Skip to content

chore(deps): bump zip from 8.6.0 to 9.0.0 - #601

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/zip-9.0.0
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/zip-9.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

Bumps zip from 8.6.0 to 9.0.0.

Release notes

Sourced from zip's releases.

v9.0.0

🚀 Features

  • add ZipFileBuilder for parallelizing compression (#911)
  • add method by_index_with_data_descriptor (#994)
  • add len, is_empty and entry to ZipArchiveMetadata (#1015)
  • read data descriptor from binary (#990)
  • add comment and test for ZipStreamReader and symlinks (#985)
  • (write) add ZipWriter::hide_file for in-place entry deletion (#924)
  • add compression (#948)
  • add test to in place modification (#945)
  • move CustomExtraField to own file (#941)
  • add a test on enum size (#939)
  • use ZipFileEntry instead of ZipStreamFileMetadata (#935)
  • add ZipFileEntry with no Reader (#933)
  • change aes_mode to aes_settings() in ZipFileData (#925)
  • cleanup and harmonize extra fields (#923)
  • Rewrite zip64 extra (#913)

🐛 Bug Fixes

  • reading an empty AES entry again at EOF returns Ok(0) (#1024)
  • reject ZIP64 sizes that overflow u64 when computing data end offsets (#1036)
  • apply central directory metadata in ZipStreamReader, only to written entries (#1030)
  • consume the whole extended timestamp field in the central header (#1016)
  • parse the central header of the extended timestamp (#1002)
  • don't pre-allocate the declared size in the legacy decoders (#991)
  • Symlink with very large declared size could lead to out-of-memory panic (#984)
  • copy extra fields in raw_copy_file (#955) (#982)
  • add unix_mode when copy_raw_file (#981)
  • rewrite documentation of add_symlink_from_path (#979)
  • ignore a ZIP64 extra field that no sentinel asked for (#962)
  • do not set data descriptor if directory (#973)
  • expose flags function for easier access (#972)
  • preserve unix permission in raw_copy_file (#956)
  • clippy warning on nightly (#960)
  • remove extra alloc used to copy (#938)
  • lazy allocation on error case (#937)
  • fix data alignment (#929)

🚜 Refactor

  • move extract to own file (#1009)
  • cleanup permissions related code (#961)
  • remove feature gate (#949)
  • create ZipFileFlags to wrap flags (#947)
  • remove unused trait (#946)
  • access crate::format with zip::unstable::format (#944)
  • harmonize functions to format/functions.rs (#943)
  • rewrite make_reader() function (#936)

... (truncated)

Changelog

Sourced from zip's changelog.

9.0.0 - 2026-10-08

🚀 Features

  • add ZipFileBuilder for parallelizing compression (#911)
  • add method by_index_with_data_descriptor (#994)
  • add len, is_empty and entry to ZipArchiveMetadata (#1015)
  • read data descriptor from binary (#990)
  • add comment and test for ZipStreamReader and symlinks (#985)
  • (write) add ZipWriter::hide_file for in-place entry deletion (#924)
  • add compression (#948)
  • add test to in place modification (#945)
  • move CustomExtraField to own file (#941)
  • add a test on enum size (#939)
  • use ZipFileEntry instead of ZipStreamFileMetadata (#935)
  • add ZipFileEntry with no Reader (#933)
  • change aes_mode to aes_settings() in ZipFileData (#925)
  • cleanup and harmonize extra fields (#923)
  • Rewrite zip64 extra (#913)

🐛 Bug Fixes

  • reading an empty AES entry again at EOF returns Ok(0) (#1024)
  • reject ZIP64 sizes that overflow u64 when computing data end offsets (#1036)
  • apply central directory metadata in ZipStreamReader, only to written entries (#1030)
  • consume the whole extended timestamp field in the central header (#1016)
  • parse the central header of the extended timestamp (#1002)
  • don't pre-allocate the declared size in the legacy decoders (#991)
  • Symlink with very large declared size could lead to out-of-memory panic (#984)
  • copy extra fields in raw_copy_file (#955) (#982)
  • add unix_mode when copy_raw_file (#981)
  • rewrite documentation of add_symlink_from_path (#979)
  • ignore a ZIP64 extra field that no sentinel asked for (#962)
  • do not set data descriptor if directory (#973)
  • expose flags function for easier access (#972)
  • preserve unix permission in raw_copy_file (#956)
  • clippy warning on nightly (#960)
  • remove extra alloc used to copy (#938)
  • lazy allocation on error case (#937)
  • fix data alignment (#929)

🚜 Refactor

  • move extract to own file (#1009)
  • cleanup permissions related code (#961)
  • remove feature gate (#949)
  • create ZipFileFlags to wrap flags (#947)
  • remove unused trait (#946)
  • access crate::format with zip::unstable::format (#944)
  • harmonize functions to format/functions.rs (#943)

... (truncated)

Commits
  • 2b1c424 chore: release v9.0.0 (#940)
  • 759993f fix: reading an empty AES entry again at EOF returns Ok(0) (#1024)
  • acd09d3 fix: reject ZIP64 sizes that overflow u64 when computing data end offsets (#1...
  • 8eab8e3 ci(deps): bump codelytv/pr-size-labeler from 1.11.0 to 1.11.1 (#1034)
  • 53bdadc fix: apply central directory metadata in ZipStreamReader, only to written ent...
  • f86c8be ci: Add endianness_miri as requirement before build_and_test (#1037)
  • a72b210 chore: Fix high-level symlink extraction logic, disable some tests in miri, a...
  • 96c1693 test: Fix typo in comment for symlink test
  • 2a87f64 Merge commit from fork
  • a82b390 ci: Fix: Change trigger event for size_labels.yml to pull_request_target (#1032)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

  • Chores
    • Updated archive-processing support across the app’s available platforms and related workflows. Existing compression behavior remains unchanged, and the optional test workflow remains optional.
    • No changes to the app’s features or interface are included in this update.

Bumps [zip](https://github.com/zip-rs/zip2) from 8.6.0 to 9.0.0.
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](zip-rs/zip2@v8.6.0...v9.0.0)

---
updated-dependencies:
- dependency-name: zip
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from doublegate as a code owner October 13, 2026 05:13
@dependabot dependabot Bot added dependencies Dependency updates rust Rust / cargo dependencies labels Oct 13, 2026
@coderabbitai

coderabbitai Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: doublegate/RustyNES/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 682cf2bb-7eaf-4cb0-85b9-060a643b6109
📥 Commits

Reviewing files that changed from the base of the PR and between 67b2a6b and 7c3126b.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock, !Cargo.lock
📒 Files selected for processing (4)
  • crates/rustynes-frontend/Cargo.toml
  • crates/rustynes-hdpack/Cargo.toml
  • crates/rustynes-mobile/Cargo.toml
  • crates/rustynes-test-harness/Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

Four crate manifests upgrade the zip dependency from version 8 to version 9. Existing feature settings remain unchanged, including the optional status in the test harness.

Changes: zip dependency update

Layer / File(s) Summary
Update zip dependency declarations
crates/rustynes-frontend/Cargo.toml, crates/rustynes-hdpack/Cargo.toml, crates/rustynes-mobile/Cargo.toml, crates/rustynes-test-harness/Cargo.toml
The zip dependency version changes from 8 to 9. Disabled default features and the enabled deflate feature remain unchanged. The test-harness dependency remains optional.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 7c312

This change bumps the zip archive library from 8 to 9 in four crates and keeps the existing feature settings. The archive-reading code in these crates uses APIs that are unchanged in version 9, so ROM, HD pack, and image extraction should keep working. Normal CI checks are sufficient before merging.

### Architecture Summary

Architecture risk: 🔵 Low · up to 7c312

The change affects 1 system.

Changed systems: crates

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

  • observed — crates (service) was modified; 4 changed files map to changed impact.

Before / after behavior

  • observed — Modified behavior in crates/rustynes-frontend/Cargo.toml: The native-only zip dependency changes from version 8 to version 9; default-features = false and the deflate feature are unchanged.
  • observed — Modified behavior in crates/rustynes-hdpack/Cargo.toml: The zip dependency version changes from 8 to 9; default-features = false and the deflate feature are unchanged.
  • observed — Modified behavior in crates/rustynes-mobile/Cargo.toml: The zip dependency version changes from 8 to 9; its feature configuration remains unchanged.
  • observed — Modified behavior in crates/rustynes-test-harness/Cargo.toml: The optional zip dependency version changes from 8 to 9; default features remain disabled and deflate remains enabled.
Pre-merge checks · Passed 9
Passed Passed checks (9 passed)
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the primary change: upgrading the zip dependency from 8.6.0 to 9.0.0.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Docs-As-Spec Sync Passed The PR changes only four Cargo manifests and Cargo.lock. The manifest changes update zip from 8 to 9 while preserving features. No files under crates/rustynes-cpu, rustynes-ppu, rustynes-apu, …
Changelog Entry For User-Visible Changes Passed The PR only updates zip from 8.6.0 to 9.0.0 in four manifests and Cargo.lock. The default-features, deflate, and optional settings remain unchanged. No Rust source or user-facing project behav…
No Unwrap/Expect/Panic On Untrusted Input Passed PASS: The pull request changes only four Cargo.toml dependency versions and the zip entry in Cargo.lock. It adds no .unwrap(), .expect(), or panic!() call, and it changes no untrusted-inpu…
Safety Comment On New Unsafe Blocks Passed The pull request changes only four Cargo manifests and Cargo.lock. The diff contains no Rust files and no added lines containing unsafe, so it introduces no new unsafe block or unsafe function requi…
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedcargo/​zip@​8.6.0 ⏵ 9.0.0100 +110099 +6100100

View full report

@github-actions

Copy link
Copy Markdown

Antigravity review (Gemini via Ultra)

Bumps the zip dependency from 8.6.0 to 9.0.0 across four workspace crates and updates Cargo.lock.

Blocking issues

  • Workspace build fails to compile due to an unhandled breaking API change in zip 9.0.0.
    In zip 9.0.0, ZipFile::name(&self) changed return type from &str to ZipResult<Cow<'_, str>>. Because Result does not implement AsRef<Path> or Display/ToString, every unadapted call site in the workspace fails compilation under cargo check --workspace:
    • crates/rustynes-frontend/src/app.rs:215 and app.rs:228: std::path::Path::new(f.name()) fails because Result cannot be passed to Path::new.
    • crates/rustynes-hdpack/src/hdpack.rs:570: e.name().to_string() fails because ToString is not implemented for `ZipResult<Co[agy] print timeout after 5m0s with turn in progress; returning partial output

Automated first-pass review by agy on a self-hosted runner -- not a human review.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency updates rust Rust / cargo dependencies

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant