UI5 / cli / 29720441135

94%

push

github

deps: Bump adm-zip from 0.5.17 to 0.6.0 (#1461)

Bumps [adm-zip](https://github.com/cthackers/adm-zip) from 0.5.17 to
0.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cthackers/adm-zip/releases">adm-zip's
releases</a>.</em></p>
<blockquote>
<h2>v0.6.0</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/cthackers/adm-zip/compare/v0.5.18...v0.6.0">https://github.com/cthackers/adm-zip/compare/v0.5.18...v0.6.0</a></p>
<p>This release fixes a security vulnerability (CVE-2026-39244),
resolves several long-standing bugs, ships built-in TypeScript types,
and includes two behavior changes worth reading before you upgrade.</p>
<ul>
<li>extractEntryTo(dirEntry, target, maintainEntryPath = false) now
preserves subdirectories instead of flattening files into the target
folder by basename (which also silently overwrote same-named files). (<a
href="https://redirect.github.com/cthackers/adm-zip/issues/306">#306</a>)</li>
<li>Extraction no longer fails when the modification time can't be set —
utimes is now best-effort. (<a
href="https://redirect.github.com/cthackers/adm-zip/issues/379">#379</a>)</li>
<li>Minimum Node.js is now 14 (the code already required it; engines was
incorrectly &gt;=12).</li>
<li>CVE-2026-39244 — a crafted archive declaring a huge uncompressed
size could force an unbounded Buffer.alloc and OOM the process;
allocation is now bounded by the data actually present. Reported by
Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (<a
href="https://redirect.github.com/cthackers/adm-zip/issues/568">#568</a>)</li>
<li>Hardened entry-name lookup against object injection
(<strong>proto</strong> names). Prototype-less table.</li>
<li>Data-descriptor regression rejecting valid archives (<a
href="https://redirect.github.com/cthackers/adm-zip/issues/548">#548</a>,
<a
href="https://redirect.github.com/cthackers/adm-zip/issues/533">#533</a>,
<a
href="https://redirect.github.com/cthac... (continued)

6474 of 7127 branches covered (90.84%)

Branch coverage included in aggregate %.

12237 of 12765 relevant lines covered (95.86%)

5842.49 hits per line