[dependabot]

Updates the requirements on zip to permit the latest version.

Release notes

Sourced from zip's releases.

v9.1.0

🚀 Features

• (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
• Add borrowing inner method to reader wrappers (#1050)
• add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
• add file_names_raw iterator (#1082)

🐛 Bug Fixes

• raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)
• (write) prevent seek panic on streaming writer with comment (#1151)
• Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)
• apply unix permissions at creation (#1104)
• raw_copy_file should work with any extra fields (#1120)
• (read) avoid full-file forward scans and redundant allocations in central directory (#1142)
• don't enable typed-path's default std feature (#1112)
• ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)
• resolve decoded CP437 member names (#1080) (#1085)
• Debug assertion doesn't account for length of archive comment (#1097)

🚜 Refactor

• Lazy instantiation for all decompressors (#1046) (#1047)

⚡ Performance

• (write) reuse the DEFLATE compressor across entries (#1119)

⚙️ Miscellaneous Tasks

• Fix reference to nonexistent variable on #[cfg(not(any(unix, windows)))] (#1138)
• target lzma-rust2 v0.23 (#1096)

Bench

• add Criterion benchmarks (#754)
• add deflate_many_small_files bench for #633 (#964)

Changelog

Sourced from zip's changelog.

9.1.0 - 2026-10-24

🚀 Features

• (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
• Add borrowing inner method to reader wrappers (#1050)
• add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
• add file_names_raw iterator (#1082)

🐛 Bug Fixes

• raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)
• (write) prevent seek panic on streaming writer with comment (#1151)
• Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)
• apply unix permissions at creation (#1104)
• raw_copy_file should work with any extra fields (#1120)
• (read) avoid full-file forward scans and redundant allocations in central directory (#1142)
• don't enable typed-path's default std feature (#1112)
• ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)
• resolve decoded CP437 member names (#1080) (#1085)
• Debug assertion doesn't account for length of archive comment (#1097)

🚜 Refactor

• Lazy instantiation for all decompressors (#1046) (#1047)

⚡ Performance

• (write) reuse the DEFLATE compressor across entries (#1119)

⚙️ Miscellaneous Tasks

• Fix reference to nonexistent variable on #[cfg(not(any(unix, windows)))] (#1138)
• target lzma-rust2 v0.23 (#1096)

Bench

• add Criterion benchmarks (#754)
• add deflate_many_small_files bench for #633 (#964)

9.0.5 - 2026-10-17

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#1079)

... (truncated)

Commits

• 3ac375b chore: release v9.1.0 (#1121)
• 49b1362 ci: Allow build_and_test to run concurrently with WASM (#1157)
• 7233436 fix: raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)
• 8c2b231 ci: [StepSecurity] Apply security best practices (#1129)
• ef13e22 test: add test for the previous MR (#1125)
• 9275e5b test: Eliminate unnecessary requirement for little endianness (#1108)
• 9151ce9 fix(write): prevent seek panic on streaming writer with comment (#1151)
• 056a4eb ci: Fix: run build_and_test and check_fuzz even if dependency_review was skip...
• 28f80dd feat(read): enforce header consistency on extract_with_options and expose dup...
• 99ab668 bench: add Criterion benchmarks (#754)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)