chore(deps): update dependency adm-zip to v0.6.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
adm-zip	0.5.10 → 0.6.0
@types/adm-zip (source)	0.5.1 → 0.5.8

---

Release Notes

cthackers/adm-zip (adm-zip)

v0.6.0

Compare Source

==================

Security

• Fixed CVE-2026-39244: a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc (memory exhaustion / DoS) before any validation. Allocation is now bounded by the data actually present — STORED output is sized from the real bytes, DEFLATED output is grown by the inflater and capped at the declared size (#​568)
• Hardened the internal entry-name lookup table against object injection: entry names come from untrusted archives, and a name such as __proto__ previously resolved to Object.prototype, crashing addFile and hiding the entry from getEntry/readFile. The table is now prototype-less

Bug fixes

• Fixed a regression (0.5.15) that rejected valid archives using a data descriptor (general-purpose bit 3). The payload is now validated against the authoritative central-directory CRC instead of requiring/parsing the trailing descriptor (#​548, #​533, #​554)
• Fixed extractAllTo/extractAllToAsync not restoring directory permissions with keepOriginalPermission; directory modes are applied after their contents are written, deepest path first, and no longer lock the extractor out of a restrictive directory (#​530)
• Fixed infinite recursion in addLocalFolder when a folder contains a symlink pointing back to an ancestor (e.g. workspace node_modules); the walk now tracks resolved real paths and skips already-visited directories (#​541)
• Fixed an uncaught exception (ERR_INVALID_ARG_TYPE) that crashed the process when writeFileToAsync could not open the target file (bad permissions, invalid filename, exhausted file descriptors); write failures are now reported through the callback and write errors are no longer silently swallowed (#​470, #​459, #​402)
• Fixed directory entries reporting an empty name (e.g. a/b/c/ now returns c) (#​466)
• Fixed extractEntryTo flattening subdirectories when maintainEntryPath is false; the structure below the extracted directory is now preserved instead of collapsing (and overwriting) files by basename (#​306)
• Fixed a failed utimes aborting extraction; setting the modification time is now best-effort and never fails extraction of already-written content (#​379)
• Fixed test() always returning false for any archive containing a file (it indexed the entries array with an entry object instead of reading the entry); it now correctly verifies each entry's CRC

Performance

• Faster entry sorting when writing archives with many entries: names are decoded once instead of on every comparison (about 6× faster sort for large archives)

Added

• Bundled TypeScript type definitions (types.d.ts), so @types/adm-zip is no longer required

Notes

• Behavior change: extractEntryTo(dir, target, /* maintainEntryPath */ false) now preserves subdirectories beneath the extracted directory rather than flattening them
• Behavior change: extraction no longer fails when the modification time cannot be set

v0.5.18

Compare Source

What's Changed

• Bump js-yaml from 4.1.1 to 4.3.0 by @​dependabot[bot] in #​566
• Fix corrupted zip when round-tripping entries with a data descriptor (#​555) by @​JohnJunior in #​564
• prevent crashes when process.versions is an empty object by @​matt-fidd in #​551
• support for writing zip64 by @​mielverkerken in #​562
• Fix Archive Utility failure on zips with empty directories (#​558) by @​JohnJunior in #​563

New Contributors

• @​JohnJunior made their first contribution in #​564
• @​matt-fidd made their first contribution in #​551
• @​mielverkerken made their first contribution in #​562

Full Changelog: cthackers/adm-zip@v0.5.17...v0.5.18

v0.5.17

Compare Source

What's Changed

• entryHeader time setter more tolerant by @​thomasheritage in #​540
• Add check for local desc flag in crc check by @​issacgerges in #​543
• Create only if the directory does not exist by @​DennisHill in #​557
• Fix issue with absolute paths by @​kwolfy in #​559

New Contributors

• @​thomasheritage made their first contribution in #​540
• @​issacgerges made their first contribution in #​543
• @​DennisHill made their first contribution in #​557
• @​kwolfy made their first contribution in #​559

Full Changelog: cthackers/adm-zip@v0.5.16...v0.5.17

v0.5.16

Compare Source

What's Changed

• Fixing preserving linux file permissions by @​NickAllmakerOpsCompass in #​531
• fix: totalEntries is not defined by @​sidartaveloso in #​535

New Contributors

• @​NickAllmakerOpsCompass made their first contribution in #​531
• @​sidartaveloso made their first contribution in #​535

Full Changelog: cthackers/adm-zip@v0.5.15...v0.5.16

v0.5.15

Compare Source

What's Changed

• Fix utils canonical to valid posix by @​skoniks in #​499
• addFile backslash test by @​5saviahv in #​500
• added addLocalFolderAsync2 by @​5saviahv in #​501
• fixed windows paths by @​roosipuu in #​503
• Add Windows build by @​5saviahv in #​504
• inital "decoder" functionality by @​5saviahv in #​505
• Bump braces from 3.0.2 to 3.0.3 by @​dependabot in #​506
• Write out Electron original-fs auto loading by @​5saviahv in #​502
• using writeZip() twice throws "Invalid LOC header (bad signature)" error by @​5saviahv in #​507
• Descriptor check & Main Header locating by @​5saviahv in #​508
• House keeping by @​5saviahv in #​509
• typo by @​5saviahv in #​510
• Allow interoperability files with non-UTF-8 (bit 11 = 0) name by @​yfdyh000 in #​450
• package lock update by @​5saviahv in #​511
• small updates by @​5saviahv in #​513
• CodeQL check by @​5saviahv in #​514
• Keep local extra data by @​5saviahv in #​515
• Update old test by @​5saviahv in #​516
• make all errors a function by @​5saviahv in #​517
• Update date time functions by @​5saviahv in #​518
• Add a length check when extra field parsed by @​code-sunbo in #​520
• deleteFile is too eager by @​5saviahv in #​525

New Contributors

• @​skoniks made their first contribution in #​499
• @​roosipuu made their first contribution in #​503
• @​code-sunbo made their first contribution in #​520

Full Changelog: cthackers/adm-zip@v0.5.14...v0.5.15

v0.5.14

Compare Source

Fixed an issue introduced on version 0.5.13 requiring a new mandatory parameter on the inflater on nodejs version >= 15

v0.5.13

Compare Source

• Fixed extractAllToAsync callback @​5saviahv
• Fixed issue with "toAsyncBuffer" where after that command all entries are gone @​5saviahv
• Minor fixes (tests, typos etc) @​5saviahv
• Added a an option to specificy the maximum expectedLength of the file to protect against zip bombs or limit memory usage @​undefined-moe
• Add check for invalid large disk entries @​criyle

v0.5.12

Compare Source

Fixed extraction error

v0.5.11

Compare Source

• Add support for Info-Zip password check spec for ZipCrypto @​lukemalcolm
• Extraction of password protected zip entries @​Santa77
• Fixed unnecessary scanning a local file headers (except in the case of corrupted archives) @​likev
• Added GitHub actions @​kibertoad
• Fixed cases when extra data was lost @​yfdyh000
• Fixed throw empty error in extractAllToAsync on operation done @​Autokaka

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 99.54%. Comparing base (529b37f) to head (6812ff2).
Report is 2 commits behind head on main.

❗ Current head 6812ff2 differs from pull request most recent head 28f366f

Please upload reports for the commit 28f366f to get more accurate results.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #169   +/-   ##
=======================================
  Coverage   99.54%   99.54%           
=======================================
  Files          23       23           
  Lines        1107     1107           
  Branches      169      169           
=======================================
  Hits         1102     1102           
  Misses          5        5           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

The update focuses on enhancing the devDependencies in the package.json file by upgrading two packages: @types/adm-zip and adm-zip. The version increments from 0.5.1 to 0.5.5 for the type definitions and from 0.5.10 to 0.5.16 for the main package aim to bolster compatibility, security, and overall functionality through the integration of recent bug fixes and improvements.

Changes

Files	Change Summary
package.json	Updated @types/adm-zip from 0.5.1 to 0.5.5 and adm-zip from 0.5.10 to 0.5.16

Poem

In the garden of code, we hop with glee,
With adm-zip and types, we’ve made them free!
Versions have leapt, like bunnies at play,
Bringing fixes and joys to brighten our day.
So here’s to the updates, fresh and bright,
A leap forward in code, oh what a delight! 🐇✨

---

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 0

Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between 39d12de and 0fa9a25.

Files selected for processing (1)

• package.json (1 hunks)

Files skipped from review due to trivial changes (1)

• package.json

[coderabbitai]

Actionable comments posted: 0

Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between 0fa9a25 and ce4860a.

Files selected for processing (1)

• package.json (1 hunks)

Files skipped from review due to trivial changes (1)

• package.json