[dlunch]

Changes

• Raise Tokio to 1.54.1 and ZIP to 9.0.5, updating the lockfile and required ZIP dependencies.
• Adapt JAR manifest lookup and ZIP enumeration to fallible filename decoding, propagating errors as ZipException.

Verification

• cargo audit: passed against the current advisory database.
• cargo test --workspace --locked --quiet: 556 passed, 2 existing ignored.
• cargo clippy --workspace --all-targets --locked -- -D warnings: passed.
• cargo clippy --locked --target wasm32-unknown-unknown -- -D warnings: passed (compile only).
• cargo fmt --all -- --check and git diff --check: passed.

Closes #219
Closes #220
Closes #221
Closes #223

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T08:37:29.211521Z	cc4da87	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

❌ Patch coverage is 84.61538% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.29%. Comparing base (0eb89e4) to head (cc4da87).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...java-runtime/src/classes/java/util/jar/jar_file.rs	90.00%	1 Missing ⚠️
...java-runtime/src/classes/java/util/zip/zip_file.rs	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #224      +/-   ##
==========================================
- Coverage   87.29%   87.29%   -0.01%     
==========================================
  Files         310      310              
  Lines       46685    46694       +9     
==========================================
+ Hits        40756    40763       +7     
- Misses       5929     5931       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🔵 Needs a closer look

It is a major-version dependency bump (zip 8→9) whose full workspace build/test outcome (MSRV 1.88, feature flags, native/Wasm) cannot be verified here, so final human confirmation is warranted.

No open issues 🎉

What changed in this PR

This PR bumps two dependencies to versions that resolve open RustSec advisories: Tokio 1.54.1 (fixes the Interval race condition, RUSTSEC-2026-0384) and zip 9.0.5 (fixes the SUID/SGID, symlink-permission, and symlink-target advisories, RUSTSEC-2026-0367/0368/0369). Because zip 9.x changed ZipArchive::file_names() to return impl Iterator<Item = Result<Cow<str>, ZipError>> (fallible UTF‑8 decoding), the two call sites in the runtime are adapted to handle the per-entry Result and surface decode failures as a Java ZipException.

Changes:

• Raise tokio to ^1.54.1 (workspace) and zip to ^9.0.5 (rustjava-runtime), updating Cargo.lock with the new transitive deps (nix, cfg_aliases).
• Adapt ZipFile.entries() to collect file_names() via collect::<Result<Vec<_>, _>>(), converting errors to ZipException.
• Adapt JarFile.getManifest()'s manifest lookup loop to match each fallible filename, using into_owned() and propagating decode errors as ZipException.

File	Description
Cargo.toml	Bumps workspace tokio to ^1.54.1.
rustjava-runtime/​Cargo.toml	Bumps zip to ^9.0.5.
Cargo.lock	Updates tokio/zip checksums and adds nix + cfg_aliases transitive deps.
rustjava-runtime/​src/​classes/​java/​util/​zip/​zip_file.rs	Adapts entries() to fallible file_names(), raising ZipException on decode error.
rustjava-runtime/​src/​classes/​java/​util/​jar/​jar_file.rs	Adapts manifest lookup to iterate fallible filenames, raising ZipException on decode error.

_{Review effort: Balanced}