Update Rust crate zip to v7 #832

renovate · 2025-12-20T01:33:33Z

This PR contains the following updates:

Package	Type	Update	Change
zip	dependencies	major	`0.6.6` → `7.0.0`

Release Notes

zip-rs/zip2 (zip)

`v7.1.0`

Compare Source

🚀 Features

display the underlying error in Display impl for ZipError::Display (#483)
Enable creation of ZipArchive without reparsing (#485)

🐛 Bug Fixes

Return InvalidPassword rather than panic when AES key is the wrong length (#457)
bench with auto zip64 comment (#505)
add condition for getrandom dependency (#504)
(zipcrypto) Support streaming ZipCrypto encryption, don't store entire file in memory (#462)

🚜 Refactor

Clean up imports and move types (#461)
Replace handwritten Ord and PartialOrd for DateTime (#484)

⚙️ Miscellaneous Tasks

Lock lzma-rust2 to at least 0.15.5 (#491)

`v7.0.0`

Compare Source

⚠️ Breaking Changes

Removed the following features: getrandom, hmac, pbkdf2, sha1, zeroize.
Removed lzma-static and xz-static feature flags, which were deprecated synonyms of lzma and xz. (#405, #425)

🚀 Features

(SimpleFileOptions) const DEFAULT implementation (#474)
ZipWriter set_auto_large_file() method to enable large-file data descriptor when necessary (#468)

🐛 Bug Fixes

print previous error when failing to search another cde (#460)
cargo doc warnings (#472)
Write ZIP64 data descriptors when large_file option is true (#467)
Pin generic-array to an old version to work around RustCrypto/traits#2036 until next RustCrypto & aes-crypto releases (#458)

⚙️ Miscellaneous Tasks

Revert version bump so that release-plz will trigger
expose more flate2 feature flags (#476)
Next release will be 7.0.0
release v6.0.0 (#442)

Deps

Bump lzma-rust2 to v0.15 (#465)*] Remove lzma-static and xz-static feature flags, which are deprecated synonyms of lzma and xz. (#405, #425)

`v6.0.0`

Compare Source

⚠️ Breaking Changes

Removed the following features: getrandom, hmac, pbkdf2, sha1, zeroize.
Removed lzma-static and xz-static feature flags, which were deprecated synonyms of lzma and xz. (#405, #425)

🚀 Features

(SimpleFileOptions) const DEFAULT implementation (#474)
ZipWriter set_auto_large_file() method to enable large-file data descriptor when necessary (#468)

🐛 Bug Fixes

print previous error when failing to search another cde (#460)
cargo doc warnings (#472)
Write ZIP64 data descriptors when large_file option is true (#467)
Pin generic-array to an old version to work around RustCrypto/traits#2036 until next RustCrypto & aes-crypto releases (#458)

⚙️ Miscellaneous Tasks

Revert version bump so that release-plz will trigger
expose more flate2 feature flags (#476)
Next release will be 7.0.0
release v6.0.0 (#442)

Deps

Bump lzma-rust2 to v0.15 (#465)*] Remove lzma-static and xz-static feature flags, which are deprecated synonyms of lzma and xz. (#405, #425)

`v5.1.1`

Compare Source

🐛 Bug Fixes

panic when reading empty extended-timestamp field (#404) (#422)
Restore original file timestamp when unzipping with chrono (#46)

⚙️ Miscellaneous Tasks

Configure Amazon Q rules (#421)

`v5.1.0`

Compare Source

🚀 Features

Add legacy shrink/reduce/implode compression (#303)

`v5.0.1`

Compare Source

🐛 Bug Fixes

AES metadata was not copied correctly in raw copy methods, which could corrupt the copied file. (#417)

`v5.0.0`

Compare Source

🚀 Features

Implement by_path*() methods on ZipArchive (#382)

`v4.6.1`

Compare Source

🐛 Bug Fixes

Fixes an issue introduced by the swap from lzma-rs to liblzma (#407)

`v4.6.0`

Compare Source

🚀 Features

Allow to read zip files with unsupported extended timestamps (#400)

🐛 Bug Fixes

enable clamp_opt for ppmd and xz (#401)

`v4.5.0`

Compare Source

🚀 Features

Allow reading ZIP files where the central directory comes before the files (#384) (#396)

`v4.4.0`

Compare Source

🚀 Features

Add lzma-static and xz-static features that enable liblzma/static (#393)

⚙️ Miscellaneous Tasks

Move deprecated annotations to fix a Clippy warning (#391)

`v4.3.0`

Compare Source

🚀 Features

Add support for PPMd (#370)

`v4.2.0`

Compare Source

🚀 Features

Write ZIP file to stream (#246)

`v4.1.0`

Compare Source

🚀 Features

Add has_overlapping_files method

`v4.0.0`

Compare Source

🐛 Bug Fixes

Allow extraction of Zip64 where "Version needed to extract" is higher than "Version made by" (#356)

⚙️ Miscellaneous Tasks

Revert nt-time upgrade (would increase MSRV)
Revert constant_time_eq update (would increase MSRV)
Update fully-qualified names of liblzma imports

`v3.0.0`

Compare Source

🐛 Bug Fixes

return correct offset in SeekableTake::seek (#342)
When only zopfli is available, decompression of deflate should not be possible (#348)
Specify flate2 dependency of the deflate-flate2 feature. (#345)

⚙️ Miscellaneous Tasks

drop unused crossbeam-utils dependency (#339)
fix typo
remove deflate-flate2 dependency on specific backend
[breaking] Drop deprecated deflate-miniz feature flag (#351)

`v2.6.1`

Compare Source

🐛 Bug Fixes

avoid scanning through all local file headers while opening an archive (#281)

`v2.6.0`

Compare Source

🚀 Features

Add support for time::PrimitiveDateTime (#322)
Add jiff integration (#323)

🐛 Bug Fixes

improve error message for duplicated file (#277)

`v2.5.0`

Compare Source

🚀 Features

Add support for time::PrimitiveDateTime (#322)
Add jiff integration (#323)

🐛 Bug Fixes

improve error message for duplicated file (#277)

`v2.4.2`

Compare Source

🐛 Bug Fixes

deep_copy_file produced a mangled file header on big-endian platforms (#309)

`v2.4.1`

Compare Source

🐛 Bug Fixes

type issue in test
double as_ref().canonicalize()?
CI failures
Create directory for extraction if necessary (#314)

`v2.4.0`

Compare Source

🚀 Features

ZipArchive::root_dir and ZipArchive::extract_unwrapped_root_dir (#304)

🐛 Bug Fixes

wasm build failure due to a missing use statement (#313)

`v2.3.0`

Compare Source

🚀 Features

Add support for NTFS extra field (#279)

🐛 Bug Fixes

(test) Conditionalize a zip64 doctest (#308)
fix failing tests, remove symlink loop check
Canonicalize output path to avoid false negatives
Symlink handling in stream extraction
Canonicalize output paths and symlink targets, and ensure they descend from the destination

⚙️ Miscellaneous Tasks

Fix clippy and cargo fmt warnings (#310)

`v2.2.3`

Compare Source

🚜 Refactor

Change the inner structure of DateTime (#267)

⚙️ Miscellaneous Tasks

cargo fix --edition

`v2.2.2`

Compare Source

🐛 Bug Fixes

rewrite the EOCD/EOCD64 detection to fix extreme performance regression (#247)

`v2.2.1`

Compare Source

🐛 Bug Fixes

remove executable bit (#238)
(lzma) fixed panic in case of invalid lzma stream (#259)
resolve new clippy warnings on nightly (#262)
resolve clippy warning in nightly (#252)

⚡ Performance

Faster cde rejection (#255)

`v2.2.0`

Compare Source

🚀 Features

Expose ZipArchive::central_directory_start (#232)

`v2.1.6`

Compare Source

🐛 Bug Fixes

(#33) Rare combination of settings could lead to writing a corrupt archive with overlength extra data, and data_start locations when reading the archive back were also wrong (#221)

🚜 Refactor

Eliminate some magic numbers and unnecessary path prefixes (#225)

`v2.1.5`

Compare Source

🚜 Refactor

change invalid_state() return type to io::Result

`v2.1.4`

Compare Source

🐛 Bug Fixes

fix(#215): Upgrade to deflate64 0.1.9
Panic when reading a file truncated in the middle of an XZ block header
Some archives with over u16::MAX files were handled incorrectly or slowly (#189)
Check number of files when deciding whether a CDE is the real one
Could still select a fake CDE over a real one in some cases
May have to consider multiple CDEs before filtering for validity
We now keep searching for a real CDE header after read an invalid one from the file comment
Always search for data start when opening an archive for append, and reject the header if data appears to start after central directory
deep_copy_file no longer allows overwriting an existing file, to match the behavior of shallow_copy_file
File start position was wrong when extra data was present
Abort file if central extra data is too large
Overflow panic when central directory extra data is too large
ZIP64 header was being written twice when copying a file
ZIP64 header was being written to central header twice
Start position was incorrect when file had no extra data
Allow all reserved headers we can create
Fix a bug where alignment padding interacts with other extra-data fields
Fix bugs involving alignment padding and Unicode extra fields
Incorrect header when adding AES-encrypted files
Parse the extra field and reject it if invalid
Incorrect behavior following a rare combination of merge_archive, abort_file and deep_copy_file. As well, we now return an error when a file is being copied to itself.
path_to_string now properly handles the case of an empty path
Implement Debug for ZipWriter even when it's not implemented for the inner writer's type
Fix an issue where the central directory could be incorrectly detected
finish_into_readable() would corrupt the archive if the central directory had moved

🚜 Refactor

Verify with debug assertions that no FixedSizeBlock expects a multi-byte alignment (#198)
Use new do_or_abort_file method

⚡ Performance

Speed up CRC when encrypting small files
Limit the number of extra fields
Refactor extra-data validation
Store extra data in plain vectors until after validation
Only build one IndexMap after choosing among the possible valid headers
Simplify validation of empty extra-data fields
Validate automatic extra-data fields only once, even if several are present
Remove redundant validate_extra_data() call
Skip searching for the ZIP32 header if a valid ZIP64 header is present (#189)

⚙️ Miscellaneous Tasks

Fix a bug introduced by c934c82
Fix a failing unit test
Fix build errors on older Rust versions
Fix build
Fix another fuzz failure
Switch to ok_or_abort_file, and inline when that fails borrow checker
Switch to ok_or_abort_file, and inline when that fails borrow checker
Fix a build error
Fix boxed_local warning (can borrow instead)
Partial debug
Fix more errors when parsing multiple extra fields
Fix an error when decoding AES header
Fix an error caused by not allowing 0xa11e field
Bug fix: crypto_header was being counted toward extra_data_end
Bug fix: revert a change where crypto_header was incorrectly treated as an extra field
Fix a bug where a modulo of 0 was used
Fix a bug when ZipCrypto, alignment and a custom header are used
Fix a bug when both ZipCrypto and alignment are used
Fix another bug: header_end vs extra_data_end
Fix use of a stale value in a debug_assert_eq!
Fix: may still get an incorrect size if opening an invalid file for append
Fix: may need the absolute start as tiebreaker to ensure deterministic behavior

`v2.1.3`

Compare Source

🐛 Bug Fixes

Some date/time filters were previously unreliable (i.e. later-pass filters had no earliest-pass or latest-fail, and vice-versa)
Decode Zip-Info UTF8 name and comment fields (#159)

🚜 Refactor

Return extended timestamp fields copied rather than borrowed (#183)

⚙️ Miscellaneous Tasks

Fix a new Clippy warning
Fix a bug and inline deserialize for safety
Add check for wrong-length blocks, and incorporate fixed-size requirement into the trait name
Fix a fuzz failure by using checked_sub
Add feature gate for new unit test

`v2.1.2`

Compare Source

🐛 Bug Fixes

Derive Debug for ZipWriter
lower default version to 4.5 and use the version-needed-to-extract where feasible.

🚜 Refactor

use a MIN_VERSION constant

⚙️ Miscellaneous Tasks

Bug fixes for debug implementation
Bug fixes for debug implementation
Update unit tests
Remove unused import

`v2.1.1`

Compare Source

🐛 Bug Fixes

Derive Debug for ZipWriter
lower default version to 4.5 and use the version-needed-to-extract where feasible.

🚜 Refactor

use a MIN_VERSION constant

⚙️ Miscellaneous Tasks

Bug fixes for debug implementation
Bug fixes for debug implementation
Update unit tests
Remove unused import

`v2.1.0`

Compare Source

🚀 Features

Support mutual conversion between DateTime and MS-DOS pair

🐛 Bug Fixes

version-needed-to-extract was incorrect in central header, and version-made-by could be lower than that (#100)
version-needed-to-extract was incorrect in central header, and version-made-by could be lower than that (#100)

⚙️ Miscellaneous Tasks

Another tweak to ensure version_needed is applied
Tweaks to make version_needed and version_made_by work with recently-merged changes

`v2.0.0`

Compare Source

🚀 Features

Add fmt::Display for DateTime
Implement more traits for DateTime

🚜 Refactor

Change type of last_modified_time to Option<DateTime>
[breaking] Rename from_msdos to from_msdos_unchecked, make it unsafe, and add try_from_msdos (#145)

⚙️ Miscellaneous Tasks

Continue to accept archives with invalid DateTime, and use now_utc() as default only when writing, not reading

`v1.3.1`

Compare Source

🚜 Refactor

Make deflate enable both default implementations
Merge the hidden deflate-flate2 flag into the public one
Rename _deflate-non-zopfli to _deflate-flate2
Reject encrypted and using_data_descriptor files slightly faster in read_zipfile_from_stream
Convert impl TryInto<NaiveDateTime> for DateTime to impl TryFrom<DateTime> for NaiveDateTime (#136)

⚡ Performance

Change default compression implementation to flate2/zlib-ng

⚙️ Miscellaneous Tasks

chore(#132): Attribution for some copied test data
chore(#133): chmod -x src/result.rs

`v1.3.0`

Compare Source

🚀 Features

Add is_symlink method

🐛 Bug Fixes

Extract symlinks into symlinks on Unix and Windows, and fix a bug that affected making directories writable on MacOS

🚜 Refactor

Eliminate deprecation warning when --all-features implicitly enables the deprecated feature
Check if archive contains a symlink's target, without borrowing both at the same time
Eliminate a clone that's no longer necessary
is_dir only needs to look at the filename
Remove unnecessary #[cfg] attributes

⚙️ Miscellaneous Tasks

Fix borrow-of-moved-value
Box doesn't directly convert to PathBuf, so convert back to String first
partial revert - only &str has chars(), but Box should auto-deref
contains_key needs a Box<str>, so generify is_dir to accept one
Add missing ZipFileData::is_dir() method
Fix another Windows-specific error
More bug fixes for Windows-specific symlink code
More bug fixes for Windows-specific symlink code
Bug fix: variable name change
Bug fix: need both internal and output path to determine whether to symlink_dir
Another bug fix
Fix another error-type conversion error
Fix error-type conversion on Windows
Fix conditionally-unused import
Fix continued issues, and factor out the Vec-to-OsString conversion (cc: #125)
Fix CI failure involving conversion to OsString for symlinks (see my comments on #125)
Move path join into platform-independent code

`v1.2.3`

Compare Source

🐛 Bug Fixes

Remove a window when an extracted directory might be unexpectedly listable and/or cdable by non-owners
Extract directory contents on Unix even if the directory doesn't have write permission (zip-rs/zip-old#423)

⚙️ Miscellaneous Tasks

More conditionally-unused imports

`v1.2.2`

Compare Source

🐛 Bug Fixes

Failed to clear "writing_raw" before finishing a symlink, leading to dropped extra fields

⚡ Performance

Use boxed slice for archive comment, since it can't be concatenated
Optimize for the fact that false signatures can't overlap with real ones

`v1.2.1`

Compare Source

🐛 Bug Fixes

Prevent panic when trying to read a file with an unsupported compression method
Prevent panic after reading an invalid LZMA file
Make Stored the default compression method if Deflated isn't available, so that zip files are readable by as much software as possible
version_needed was wrong when e.g. cfg(bzip2) but current file wasn't bzip2 (#100)
file paths shouldn't start with slashes (#102)

🚜 Refactor

Overhaul impl Arbitrary for FileOptions
Remove unused atomic module

`v1.2.0`

Compare Source

🚀 Features

Add method decompressed_size() so non-recursive ZIP bombs can be detected

🚜 Refactor

Make ZipWriter::finish() consume the ZipWriter

⚙️ Miscellaneous Tasks

Use panic! rather than abort to ensure the fuzz harness can process the failure
Update fuzz_write to use replace_with
Remove a drop that can no longer be explicit
Add #![allow(unexpected_cfgs)] in nightly

`v1.1.4`

Compare Source

🐛 Bug Fixes

Build was failing with bzip2 enabled
use is_dir in more places where Windows paths might be handled incorrectly

⚡ Performance

Quick filter for paths that contain "/../" or "/./" or start with "./" or "../"
Fast handling for separator-free paths
Speed up logic if main separator isn't '/'
Drop normalized_components slightly sooner when not using it
Speed up path_to_string in cases where the path is already in the proper format

⚙️ Miscellaneous Tasks

Refactor: can short-circuit handling of paths that start with MAIN_SEPARATOR, no matter what MAIN_SEPARATOR is
Bug fix: non-canonical path detection when MAIN_SEPARATOR is not slash or occurs twice in a row
Bug fix: must recreate if . or .. is a path element
Bug fix

◀️ Revert

#58 (partial): bzip2-rs can't replace bzip2 because it's decompress-only

`v1.1.3`

Compare Source

🐛 Bug Fixes

Rare bug where find_and_parse would give up prematurely on detecting a false end-of-CDR header

`v1.1.2`

Compare Source

🐛 Bug Fixes

Alignment was previously handled incorrectly (#33)

🚜 Refactor

deprecate deflate-miniz feature since it's now equivalent to deflate (#35)

`v1.1.1`

Compare Source

Added

index_for_name, index_for_path, name_for_index: get the index of a file given its path or vice-versa, without
initializing metadata from the local-file header or needing to mutably borrow the ZipArchive.
add_symlink_from_path, shallow_copy_file_from_path, deep_copy_file_from_path, raw_copy_file_to_path: copy a
file or create a symlink using AsRef<Path> arguments

Changed

add_directory_from_path and start_file_from_path are no longer deprecated, and they now normalize .. as well as
..

`v1.1.0`

Added

Support for decoding LZMA.

Changed

Eliminated a custom AtomicU64 type by replacing it with OnceLock in the only place it's used.
FileOptions now has the subtype SimpleFileOptions which implements Copy but has no extra data.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-01-14T14:09:02Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --package [email protected] --precise 7.1.0
    Updating crates.io index
error: failed to select a version for `reqwest`.
    ... required by package `dsc v0.12.0-pre (/tmp/renovate/repos/github/docspell/dsc)`
versions that meet the requirements `^0.13.0` are: 0.13.1, 0.13.0

package `dsc` depends on `reqwest` with feature `rustls-tls` but `reqwest` does not have that feature.


failed to select a version for `reqwest` which could resolve this conflict

renovate bot force-pushed the renovate/zip-7.x branch from d5e4312 to 74a2db5 Compare December 24, 2025 05:06

renovate bot force-pushed the renovate/zip-7.x branch from 74a2db5 to a3d7eb3 Compare January 1, 2026 02:03

Update Rust crate zip to v7

f423d72

renovate bot force-pushed the renovate/zip-7.x branch from a3d7eb3 to f423d72 Compare January 14, 2026 14:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update Rust crate zip to v7 #832

Update Rust crate zip to v7 #832

Uh oh!

renovate bot commented Dec 20, 2025 •

edited

Loading

Uh oh!

renovate bot commented Jan 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Update Rust crate zip to v7 #832

Are you sure you want to change the base?

Update Rust crate zip to v7 #832

Uh oh!

Conversation

renovate bot commented Dec 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

🚀 Features

🐛 Bug Fixes

🚜 Refactor

⚙️ Miscellaneous Tasks

⚠️ Breaking Changes

🚀 Features

🐛 Bug Fixes

⚙️ Miscellaneous Tasks

Deps

⚠️ Breaking Changes

🚀 Features

🐛 Bug Fixes

⚙️ Miscellaneous Tasks

Deps

🐛 Bug Fixes

⚙️ Miscellaneous Tasks

🚀 Features

🐛 Bug Fixes

🚀 Features

🐛 Bug Fixes

🚀 Features

🐛 Bug Fixes

🚀 Features

🚀 Features

⚙️ Miscellaneous Tasks

🚀 Features

🚀 Features

🚀 Features

🐛 Bug Fixes

⚙️ Miscellaneous Tasks

🐛 Bug Fixes

⚙️ Miscellaneous Tasks

🐛 Bug Fixes

🚀 Features

🐛 Bug Fixes

🚀 Features

🐛 Bug Fixes

🐛 Bug Fixes

🐛 Bug Fixes

🚀 Features

🐛 Bug Fixes

🚀 Features

🐛 Bug Fixes

⚙️ Miscellaneous Tasks

🚜 Refactor

⚙️ Miscellaneous Tasks

🐛 Bug Fixes

🐛 Bug Fixes

⚡ Performance

🚀 Features

🐛 Bug Fixes

🚜 Refactor

🚜 Refactor

🐛 Bug Fixes

🚜 Refactor

⚡ Performance

⚙️ Miscellaneous Tasks

🐛 Bug Fixes

🚜 Refactor

⚙️ Miscellaneous Tasks

🐛 Bug Fixes

🚜 Refactor

⚙️ Miscellaneous Tasks

🐛 Bug Fixes

🚜 Refactor

⚙️ Miscellaneous Tasks

🚀 Features

🐛 Bug Fixes

⚙️ Miscellaneous Tasks

🚀 Features

🚜 Refactor

⚙️ Miscellaneous Tasks

renovate bot commented Dec 20, 2025 •

edited

Loading