[dependabot]

Bumps zip from 8.6.0 to 9.0.5.

Release notes

Sourced from zip's releases.

v9.0.5

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#1079)

v9.0.4

🐛 Bug Fixes

• enclosed_name rejects a separator inside one verbatim path component (#1066)
• return Ok(None) when read_zipfile_from_stream is called on an empty archive (#1063)

⚙️ Miscellaneous Tasks

• Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#1065)
• update lzma-rust2 and ppmd-rust dependencies (#1060)

v9.0.3

🐛 Bug Fixes

• Preserve directories' read-only status when extracting on non-Unix systems (#1054)

v9.0.1

🐛 Bug Fixes

• set_permissions was still following symlinks in non-streaming extraction (#1038)
• two arithmetic overflows in the implode decoder (#1028)
• reject an empty archive whose central directory offset is past the EOCD (#1025)
• don't panic when two entries extract to the same path (#1023)
• fail reads that exceed the declared uncompressed size (#1022)
• shrink decoder skipped LZW code 8191 (#1029)
• write only the sentinel-marked values in a central ZIP64 field (#1027)

v9.0.0

🚀 Features

• add ZipFileBuilder for parallelizing compression (#911)
• add method by_index_with_data_descriptor (#994)
• add len, is_empty and entry to ZipArchiveMetadata (#1015)
• read data descriptor from binary (#990)
• add comment and test for ZipStreamReader and symlinks (#985)
• (write) add ZipWriter::hide_file for in-place entry deletion (#924)
• add compression (#948)
• add test to in place modification (#945)
• move CustomExtraField to own file (#941)
• add a test on enum size (#939)

... (truncated)

Changelog

Sourced from zip's changelog.

9.0.5 - 2026-10-17

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#1079)

9.0.4 - 2026-10-16

🐛 Bug Fixes

• enclosed_name rejects a separator inside one verbatim path component (#1066)
• return Ok(None) when read_zipfile_from_stream is called on an empty archive (#1063)

⚙️ Miscellaneous Tasks

• Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#1065)
• update lzma-rust2 and ppmd-rust dependencies (#1060)

9.0.3 - 2026-10-13

🐛 Bug Fixes

• Preserve directories' read-only status when extracting on non-Unix systems (#1054)

9.0.2 - 2026-10-11

🐛 Bug Fixes

• additional bug fixes for symlink extraction

9.0.1 - 2026-10-10

🐛 Bug Fixes

• set_permissions was still following symlinks in non-streaming extraction (#1038)
• two arithmetic overflows in the implode decoder (#1028)
• reject an empty archive whose central directory offset is past the EOCD (#1025)
• don't panic when two entries extract to the same path (#1023)
• fail reads that exceed the declared uncompressed size (#1022)
• shrink decoder skipped LZW code 8191 (#1029)
• write only the sentinel-marked values in a central ZIP64 field (#1027)

9.0.0 - 2026-10-08

🚀 Features

... (truncated)

Commits

• 0123ed1 chore: release v9.0.5 (#1093)
• 00cf82b docs: Repeal policy of yanking versions with known vulnerabilities, add menti...
• 52165b9 chore: Enable release-plz on backport branches in future (#1079)
• ca51e64 docs: Remove doc links that break when doc build doesn't enable all features ...
• 6639687 fix: use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• 5e06fa8 fix(write): prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)
• b6f9fb8 Merge commit from fork
• ea2ccfe Merge commit from fork
• 8068ab4 Merge commit from fork
• 0b51128 doc: Clarifications to security policy (#1074)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: alpha, 📦 dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.