[dependabot]

Bumps zip from 9.0.5 to 9.1.3.

Release notes

Sourced from zip's releases.

v9.1.3

🚀 Features

• (extra_fields) support 0xd935 Android ZIP alignment extra field (#928) (#1198)

🐛 Bug Fixes

• (format) record correct 32-bit EOCD offset in ZIP64 archives (#1205)
• (aes) wipe AES round keys when the cipher is dropped (#1204)
• (fuzz) treat a comment change in a merged sub-writer as non-streamable (#1188)
• (aes) zeroize AesCtrZipKeyStream buffer and counter on drop (#1196)
• (extract) prevent symlink-follow truncation via FILE_FLAG_OPEN_REPARSE_POINT (#1195)
• (write) drop a stale Unicode Path extra field when copying an entry (#1187)
• (write) don't leave a stale tail that completes a fake EOCD in the comment (#1186)
• (write) reject deflate levels below 10 when only zopfli is enabled (#1182)

⚡ Performance

• (read) accelerate extraction with 64 KiB reusable buffer (#1206)
• (aes) encrypt AES-CTR counter blocks in batches (#1203)
• (read) eliminate double allocation by populating IndexMap directly (#1200)
• (read) preallocate files vector in read_central_header (#1199)

v9.1.1

🐛 Bug Fixes

• store the raw count instead of a bool (#1174)
• preserve extra fields in raw_copy_file_touch (#1172)
• (write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)
• (write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

v9.1.0

🚀 Features

• (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
• Add borrowing inner method to reader wrappers (#1050)
• add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
• add file_names_raw iterator (#1082)

🐛 Bug Fixes

• raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)
• (write) prevent seek panic on streaming writer with comment (#1151)
• Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)
• apply unix permissions at creation (#1104)
• raw_copy_file should work with any extra fields (#1120)
• (read) avoid full-file forward scans and redundant allocations in central directory (#1142)
• don't enable typed-path's default std feature (#1112)
• ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)
• resolve decoded CP437 member names (#1080) (#1085)

... (truncated)

Changelog

Sourced from zip's changelog.

9.1.3 - 2026-10-27

🚀 Features

• (extra_fields) support 0xd935 Android ZIP alignment extra field (#928) (#1198)

🐛 Bug Fixes

• (format) record correct 32-bit EOCD offset in ZIP64 archives (#1205)
• (aes) wipe AES round keys when the cipher is dropped (#1204)
• (fuzz) treat a comment change in a merged sub-writer as non-streamable (#1188)
• (aes) zeroize AesCtrZipKeyStream buffer and counter on drop (#1196)
• (extract) prevent symlink-follow truncation via FILE_FLAG_OPEN_REPARSE_POINT (#1195)
• (write) drop a stale Unicode Path extra field when copying an entry (#1187)
• (write) don't leave a stale tail that completes a fake EOCD in the comment (#1186)
• (write) reject deflate levels below 10 when only zopfli is enabled (#1182)

⚡ Performance

• (read) accelerate extraction with 64 KiB reusable buffer (#1206)
• (aes) encrypt AES-CTR counter blocks in batches (#1203)
• (read) eliminate double allocation by populating IndexMap directly (#1200)
• (read) preallocate files vector in read_central_header (#1199)

9.1.2 - 2026-10-26

🐛 Bug Fixes

• preserve the file kind (normal/directory/symlink) in raw_copy_file_touch (#1179)
• (write) reject a Unicode Path extra field that would rename the entry (#1177)
• (extract) prevent following symbolic links during file creation (#1116)

9.1.1 - 2026-10-25

🐛 Bug Fixes

• store the raw count instead of a bool (#1174)
• preserve extra fields in raw_copy_file_touch (#1172)
• (write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)
• (write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

9.1.0 - 2026-10-24

🚀 Features

• (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
• Add borrowing inner method to reader wrappers (#1050)
• add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
• add file_names_raw iterator (#1082)

... (truncated)

Commits

• af2ed2a chore: release v9.1.3 (#1185)
• 019776a perf(read): accelerate extraction with 64 KiB reusable buffer (#1206)
• 5b5c4a0 fix(format): record correct 32-bit EOCD offset in ZIP64 archives (#1205)
• 20e809a perf(aes): encrypt AES-CTR counter blocks in batches (#1203)
• 9865299 fix(aes): wipe AES round keys when the cipher is dropped (#1204)
• e656c5d perf(read): eliminate double allocation by populating IndexMap directly (#1200)
• 2431276 perf(read): preallocate files vector in read_central_header (#1199)
• 09d6a8b ci: Manually update version to 9.1.3 (#1202)
• f2fe6c4 feat(extra_fields): support 0xd935 Android ZIP alignment extra field (#928) (...
• 5125442 test(fuzz): tolerate reopen failures once the comment holds an EOCD signature...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)