform" field in zip files should be set to the local platform, rather than always "Unix" (#​470) (#​471)
🚜 Refactor
  • Define cfg_if! and cfg_if_expr! internal macros (#​438)
⚡ Performance
  • Change an assert to debug_assert when encrypting/decrypting AES, and eliminate a fallible operation (#​521)
  • eliminate a String clone per new file added to archive, and other related refactors (#​522)

v7.1.0

Compare Source

🚀 Features
  • display the underlying error in Display impl for ZipError (#​483)
  • Enable creation of ZipArchive without reparsing (#​485)
🐛 Bug Fixes
  • Return InvalidPassword rather than panic when AES key is the wrong length (#​457)
  • bench with auto zip64 comment (#​505)
  • add condition for getrandom dependency (#​504)
  • (zipcrypto) Support streaming ZipCrypto encryption, don't store entire file in memory (#​462)
🚜 Refactor
  • Clean up imports and move types (#​461)
  • Replace handwritten Ord and PartialOrd for DateTime (#​484)
⚙️ Miscellaneous Tasks
  • Lock lzma-rust2 to at least 0.15.5 (#​491)

v7.0.0

Compare Source

⚠️ Breaking Changes
  • Removed the following features: getrandom, hmac, pbkdf2, sha1, zeroize.
  • Removed lzma-static and xz-static feature flags, which were deprecated synonyms of lzma and xz. (#​405, #​425)
🚀 Features
  • (SimpleFileOptions) const DEFAULT implementation (#​474)
  • ZipWriter set_auto_large_file() method to enable large-file data descriptor when necessary (#​468)
🐛 Bug Fixes
  • print previous error when failing to search another cde (#​460)
  • cargo doc warnings (#​472)
  • Write ZIP64 data descriptors when large_file option is true (#​467)
  • Pin generic-array to an old version to work around RustCrypto/traits#2036 until next RustCrypto & aes-crypto releases (#​458)
⚙️ Miscellaneous Tasks
  • Revert version bump so that release-plz will trigger
  • expose more flate2 feature flags (#​476)
  • Next release will be 7.0.0
  • release v6.0.0 (#​442)
Deps
  • Bump lzma-rust2 to v0.15 (#​465)

v6.0.0

Compare Source

⚠️ Breaking Changes
  • Removed the following features: getrandom, hmac, pbkdf2, sha1, zeroize.
  • Removed lzma-static and xz-static feature flags, which were deprecated synonyms of lzma and xz. (#​405, #​425)
🚀 Features
  • (SimpleFileOptions) const DEFAULT implementation (#​474)
  • ZipWriter set_auto_large_file() method to enable large-file data descriptor when necessary (#​468)
🐛 Bug Fixes
  • print previous error when failing to search another cde (#​460)
  • cargo doc warnings (#​472)
  • Write ZIP64 data descriptors when large_file option is true (#​467)
  • Pin generic-array to an old version to work around RustCrypto/traits#2036 until next RustCrypto & aes-crypto releases (#​458)
⚙️ Miscellaneous Tasks
  • Revert version bump so that release-plz will trigger
  • expose more flate2 feature flags (#​476)
  • Next release will be 7.0.0
  • release v6.0.0 (#​442)
Deps
  • Bump lzma-rust2 to v0.15 (#​465)

v5.1.1

Compare Source

🐛 Bug Fixes
  • panic when reading empty extended-timestamp field (#​404) (#​422)
  • Restore original file timestamp when unzipping with chrono (#​46)
⚙️ Miscellaneous Tasks
  • Configure Amazon Q rules (#​421)

v5.1.0

Compare Source

🚀 Features
  • Add legacy shrink/reduce/implode compression (#​303)

v5.0.1

Compare Source

🐛 Bug Fixes
  • AES metadata was not copied correctly in raw copy methods, which could corrupt the copied file. (#​417)

v5.0.0

Compare Source

🚀 Features
  • Implement by_path*() methods on ZipArchive (#​382)

v4.6.1

Compare Source

🐛 Bug Fixes
  • Fixes an issue introduced by the swap from lzma-rs to liblzma (#​407)

v4.6.0

Compare Source

🚀 Features
  • Allow to read zip files with unsupported extended timestamps (#​400)
🐛 Bug Fixes
  • enable clamp_opt for ppmd and xz (#​401)

v4.5.0

Compare Source

🚀 Features
  • Allow reading ZIP files where the central directory comes before the files (#​384) (#​396)

v4.4.0

Compare Source

🚀 Features
  • Add lzma-static and xz-static features that enable liblzma/static (#​393)
⚙️ Miscellaneous Tasks
  • Move deprecated annotations to fix a Clippy warning (#​391)

v4.3.0

Compare Source

🚀 Features

v4.2.0

Compare Source

🚀 Features
  • Write ZIP file to stream (#​246)

v4.1.0

Compare Source

🚀 Features
  • Add has_overlapping_files method

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 12, 2026
@renovate

renovate Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: plugins/updater/Cargo.toml
Artifact update for zip resolved to version 9.0.3, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 9.0.2
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/

@socket-security

socket-security Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedcargo/​zip@​4.0.0 ⏵ 9.0.3100 +110099 +6100100

View full report

@renovate
renovate Bot force-pushed the renovate/zip-9.x branch 17 times, most recently from 1f21639 to 901c97c Compare October 15, 2026 22:22
@renovate
renovate Bot force-pushed the renovate/zip-9.x branch from 901c97c to c995925 Compare October 15, 2026 22:24
@renovate

renovate Bot commented Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@picassoglitch picassoglitch mentioned this pull request Oct 16, 2026
Merged
@diazoxide diazoxide mentioned this pull request Oct 16, 2026
Closed
@TheManoeuvre TheManoeuvre mentioned this pull request Oct 16, 2026
Merged
1 of 3 tasks
@robertomarchioro robertomarchioro mentioned this pull request Oct 16, 2026
Merged
2 of 4 tasks
robertomarchioro added a commit to robertomarchioro/prompt-a-porter that referenced this pull request Oct 16, 2026
@robertomarchioro @claude
fix(deps): zip 9.0.4 — la linea 8.x è ritirata da crates.io (#700)
82771aa 
Tutte le release 8.x di zip sono yanked; passaggio a 9.0.4. Unico cambio API: ZipFile::name() ritorna Result (solo un helper di test). Due test di roundtrip per estrai_da_zip (in produzione solo Windows).

Refs #697: il canary resta rosso per zip ^4 dichiarato da tauri-plugin-updater (upstream tauri-apps/plugins-workspace#3698).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@robertomarchioro robertomarchioro mentioned this pull request Oct 16, 2026
Open
@lucasfernog
lucasfernog merged commit ba98bfa into v2 Oct 16, 2026
6 checks passed
@lucasfernog
lucasfernog deleted the renovate/zip-9.x branch October 16, 2026 15:05
@github-actions github-actions Bot mentioned this pull request Oct 16, 2026
Open
@RaphaelMitas RaphaelMitas mentioned this pull request Oct 16, 2026
Merged
3 of 4 tasks
@theatrus theatrus mentioned this pull request Oct 17, 2026
Merged
theatrus added a commit to theatrus/psf-guard that referenced this pull request Oct 17, 2026
@theatrus @claude
Ignore the zip 4 advisories that come only from the Tauri updater (#894)
cc40798 
cargo audit fails on RUSTSEC-2026-0367/0368/0369 in zip 4.6.1. psf-guard
uses zip 9; zip 4 comes from tauri-plugin-updater 2.14.0 on Windows only.
Upstream moved the updater to zip 9 (tauri-apps/plugins-workspace#3698),
shipping in 2.14.1. Remove the ignore list once the lockfile reaches it.


Claude-Session: https://claude.ai/code/session_014PJQRfUHA758bZnZfLgq2B

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
0xPlayerOne pushed a commit to adea-ai/cortana that referenced this pull request Oct 17, 2026
@claude
fix(deps): vendor tauri-plugin-updater 2.10.1 with zip 9 for RUSTSEC-…
64881ac 
…2026-0367/0368/0369

The desktop lockfile carried zip 4.6.1 through tauri-plugin-updater, and every
published updater release still requires zip ^4. Vendor the locked 2.10.1
archive under third_party, raise only its Windows zip requirement to 9 (as
tauri-apps/plugins-workspace#3698 did upstream), resolve zip 9.0.4, and add a
provenance check wired next to the vendored glib check. Third-party sources
are excluded from oxlint.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MfzvPs9KL9LLoLyPv5DiLP
0xPlayerOne pushed a commit to adea-ai/cortana that referenced this pull request Oct 17, 2026
@claude
fix(deps): vendor tauri-plugin-updater 2.10.1 with zip 9 for RUSTSEC-…
19c1ba3 
…2026-0367/0368/0369

The desktop lockfile carried zip 4.6.1 through tauri-plugin-updater, and every
published updater release still requires zip ^4. Vendor the locked 2.10.1
archive under third_party, raise only its Windows zip requirement to 9 (as
tauri-apps/plugins-workspace#3698 did upstream), resolve zip 9.0.4, and add a
provenance check wired next to the vendored glib check. Third-party sources
are excluded from oxlint.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MfzvPs9KL9LLoLyPv5DiLP
@0xPlayerOne 0xPlayerOne mentioned this pull request Oct 17, 2026
Merged
1 task
@Cassidy321 Cassidy321 mentioned this pull request Oct 17, 2026
Merged
@ndftz ndftz mentioned this pull request Oct 17, 2026
Merged
@vdavid vdavid mentioned this pull request Oct 17, 2026
Closed
vdavid added a commit to vdavid/cmdr that referenced this pull request Oct 17, 2026
@vdavid
chore(security): the advisory scan goes green again: zip 4.6.1's thre…
33f9595 
…e advisories (Windows-only, via tauri-plugin-updater) get a time-boxed exception, and three new Linux-only D-Bus unmaintained notices are recorded

- RUSTSEC-2026-0367/0368/0369: zip 4.6.1 reaches the lockfile only through tauri-plugin-updater for the Windows target, which Cmdr doesn't ship; our own archive code uses zip 9. Upstream already moved the plugin to zip 9 (tauri-apps/plugins-workspace#3698); it ships in tauri-plugin-updater 2.14.1 (release PR #3712) and Renovate picks it up. `ignoreUntil = 2027-01-17` so the exception can't outlive that (#464)
- RUSTSEC-2026-0370/0371/0372: zvariant, zbus_names, zvariant_derive are unmaintained notices with no known vulnerability, on the Linux-only zbus path (secret-service, notification, opener); not in the macOS graph
@asdfghj1237890 asdfghj1237890 mentioned this pull request Oct 19, 2026
Merged
asdfghj1237890 added a commit to asdfghj1237890/SteamAchievementManager-Enhanced that referenced this pull request Oct 19, 2026
@asdfghj1237890 @claude
fix(deps): clear the rustls, zip and source-map-js advisories (#92)
1ef57ee 
Advisories published after master's last CI run fail the audit jobs on
every open Dependabot PR:

- rustls 0.23.45 -> 0.23.46 in both lockfiles: RUSTSEC-2026-0346
  (medium), -0347, -0348 and -0349 (low).
- source-map-js 1.2.1 -> 1.2.2, a build-time dependency:
  GHSA-68fv-2mgg-jv7q (high). Supersedes #91.
- zip 4.6.1, through tauri-plugin-updater: RUSTSEC-2026-0367 (high),
  -0368 and -0369 (critical). No updater release depends on zip 9 yet
  (tauri-apps/plugins-workspace#3698 is merged but unreleased), so the
  plugin's default `zip` feature is dropped instead. That feature only
  unpacks .zip update bundles on Windows and AppImage archives on Linux.
  Releases (createUpdaterArtifacts: true) ship the signed NSIS
  -setup.exe and the macOS .app.tar.gz, and neither goes through it. A
  .zip update now fails with InvalidUpdaterFormat instead of being
  unpacked. zip, arbitrary and derive_arbitrary leave the lockfile.

rustls 0.23.46 is four days old, inside the 7-day cooldown, which
exempts security updates (.github/dependabot.yml).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@maxgfr maxgfr mentioned this pull request Oct 20, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lucasfernog