[dependabot]

Bumps zip from 9.1.2 to 9.1.3.

Release notes

Sourced from zip's releases.

v9.1.3

🚀 Features

• (extra_fields) support 0xd935 Android ZIP alignment extra field (#928) (#1198)

🐛 Bug Fixes

• (format) record correct 32-bit EOCD offset in ZIP64 archives (#1205)
• (aes) wipe AES round keys when the cipher is dropped (#1204)
• (fuzz) treat a comment change in a merged sub-writer as non-streamable (#1188)
• (aes) zeroize AesCtrZipKeyStream buffer and counter on drop (#1196)
• (extract) prevent symlink-follow truncation via FILE_FLAG_OPEN_REPARSE_POINT (#1195)
• (write) drop a stale Unicode Path extra field when copying an entry (#1187)
• (write) don't leave a stale tail that completes a fake EOCD in the comment (#1186)
• (write) reject deflate levels below 10 when only zopfli is enabled (#1182)

⚡ Performance

• (read) accelerate extraction with 64 KiB reusable buffer (#1206)
• (aes) encrypt AES-CTR counter blocks in batches (#1203)
• (read) eliminate double allocation by populating IndexMap directly (#1200)
• (read) preallocate files vector in read_central_header (#1199)

Changelog

Sourced from zip's changelog.

9.1.3 - 2026-10-27

🚀 Features

• (extra_fields) support 0xd935 Android ZIP alignment extra field (#928) (#1198)

🐛 Bug Fixes

• (format) record correct 32-bit EOCD offset in ZIP64 archives (#1205)
• (aes) wipe AES round keys when the cipher is dropped (#1204)
• (fuzz) treat a comment change in a merged sub-writer as non-streamable (#1188)
• (aes) zeroize AesCtrZipKeyStream buffer and counter on drop (#1196)
• (extract) prevent symlink-follow truncation via FILE_FLAG_OPEN_REPARSE_POINT (#1195)
• (write) drop a stale Unicode Path extra field when copying an entry (#1187)
• (write) don't leave a stale tail that completes a fake EOCD in the comment (#1186)
• (write) reject deflate levels below 10 when only zopfli is enabled (#1182)

⚡ Performance

• (read) accelerate extraction with 64 KiB reusable buffer (#1206)
• (aes) encrypt AES-CTR counter blocks in batches (#1203)
• (read) eliminate double allocation by populating IndexMap directly (#1200)
• (read) preallocate files vector in read_central_header (#1199)

Commits

• af2ed2a chore: release v9.1.3 (#1185)
• 019776a perf(read): accelerate extraction with 64 KiB reusable buffer (#1206)
• 5b5c4a0 fix(format): record correct 32-bit EOCD offset in ZIP64 archives (#1205)
• 20e809a perf(aes): encrypt AES-CTR counter blocks in batches (#1203)
• 9865299 fix(aes): wipe AES round keys when the cipher is dropped (#1204)
• e656c5d perf(read): eliminate double allocation by populating IndexMap directly (#1200)
• 2431276 perf(read): preallocate files vector in read_central_header (#1199)
• 09d6a8b ci: Manually update version to 9.1.3 (#1202)
• f2fe6c4 feat(extra_fields): support 0xd935 Android ZIP alignment extra field (#928) (...
• 5125442 test(fuzz): tolerate reopen failures once the comment holds an EOCD signature...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates ZIP to 9.1.3 and resolves four existing Windows dependency references to windows-sys 0.61.2.

Example: OCM prepares its private Node.js installation on Windows.

• Before: The downloaded ZIP archive is read using zip 9.1.2.
• After: The same installation path uses zip 9.1.3.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The focused patch has no identified defect and relevant native Windows harness coverage; shipped-entry-point proof is absent and the full test matrix is unfinished.
Proof confidence	🦐 gold shrimp (3/6)	This Dependabot PR is outside the ordinary contributor proof gate; the successful native Windows owner test exercises downloaded Node ZIP extraction and offline reuse, but supplies harness evidence rather than a shipped CLI demonstration.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: OCM's locked ZIP dependency trails upstream archive-reader fixes and improvements.
Reason: The narrow patch refresh follows established dependency-maintenance practice without adding a public option or changing the product contract.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: current main still uses ZIP 9.1.2, and this compatible patch update has no identified actionable defect.

Priority: P3
Reviewed head: 726bcb05390146ea06c69f4ba0a1f98ea692cdeb

Before merge

None.

Findings

None.

Agent review details

How this fits together

The managed Node installer verifies a downloaded archive, passes it through OCM's ZIP extraction helper, and validates the extracted toolchain before publication.

flowchart TD
  A[Runtime setup] --> B[Managed Node installer]
  B --> C[Download and checksum verification]
  C --> D[OCM ZIP extraction helper]
  D --> E[ZIP archive reader]
  E --> F[Validate and publish toolchain]

Loading

Technical review

Best possible solution:

Retain the focused dependency update and land it once the required candidate checks pass.

Do we have a high-confidence way to reproduce the issue?

No OCM bug reproduction is claimed; inspection verifies the dependency delta and its production consumer.

Is this the best way to solve the issue?

A lockfile-only patch update fits the existing compatible dependency range and preserves OCM's features, Rust minimum, and extraction owner.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 52a2c76ca918.

Provenance checked

• ZIP version and Windows dependency resolutions keeps the original intent (54927da: The prior merged dependency refresh selected ZIP 9.1.2 and compatible platform dependencies while retaining Rust 1.88; registry metadata verifies that this PR's Windows resolutions remain permitted.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned patch and current main: The introduced diff changes only Cargo.lock; current default-branch source still pins zip 9.1.2. (Cargo.lock:1925, 726bcb053901)
• Production dependency boundary: Cargo.toml enables only ZIP's deflate feature; extract_zip uses ZipArchive and copies entries itself, so upstream changes to ZIP's extraction convenience API do not automatically change OCM's file-opening behavior. (src/infra/archive.rs:1757, 52a2c76ca918)
• Upstream patch compatibility: The verified v9.1.3 tag retains Rust 1.88 and the existing Windows dependency requirement; reviewed archive-reader changes preserve OCM's used API. No root AGENTS.md exists at that tag. (Cargo.toml:15, af2ed2a3e12a)
• Registry metadata: Published zip 9.1.3 metadata matches the new checksum and declares Rust 1.88. Published errno, rustix, tempfile, and winapi-util requirements all permit the selected windows-sys 0.61.2 resolution. (3/z/zip)
• Prior dependency-update intent: The merged update at build(deps): refresh compatible JSON5 and ZIP dependencies #705 deliberately refreshed compatible ZIP dependencies while retaining Rust 1.88; this patch continues that approach. (Cargo.lock:1925, 54927dad2f9e)
• Candidate validation: The successful Windows job includes native managed Node ZIP installation and offline reuse. Format and Rust 1.88 checks also passed; Linux and macOS Test jobs remain in progress. Discussion contains only review-status bot comments. (.github/workflows/ci.yml:78, 726bcb053901)

Labels

Label changes:

• add P3: This is compatible dependency maintenance without an established urgent OCM regression.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is compatible dependency maintenance without an established urgent OCM regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 2, 2026, 11:32 AM ET / 16:32 UTC.