From b34060dd8abff57b38d4145158757e768a7a2418 Mon Sep 17 00:00:00 2001
From: Jerome Ajot <351091+jeromeajot@users.noreply.github.com>
Date: Fri, 30 Oct 2026 10:58:10 -0400
Subject: [PATCH] deps: update zip to 9.1.3

zip 8.x is flagged by five advisories (GHSA-m665-v7pm-7grj, GHSA-9hj8-73fh-9963,
GHSA-hjqx-j4rw-g7xv, GHSA-q7v9-x93c-xqv3, GHSA-8hxf-qr8p-62x4) that are only
fixed in the 9.x line. The feature set is unchanged: default-features off,
deflate on. The minimum supported Rust version stays at 1.88.

Closes #212
---
 Cargo.lock      | 29 +++++++++++++++++++++++++----
 Cargo.toml      |  2 +-
 fuzz/Cargo.toml |  2 +-
 3 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 6bb48e2a..55ffb817 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -220,6 +220,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
 [[package]]
 name = "chacha20"
 version = "0.10.1"
@@ -970,6 +976,18 @@ dependencies = [
  "libloading",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nohash-hasher"
 version = "0.2.0"
@@ -1478,9 +1496,9 @@ checksum = "d2df906b07856748fa3f6e0ad0cbaa047052d4a7dd609e231c4f72cee8c36f31"
 
 [[package]]
 name = "typed-path"
-version = "0.12.3"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
 
 [[package]]
 name = "typenum"
@@ -1674,15 +1692,18 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "8.6.0"
+version = "9.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+checksum = "1156b39d142a34b999c2310a50455e0cb3760bf7efad0122f796d813bee26ccb"
 dependencies = [
  "crc32fast",
  "flate2",
+ "getrandom",
  "indexmap",
  "memchr",
+ "nix",
  "typed-path",
+ "windows-sys",
  "zopfli",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 2a334b72..e46978d6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -29,7 +29,7 @@ encoding_rs = "0.8.35"
 log = "0.4"
 pdf-inspector = "1.14.2"
 quick-xml = "0.41.0"
-zip = { version = "8.6.0", default-features = false, features = ["deflate"] }
+zip = { version = "9.1.3", default-features = false, features = ["deflate"] }
 
 [profile.release]
 lto = "thin"
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
index b8ea2618..09c19964 100644
--- a/fuzz/Cargo.toml
+++ b/fuzz/Cargo.toml
@@ -11,7 +11,7 @@ cargo-fuzz = true
 libfuzzer-sys = "0.4"
 anydoc = { path = ".." }
 cfb = "0.14.0"
-zip = { version = "8.6.0", default-features = false, features = ["deflate"] }
+zip = { version = "9.1.3", default-features = false, features = ["deflate"] }
 
 [[bin]]
 name = "docx"