8000 chore(deps): bump archive from 4.3.0 to 4.5.2 in /openhealth by dependabot[bot] · Pull Request #234 · shroominic/OpenGlucose · GitHub
[go: up one dir, main page]
Skip to content

chore(deps): bump archive from 4.3.0 to 4.5.2 in /openhealth - #234

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pub/openhealth/archive-4.5.2
Open

chore(deps): bump archive from 4.3.0 to 4.5.2 in /openhealth#234
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pub/openhealth/archive-4.5.2

Conversation

@dependabot
@dependabot dependabot Bot commented on behalf of github Oct 19, 2026
Copy link
Copy Markdown
Contributor

Bumps archive from 4.3.0 to 4.5.2.

Changelog

Sourced from archive's changelog.

4.5.2

  • Fixed ZipDecoder.decodeStream returning an empty archive when the input was not at position 0, such as after reading a magic number or decoding the same stream a second time (#405). decodeStream also leaves the input's read position where it was.
  • Added InputStream.totalLength, the size of the whole stream whatever the read position, where length is only the bytes after it.

4.5.1

  • Fixed zips written on the web, which decoded to nothing: the zlib encoder left the zip encoder's output big-endian, so every header after the first entry's data was written in the wrong byte order (#419).
  • ZipEncoder can be used under dart2js on Node, where creating its secure random source threw; it is now only created for a password.
  • Fixed zips written by ZipEncoder since 4.4.0, which 7-Zip reported as having header errors: the data descriptor flag was set in each entry's local header but not its central directory header. The UTF-8 flag also went into the central directory even for names that were not UTF-8.
  • Directory entries are stored rather than written as an empty deflate stream, which unzip rejected, and carry the MS-DOS directory attribute. In a zip with a password they are no longer marked encrypted.
  • Entries whose content is in memory, and stored entries that can be read twice, have their CRC and sizes in the local header again rather than in a data descriptor after the data. Java's ZipInputStream refuses a stored entry with a descriptor, and OpenDocument and EPUB files need their stored mimetype entry without one (#421).

4.5.0

  • Security: XZDecoder hung forever on a truncated .xz read from a file or a decode stream, including .tar.xz in extractFileToDisk.
  • Security: tar long name and pax header entries are limited to TarFile.maxMetadataSize (1 MB). A small .tar.gz could declare one large enough to take gigabytes of memory to read.
  • Security: decoding had no output limit, so a small archive could expand to fill memory or disk. Added maxOutputSize to decodeBytes and decodeStream on GZipDecoder, ZLibDecoder, BZip2Decoder and ZstdDecoder, and maxSize to extractFileToDisk, extractArchiveToDisk and extractArchiveToDiskSync.
  • A zip entry is no longer decoded past the uncompressed size the archive gives for it, so ArchiveFile.size can be checked before reading.
  • Security: ZstdDecoder sized its window and output from the frame header, so a 10 byte input committed hundreds of MB, even past maxWindowSize. The content size is now checked as each block decodes, and one that overflows is refused.
  • Security: XZDecoder limits the LZMA2 dictionary an archive may declare

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump archive from 4.3.0 to 4.5.2 in /openhealth
2074804 
Bumps [archive](https://github.com/brendan-duncan/archive) from 4.3.0 to 4.5.2.
- [Changelog](https://github.com/brendan-duncan/archive/blob/main/CHANGELOG.md)
- [Commits](https://github.com/brendan-duncan/archive/commits)

---
updated-dependencies:
- dependency-name: archive
  dependency-version: 4.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from shroominic as a code owner October 19, 2026 05:26
@dependabot @github
dependabot Bot commented on behalf of github Oct 19, 2026
Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@shroominic shroominic Awaiting requested review from shroominic shroominic is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

0