From 3b829c6c096539a5a6545915bbe87a03475533ba Mon Sep 17 00:00:00 2001
From: sanghnkim-max <267927865+sanghnkim-max@users.noreply.github.com>
Date: Fri, 16 Oct 2026 12:56:15 +0900
Subject: [PATCH] deps: zip 9.0.3

zip-rs yanked every 8.x release (and 9.0.0-9.0.2), so a crate requiring
^8.6.0 resolves only to yanked versions and fails cargo-deny downstream.
The releases since 8.6.0 fix symlink-following during extraction, decoder
overflows and reads past an entry's declared size. Only ZipWriter and
ZipArchive::by_name are used here, both unchanged in 9; tests pass as is.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock      | 23 +++++++++++++++++++++--
 Cargo.toml      |  2 +-
 fuzz/Cargo.toml |  2 +-
 3 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 6bb48e2a..50febd32 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -220,6 +220,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
 [[package]]
 name = "chacha20"
 version = "0.10.1"
@@ -970,6 +976,18 @@ dependencies = [
  "libloading",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nohash-hasher"
 version = "0.2.0"
@@ -1674,14 +1692,15 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "8.6.0"
+version = "9.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+checksum = "c2d98561b612a84ae525331a7a094429ef8a5772514ed507ff6db5f54badc971"
 dependencies = [
  "crc32fast",
  "flate2",
  "indexmap",
  "memchr",
+ "nix",
  "typed-path",
  "zopfli",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 2a334b72..abdfce4c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -29,7 +29,7 @@ encoding_rs = "0.8.35"
 log = "0.4"
 pdf-inspector = "1.14.2"
 quick-xml = "0.41.0"
-zip = { version = "8.6.0", default-features = false, features = ["deflate"] }
+zip = { version = "9.0.3", default-features = false, features = ["deflate"] }
 
 [profile.release]
 lto = "thin"
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
index b8ea2618..ebfe7ca2 100644
--- a/fuzz/Cargo.toml
+++ b/fuzz/Cargo.toml
@@ -11,7 +11,7 @@ cargo-fuzz = true
 libfuzzer-sys = "0.4"
 anydoc = { path = ".." }
 cfb = "0.14.0"
-zip = { version = "8.6.0", default-features = false, features = ["deflate"] }
+zip = { version = "9.0.3", default-features = false, features = ["deflate"] }
 
 [[bin]]
 name = "docx"