build(deps): update zip requirement from 7.0 to 8.5

[dependabot]

Updates the requirements on zip to permit the latest version.

Release notes

Sourced from zip's releases.

v8.5.0

🐛 Bug Fixes

• remove zip64 comment and add zip64 extensible data sector (#747)

🚜 Refactor

• remove useless magic in struct (#730)
• change extra_field from Arc<Vec> to Arc<[u8]> (#741)

⚙️ Miscellaneous Tasks

• cleanup README (#758)

Changelog

Sourced from zip's changelog.

8.5.0 - 2026-04-01

🐛 Bug Fixes

• remove zip64 comment and add zip64 extensible data sector (#747)

🚜 Refactor

• remove useless magic in struct (#730)
• change extra_field from Arc<Vec> to Arc<[u8]> (#741)

⚙️ Miscellaneous Tasks

• cleanup README (#758)

8.4.0 - 2026-03-23

🚀 Features

• add a check for building benches (#748)

🚜 Refactor

• split part of read.rs for code readability (#744)
• remove unused allow (#745)

⚡ Performance

• skip BufReader for Stored files in make_reader (#739)

⚙️ Miscellaneous Tasks

• move pull request template to correct folder (#749)

8.3.1 - 2026-03-21

🚜 Refactor

• use AexEncryption::new (#736)
• update tests to add big endian miri check (#735)

⚙️ Miscellaneous Tasks

• cleanup repository files (#743)

8.3.0 - 2026-03-19

🚀 Features

• add must_use (#727)

... (truncated)

Commits

• 93ea679 chore: release v8.5.0 (#762)
• fbd0d41 refactor: remove useless magic in struct (#730)
• 1043e92 refactor: change extra_field from Arc<Vec> to Arc<[u8]> (#741)
• 2eb28b6 fix: remove zip64 comment and add zip64 extensible data sector (#747)
• 5f4a644 ci(deps): bump rust-lang/crates-io-auth-action from 1.0.3 to 1.0.4 (#761)
• 6469720 ci: Add static.crates.io to allowed hosts in CodeQL workflow (#759)
• 404c530 chore: cleanup README (#758)
• 8fb7436 ci: Allowlist extra endpoints for Dependency Review and CodeQL actions (#756)
• 609b821 ci: Restrict allowed remote endpoints for most workflows (#753)
• 6244796 ci(deps): bump actions/cache from 5.0.3 to 5.0.4 (#752)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Claudius-Maginificent]

Smythe's security audit — PR #193 (zip 7.0 → 8.5)

Right then. Inspected the perimeter, checked every door and window. Verdict below. Trust, then verify. Then verify again.

Verdict: SAFE TO MERGE — severity LOW (defense-in-depth observation only)

What I checked

1. Scope of the change — build-time only. Confirmed:

• zip crate is declared in proto-compiler/Cargo.toml only.
• tenderdash-proto-compiler is a [build-dependencies] of the tenderdash-proto crate (verified in proto/Cargo.toml).
• Therefore zip does not ship in consumer runtime binaries. Attack surface is limited to build hosts / CI runners. Any exploit would require a compromised upstream archive to impact a developer's machine — not downstream users of tenderdash-abci.

2. Trust boundary of the extracted archive.

• Archives are fetched from https://github.com/dashpay/tenderdash over TLS (ureq), first-party repo controlled by the same org. Not attacker-controlled input under normal threat model.
• Extraction targets a throwaway tempfile::tempdir() — not a sensitive filesystem location — before being moved into place.

3. Known vulnerabilities in zip-rs/zip2 v8.x.

• Queried OSV.dev, GitHub Advisory DB, RustSec. Searched the full advisory corpus for the zip crate.
• Only material CVE on record: CVE-2025-29787 / GHSA-94vh-gphv-8pm8 — zip-slip via symlink, affected >= 1.3.0, < 2.3.0, fixed in 2.3.0 and carried forward into the v7/v8 line.
• v8.5.0 is not affected. Confirmed by reading ZipArchive::extract() in zip-rs/zip2@v8.5.0:
  • Canonicalizes the target directory.
  • Routes every entry through enclosed_name() + safe_prepare_path() (rejects ParentDir, absolute paths).
  • Limits symlink follows to 5 and requires canonicalized symlink targets to descend from the destination.
  • On Unix, restricts dir perms to 0o700 until extraction completes.
• No other open CVEs for zip 7.x or 8.x found at the time of this audit.

4. API compatibility across the 7.0 → 8.5 jump (two majors).

• ZipArchive::new(&file) and ZipArchive::extract(dest) — the only two zip APIs used by proto-compiler/src/functions.rs:169-177 — have no breaking signature changes between v7 and v8.
• v8.0 breaking changes per changelog: removed deprecated DateTime methods, migrated to Rust 2024 edition, dropped several feature flags (getrandom, hmac, pbkdf2, sha1, zeroize). None of those are used here.
• The only churn in functions.rs in this PR is a rustfmt signature collapse (5 lines → 1), not a migration.

5. Deflate feature.

• Still present and opt-in. In v8.5 deflate is part of the default set; the Cargo.toml here correctly uses default-features = false, features = ["deflate"] to pull only what's needed. Good hygiene — minimises the surface area.

6. MSRV.

• zip 8.5 requires rustc ≥ 1.88. Already handled in 131c2ac (Dockerfiles bumped 1.85 → 1.88). Workspace rust-version already aligned.

7. CI.

• All 9 checks green on 131c2ac. Build succeeds on both Debian and Alpine images. Nothing hiding in the underbrush.

Findings

ID	Severity	Title	Location
SEC-001	LOW (2)	Consider vetting zip extraction trust boundary in docs	proto-compiler/src/functions.rs:164-179

SEC-001 — The unzip() path extracts into tempfile::tempdir(), which is safe today even if an archive were malicious, because modern zip v8.5 enforces zip-slip and symlink containment. Should the upstream tenderdash repo ever be compromised (supply-chain scenario), that safety is the last line of defence. No action required — zip v8.5 handles this correctly. Recommendation: keep the dependency current (as this PR does) and avoid downgrading to any pre-v2.3.0 release. Defence-in-depth note: consider pinning to a specific commit SHA of tenderdash rather than a moving branch tag in future hardening passes. No change needed in this PR.

Score

Findings tally: CRITICAL 0, HIGH 0, MEDIUM 0, LOW 1, INFO 0.

Recommendation: approve and merge. No structural risk, no known CVEs applicable, strict build-time containment, API-compatible, CI green, MSRV already addressed. Dependabot has done an honest day's work.

Stay paranoid.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}