Skip to content

Bump org.zeroturnaround:zt-zip from 1.17 to 1.18.1 in the gradle group across 1 directory - #18

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/gradle/gradle-49e0c00f03
Open

Bump org.zeroturnaround:zt-zip from 1.17 to 1.18.1 in the gradle group across 1 directory#18
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/gradle/gradle-49e0c00f03

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the gradle group with 1 update in the / directory: org.zeroturnaround:zt-zip.

Updates org.zeroturnaround:zt-zip from 1.17 to 1.18.1

Release notes

Sourced from org.zeroturnaround:zt-zip's releases.

v1.18.1

What's Changed

Full Changelog: zeroturnaround/zt-zip@v1.18.0...v1.18.1

v1.18.0

What's Changed

... (truncated)

Changelog

Sourced from org.zeroturnaround:zt-zip's changelog.

[1.18.1] - 2026-07-01

Fixed

  • ZipUtil.unpack no longer applies a ZIP entry's stored file permissions to the output directory itself when an entry's name resolves to it (for example an entry named /), which could change the output directory's permissions (GHSA-v2g6-7r9j-v6px).

[1.18.0] - 2026-07-01

Added

  • pack overloads that write to an existing java.util.zip.ZipOutputStream.

Changed

  • Raised the minimum runtime to Java 8 (bytecode target moved from 1.6 to 1.8).
  • Upgraded the slf4j-api dependency from 1.6.6 to 2.0.18. zt-zip uses only the SLF4J API; applications that pick this newer API up transitively and still use an SLF4J 1.x binding must move to an SLF4J 2.x-compatible binding.
  • slf4j-api is now a runtime-scoped dependency (previously compile scope), so it is no longer on the consumer compile classpath. Declare a direct slf4j-api dependency if your own code references SLF4J.

Fixed

  • Zips unpack with a transformer no longer hangs when the transformer produces no entry, and a transformer that throws now surfaces its real exception to the caller instead of a misleading "Write end dead" pipe error.
  • Zips.addEntry/addEntries no longer fail with "Stream closed" when adding a directory FileSource; a directory is now stored as a proper directory entry (#138).
  • ZipUtil.pack no longer fails with FileNotFoundException when a directory contains a broken (dangling) symbolic link; such entries are skipped (#122).
  • ZipUtil.packEntries/packEntry(File, File, NameMapper) now skip an entry whose NameMapper returns null (the same convention as the directory pack) instead of throwing NullPointerException and leaving a partial zip.
  • The ZipUtil methods that take a separate destination — addEntry/addEntries, removeEntry/removeEntries, replaceEntry/replaceEntries, addOrReplaceEntries, transformEntry/transformEntries, repack — now reject a destination equal to the source with an IllegalArgumentException instead of truncating and destroying the source before reading it; use the in-place variant (without a destination) instead.
  • ByteSource (and the byte[] ZipUtil.addEntry/replaceEntry overloads) now accept null bytes as the documented directory entry instead of throwing NullPointerException.
  • ByteSource with null bytes and the STORED method now produces a valid empty entry (size 0, CRC 0) instead of failing with "STORED entry missing size, compressed size, or crc-32".

Security

  • Hardened the relative path-traversal checks when unpacking, using java.nio.file.Path for consistent sub-directory containment checks.
  • The Zips fluent API unpack path (Zips.get(...).unpack().destination(...).process()) now applies the same path-traversal guard as ZipUtil.unpack, rejecting entries that resolve outside the destination directory; this covers both the plain and transformer branches (#180).
  • In-place unpack now creates its temporary directory securely with Files.createTempDirectory (atomic, owner-only permissions) instead of a predictable, world-readable directory.
  • AsiExtraField now validates the declared symbolic-link length against the bytes actually present before allocating, so a forged length in a crafted archive can no longer trigger a large (up to ~2 GB) memory allocation per entry while unpacking (#181).
  • AsiExtraField now rejects a truncated ASI extra field with a ZipException instead of letting an ArrayIndexOutOfBoundsException/NegativeArraySizeException abort unpacking, completing the bounds check added in #181.
  • BackslashUnpacker now validates the resolved path before creating any directories, so a backslash-separated ..\ entry can no longer create directories outside the output directory (the file write itself was already blocked).
  • ZipUtil.explode, repack and unexplode now create their working file or directory atomically (File.createTempFile / Files.createTempDirectory) instead of a predictable name next to the target, closing a symlink/TOCTOU race when the target sits in a shared directory; the predictable FileUtils.getTempFileFor helper is deprecated.
  • ZipUtil.unwrap now throws a ZipException for an entry name whose path prefix resolves outside the name (such as a ~- or :-prefixed name) instead of letting an unchecked StringIndexOutOfBoundsException abort the operation.
Commits
  • b1ee083 Release 1.18.1
  • 1b62546 Skip applying a ZIP entry's permissions to the output directory itself
  • 780a2fd Set next development version 1.18.1-SNAPSHOT
  • 50abbc4 Release 1.18.0
  • 5ef84b6 Reject a destination equal to the source in the destructive ZipUtil methods
  • 62e6a4a Skip null-mapped entries in packEntries
  • 8a533ab Write a valid STORED entry for a null-bytes ByteSource
  • f847f7c Accept null bytes as a directory entry in ByteSource
  • c7b82fa Close the transformer output stream and propagate its failure on unpack
  • 86e86ab Reject a truncated ASI extra field before reading fixed offsets
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump org.zeroturnaround:zt-zip
ed2c521 
Bumps the gradle group with 1 update in the / directory: [org.zeroturnaround:zt-zip](https://github.com/zeroturnaround/zt-zip).


Updates `org.zeroturnaround:zt-zip` from 1.17 to 1.18.1
- [Release notes](https://github.com/zeroturnaround/zt-zip/releases)
- [Changelog](https://github.com/zeroturnaround/zt-zip/blob/main/CHANGELOG.md)
- [Commits](zeroturnaround/zt-zip@zt-zip-1.17...v1.18.1)

---
updated-dependencies:
- dependency-name: org.zeroturnaround:zt-zip
  dependency-version: 1.18.1
  dependency-type: direct:production
  dependency-group: gradle
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants