[dependabot]

Bumps zip from 8.6.0 to 9.0.2.

Release notes

Sourced from zip's releases.

v9.0.1

🐛 Bug Fixes

• set_permissions was still following symlinks in non-streaming extraction (#1038)
• two arithmetic overflows in the implode decoder (#1028)
• reject an empty archive whose central directory offset is past the EOCD (#1025)
• don't panic when two entries extract to the same path (#1023)
• fail reads that exceed the declared uncompressed size (#1022)
• shrink decoder skipped LZW code 8191 (#1029)
• write only the sentinel-marked values in a central ZIP64 field (#1027)

v9.0.0

🚀 Features

• add ZipFileBuilder for parallelizing compression (#911)
• add method by_index_with_data_descriptor (#994)
• add len, is_empty and entry to ZipArchiveMetadata (#1015)
• read data descriptor from binary (#990)
• add comment and test for ZipStreamReader and symlinks (#985)
• (write) add ZipWriter::hide_file for in-place entry deletion (#924)
• add compression (#948)
• add test to in place modification (#945)
• move CustomExtraField to own file (#941)
• add a test on enum size (#939)
• use ZipFileEntry instead of ZipStreamFileMetadata (#935)
• add ZipFileEntry with no Reader (#933)
• change aes_mode to aes_settings() in ZipFileData (#925)
• cleanup and harmonize extra fields (#923)
• Rewrite zip64 extra (#913)

🐛 Bug Fixes

• reading an empty AES entry again at EOF returns Ok(0) (#1024)
• reject ZIP64 sizes that overflow u64 when computing data end offsets (#1036)
• apply central directory metadata in ZipStreamReader, only to written entries (#1030)
• consume the whole extended timestamp field in the central header (#1016)
• parse the central header of the extended timestamp (#1002)
• don't pre-allocate the declared size in the legacy decoders (#991)
• Symlink with very large declared size could lead to out-of-memory panic (#984)
• copy extra fields in raw_copy_file (#955) (#982)
• add unix_mode when copy_raw_file (#981)
• rewrite documentation of add_symlink_from_path (#979)
• ignore a ZIP64 extra field that no sentinel asked for (#962)
• do not set data descriptor if directory (#973)
• expose flags function for easier access (#972)
• preserve unix permission in raw_copy_file (#956)
• clippy warning on nightly (#960)
• remove extra alloc used to copy (#938)
• lazy allocation on error case (#937)
• fix data alignment (#929)

... (truncated)

Changelog

Sourced from zip's changelog.

9.0.2 - 2026-10-11

🐛 Bug Fixes

• additional bug fixes for symlink extraction

9.0.1 - 2026-10-10

🐛 Bug Fixes

• set_permissions was still following symlinks in non-streaming extraction (#1038)
• two arithmetic overflows in the implode decoder (#1028)
• reject an empty archive whose central directory offset is past the EOCD (#1025)
• don't panic when two entries extract to the same path (#1023)
• fail reads that exceed the declared uncompressed size (#1022)
• shrink decoder skipped LZW code 8191 (#1029)
• write only the sentinel-marked values in a central ZIP64 field (#1027)

9.0.0 - 2026-10-08

🚀 Features

• add ZipFileBuilder for parallelizing compression (#911)
• add method by_index_with_data_descriptor (#994)
• add len, is_empty and entry to ZipArchiveMetadata (#1015)
• read data descriptor from binary (#990)
• add comment and test for ZipStreamReader and symlinks (#985)
• (write) add ZipWriter::hide_file for in-place entry deletion (#924)
• add compression (#948)
• add test to in place modification (#945)
• move CustomExtraField to own file (#941)
• add a test on enum size (#939)
• use ZipFileEntry instead of ZipStreamFileMetadata (#935)
• add ZipFileEntry with no Reader (#933)
• change aes_mode to aes_settings() in ZipFileData (#925)
• cleanup and harmonize extra fields (#923)
• Rewrite zip64 extra (#913)

🐛 Bug Fixes

• reading an empty AES entry again at EOF returns Ok(0) (#1024)
• reject ZIP64 sizes that overflow u64 when computing data end offsets (#1036)
• apply central directory metadata in ZipStreamReader, only to written entries (#1030)
• consume the whole extended timestamp field in the central header (#1016)
• parse the central header of the extended timestamp (#1002)
• don't pre-allocate the declared size in the legacy decoders (#991)
• Symlink with very large declared size could lead to out-of-memory panic (#984)
• copy extra fields in raw_copy_file (#955) (#982)
• add unix_mode when copy_raw_file (#981)
• rewrite documentation of add_symlink_from_path (#979)

... (truncated)

Commits

• d4baac6 doc: Manually update CHANGELOG for 9.0.2
• bbb39b5 chore: Bump version from 9.0.1 to 9.0.2 to force a release PR
• 5e0274b doc: Update CHANGELOG with bug fixes for symlink extraction
• 5cd986f Update vulnerability reporting guidelines
• 649e50e test: fix conditionally-unused function and missing imports (#1053)
• 7fc4490 Merge commit from fork
• 25a4ccb ci: explicit nightly in the command (nightly is already the default) (#1052)
• 22e8f8c chore(deps): bump rust from 1.95 to 1.99 in /.devcontainer (#1051)
• b5326b2 chore(deps): update zstd requirement from ^0.13.3 to ^0.14.0 (#986)
• 553f64f ci: Scope permissions to job level (#1049)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #218.