build(deps): update zip requirement from 8.0 to 9.0

[dependabot]

Updates the requirements on zip to permit the latest version.

Release notes

Sourced from zip's releases.

v9.0.0

🚀 Features

• add ZipFileBuilder for parallelizing compression (#911)
• add method by_index_with_data_descriptor (#994)
• add len, is_empty and entry to ZipArchiveMetadata (#1015)
• read data descriptor from binary (#990)
• add comment and test for ZipStreamReader and symlinks (#985)
• (write) add ZipWriter::hide_file for in-place entry deletion (#924)
• add compression (#948)
• add test to in place modification (#945)
• move CustomExtraField to own file (#941)
• add a test on enum size (#939)
• use ZipFileEntry instead of ZipStreamFileMetadata (#935)
• add ZipFileEntry with no Reader (#933)
• change aes_mode to aes_settings() in ZipFileData (#925)
• cleanup and harmonize extra fields (#923)
• Rewrite zip64 extra (#913)

🐛 Bug Fixes

• reading an empty AES entry again at EOF returns Ok(0) (#1024)
• reject ZIP64 sizes that overflow u64 when computing data end offsets (#1036)
• apply central directory metadata in ZipStreamReader, only to written entries (#1030)
• consume the whole extended timestamp field in the central header (#1016)
• parse the central header of the extended timestamp (#1002)
• don't pre-allocate the declared size in the legacy decoders (#991)
• Symlink with very large declared size could lead to out-of-memory panic (#984)
• copy extra fields in raw_copy_file (#955) (#982)
• add unix_mode when copy_raw_file (#981)
• rewrite documentation of add_symlink_from_path (#979)
• ignore a ZIP64 extra field that no sentinel asked for (#962)
• do not set data descriptor if directory (#973)
• expose flags function for easier access (#972)
• preserve unix permission in raw_copy_file (#956)
• clippy warning on nightly (#960)
• remove extra alloc used to copy (#938)
• lazy allocation on error case (#937)
• fix data alignment (#929)

🚜 Refactor

• move extract to own file (#1009)
• cleanup permissions related code (#961)
• remove feature gate (#949)
• create ZipFileFlags to wrap flags (#947)
• remove unused trait (#946)
• access crate::format with zip::unstable::format (#944)
• harmonize functions to format/functions.rs (#943)
• rewrite make_reader() function (#936)

... (truncated)

Changelog

Sourced from zip's changelog.

9.0.0 - 2026-10-08

🚀 Features

• add ZipFileBuilder for parallelizing compression (#911)
• add method by_index_with_data_descriptor (#994)
• add len, is_empty and entry to ZipArchiveMetadata (#1015)
• read data descriptor from binary (#990)
• add comment and test for ZipStreamReader and symlinks (#985)
• (write) add ZipWriter::hide_file for in-place entry deletion (#924)
• add compression (#948)
• add test to in place modification (#945)
• move CustomExtraField to own file (#941)
• add a test on enum size (#939)
• use ZipFileEntry instead of ZipStreamFileMetadata (#935)
• add ZipFileEntry with no Reader (#933)
• change aes_mode to aes_settings() in ZipFileData (#925)
• cleanup and harmonize extra fields (#923)
• Rewrite zip64 extra (#913)

🐛 Bug Fixes

• reading an empty AES entry again at EOF returns Ok(0) (#1024)
• reject ZIP64 sizes that overflow u64 when computing data end offsets (#1036)
• apply central directory metadata in ZipStreamReader, only to written entries (#1030)
• consume the whole extended timestamp field in the central header (#1016)
• parse the central header of the extended timestamp (#1002)
• don't pre-allocate the declared size in the legacy decoders (#991)
• Symlink with very large declared size could lead to out-of-memory panic (#984)
• copy extra fields in raw_copy_file (#955) (#982)
• add unix_mode when copy_raw_file (#981)
• rewrite documentation of add_symlink_from_path (#979)
• ignore a ZIP64 extra field that no sentinel asked for (#962)
• do not set data descriptor if directory (#973)
• expose flags function for easier access (#972)
• preserve unix permission in raw_copy_file (#956)
• clippy warning on nightly (#960)
• remove extra alloc used to copy (#938)
• lazy allocation on error case (#937)
• fix data alignment (#929)

🚜 Refactor

• move extract to own file (#1009)
• cleanup permissions related code (#961)
• remove feature gate (#949)
• create ZipFileFlags to wrap flags (#947)
• remove unused trait (#946)
• access crate::format with zip::unstable::format (#944)
• harmonize functions to format/functions.rs (#943)

... (truncated)

Commits

• 2b1c424 chore: release v9.0.0 (#940)
• 759993f fix: reading an empty AES entry again at EOF returns Ok(0) (#1024)
• acd09d3 fix: reject ZIP64 sizes that overflow u64 when computing data end offsets (#1...
• 8eab8e3 ci(deps): bump codelytv/pr-size-labeler from 1.11.0 to 1.11.1 (#1034)
• 53bdadc fix: apply central directory metadata in ZipStreamReader, only to written ent...
• f86c8be ci: Add endianness_miri as requirement before build_and_test (#1037)
• a72b210 chore: Fix high-level symlink extraction logic, disable some tests in miri, a...
• 96c1693 test: Fix typo in comment for symlink test
• 2a87f64 Merge commit from fork
• a82b390 ci: Fix: Change trigger event for size_labels.yml to pull_request_target (#1032)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)