[dependabot]

Bumps zip from 9.0.5 to 9.1.2.

Release notes

Sourced from zip's releases.

v9.1.1

🐛 Bug Fixes

• store the raw count instead of a bool (#1174)
• preserve extra fields in raw_copy_file_touch (#1172)
• (write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)
• (write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

v9.1.0

🚀 Features

• (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
• Add borrowing inner method to reader wrappers (#1050)
• add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
• add file_names_raw iterator (#1082)

🐛 Bug Fixes

• raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)
• (write) prevent seek panic on streaming writer with comment (#1151)
• Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)
• apply unix permissions at creation (#1104)
• raw_copy_file should work with any extra fields (#1120)
• (read) avoid full-file forward scans and redundant allocations in central directory (#1142)
• don't enable typed-path's default std feature (#1112)
• ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)
• resolve decoded CP437 member names (#1080) (#1085)
• Debug assertion doesn't account for length of archive comment (#1097)

🚜 Refactor

• Lazy instantiation for all decompressors (#1046) (#1047)

⚡ Performance

• (write) reuse the DEFLATE compressor across entries (#1119)

⚙️ Miscellaneous Tasks

• Fix reference to nonexistent variable on #[cfg(not(any(unix, windows)))] (#1138)
• target lzma-rust2 v0.23 (#1096)

Bench

• add Criterion benchmarks (#754)
• add deflate_many_small_files bench for #633 (#964)

Changelog

Sourced from zip's changelog.

9.1.2 - 2026-10-26

🐛 Bug Fixes

• preserve the file kind (normal/directory/symlink) in raw_copy_file_touch (#1179)
• (write) reject a Unicode Path extra field that would rename the entry (#1177)
• (extract) prevent following symbolic links during file creation (#1116)

9.1.1 - 2026-10-25

🐛 Bug Fixes

• store the raw count instead of a bool (#1174)
• preserve extra fields in raw_copy_file_touch (#1172)
• (write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)
• (write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

9.1.0 - 2026-10-24

🚀 Features

• (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
• Add borrowing inner method to reader wrappers (#1050)
• add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
• add file_names_raw iterator (#1082)

🐛 Bug Fixes

• raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)
• (write) prevent seek panic on streaming writer with comment (#1151)
• Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)
• apply unix permissions at creation (#1104)
• raw_copy_file should work with any extra fields (#1120)
• (read) avoid full-file forward scans and redundant allocations in central directory (#1142)
• don't enable typed-path's default std feature (#1112)
• ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)
• resolve decoded CP437 member names (#1080) (#1085)
• Debug assertion doesn't account for length of archive comment (#1097)

🚜 Refactor

• Lazy instantiation for all decompressors (#1046) (#1047)

⚡ Performance

• (write) reuse the DEFLATE compressor across entries (#1119)

⚙️ Miscellaneous Tasks

• Fix reference to nonexistent variable on #[cfg(not(any(unix, windows)))] (#1138)

... (truncated)

Commits

• 662ae13 chore: release v9.1.2 (#1176)
• e221cd0 fix: preserve the file kind (normal/directory/symlink) in raw_copy_file_touch...
• 525d81e fix(write): reject a Unicode Path extra field that would rename the entry (#1...
• dcc28ed ci(fuzz): Fixes for fallback when Rust nightly is updated mid-run (#1178)
• 68e7e84 fix(extract): prevent following symbolic links during file creation (#1116)
• b7201ce chore: release v9.1.1 (#1173)
• 67b3e52 fix: store the raw count instead of a bool (#1174)
• 9d710d3 ci: Share cargo-afl build across workflows (#1167)
• d6c0278 fix: preserve extra fields in raw_copy_file_touch (#1172)
• c3232c4 test: cover unreserved validation for prepared files (#1169)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)