[Snyk] Upgrade adm-zip from 0.4.7 to 0.5.16

[ConnorPoole]

Snyk has created this PR to upgrade adm-zip from 0.4.7 to 0.5.16.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 24 versions ahead of your current version.
• The recommended version was released 2 months ago, on 2024-08-30.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Directory Traversal SNYK-JS-ADMZIP-1065796	584/1000 Why? Has a fix available, CVSS 7.4	No Known Exploit
	Arbitrary File Write via Archive Extraction (Zip Slip) npm:adm-zip:20180415	584/1000 Why? Has a fix available, CVSS 7.4	Mature

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: adm-zip

• 0.5.16 - 2024-08-30
  

  What's Changed

  • Fixing preserving linux file permissions by @ NickAllmakerOpsCompass in #531
  • fix: totalEntries is not defined by @ sidartaveloso in #535

  New Contributors

  • @ NickAllmakerOpsCompass made their first contribution in #531
  • @ sidartaveloso made their first contribution in #535

  Full Changelog: v0.5.15...v0.5.16

• 0.5.15 - 2024-08-05
  

  What's Changed

  • Fix utils canonical to valid posix by @ skoniks in #499
  • addFile backslash test by @ 5saviahv in #500
  • added addLocalFolderAsync2 by @ 5saviahv in #501
  • fixed windows paths by @ roosipuu in #503
  • Add Windows build by @ 5saviahv in #504
  • inital "decoder" functionality by @ 5saviahv in #505
  • Bump braces from 3.0.2 to 3.0.3 by @ dependabot in #506
  • Write out Electron original-fs auto loading by @ 5saviahv in #502
  • using writeZip() twice throws "Invalid LOC header (bad signature)" error by @ 5saviahv in #507
  • Descriptor check & Main Header locating by @ 5saviahv in #508
  • House keeping by @ 5saviahv in #509
  • typo by @ 5saviahv in #510
  • Allow interoperability files with non-UTF-8 (bit 11 = 0) name by @ yfdyh000 in #450
  • package lock update by @ 5saviahv in #511
  • small updates by @ 5saviahv in #513
  • CodeQL check by @ 5saviahv in #514
  • Keep local extra data by @ 5saviahv in #515
  • Update old test by @ 5saviahv in #516
  • make all errors a function by @ 5saviahv in #517
  • Update date time functions by @ 5saviahv in #518
  • Add a length check when extra field parsed by @ code-sunbo in #520
  • deleteFile is too eager by @ 5saviahv in #525

  New Contributors

  • @ skoniks made their first contribution in #499
  • @ roosipuu made their first contribution in #503
  • @ code-sunbo made their first contribution in #520

  Full Changelog: v0.5.14...v0.5.15

• 0.5.14 - 2024-06-04
  

  Fixed an issue introduced on version 0.5.13 requiring a new mandatory parameter on the inflater on nodejs version >= 15

• 0.5.13 - 2024-06-01
  
  • Fixed extractAllToAsync callback @ 5saviahv
  • Fixed issue with "toAsyncBuffer" where after that command all entries are gone @ 5saviahv
  • Minor fixes (tests, typos etc) @ 5saviahv
  • Added a an option to specificy the maximum expectedLength of the file to protect against zip bombs or limit memory usage @ undefined-moe
  • Add check for invalid large disk entries @ criyle
• 0.5.12 - 2024-03-14
  

  Fixed extraction error

• 0.5.11 - 2024-03-13
• 0.5.10 - 2022-12-20
• 0.5.9 - 2021-10-07
  

  v0.5.9

• 0.5.8 - 2021-10-07
  

  v0.5.8

• 0.5.7 - 2021-10-01
  

  v0.5.7

• 0.5.6 - 2021-09-12
• 0.5.5 - 2021-03-31
• 0.5.4 - 2021-03-08
• 0.5.3 - 2021-02-18
• 0.5.2 - 2021-01-27
• 0.5.1 - 2020-11-27
• 0.5.0 - 2020-11-19
• 0.4.16 - 2020-06-23
• 0.4.14 - 2020-02-06
• 0.4.13 - 2018-11-13
• 0.4.11 - 2018-05-12
• 0.4.10 - 2018-05-12
• 0.4.9 - 2018-04-25
• 0.4.8 - 2018-04-23
• 0.4.7 - 2015-02-09

from adm-zip GitHub release notes

Commit messages

Package name: adm-zip

• 1c7860f Incremented package version
• 887f440 Merge pull request [Snyk-dev] Fix for 2 vulnerable dependencies snyk-labs/nodejs-goof#535 from devix-tecnologia/patch-1
• ca54d1a Merge pull request [Snyk] Fix for 1 vulnerable dependencies snyk-labs/nodejs-goof#531 from NickAllmakerOpsCompass/fix_fileattr
• 7e31f27 fix: totalEntries is not defined
• 3e2fa32 Removing the uint16 check from fileAttr, which seemed to fail for attr > 0x80000000
• b148463 Incremented package version
• 535815e deleteFile is too eager ([Snyk] Fix for 1 vulnerable dependencies snyk-labs/nodejs-goof#525)
• ef63cbb Merge pull request [Snyk-dev] Fix for 1 vulnerable dependencies snyk-labs/nodejs-goof#520 from code-sunbo/master
• f2830d0 Add a length check when extra field parsed
• ba46576 Update date time functions ([Snyk-dev] Fix for 1 vulnerable dependencies snyk-labs/nodejs-goof#518)
• 7a1b68e make all errors a function ([Snyk-dev] Fix for 1 vulnerable dependencies snyk-labs/nodejs-goof#517)
• d59de3e Update old test ([Snyk-dev] Fix for 1 vulnerable dependencies snyk-labs/nodejs-goof#516)
• 44b1006 Merge pull request [Snyk] Fix for 35 vulnerable dependencies snyk-labs/nodejs-goof#515 from 5saviahv/updates
• 86bae22 add temporary folders into list
• f9d1a3a added some functions to handle entries
• 161a61f handle local- and central header extra data separately
• 9d529f5 restore asset file
• 696646c Create codeql.yml (Demobranch snyk-labs/nodejs-goof#514)
• 336fd51 small updates ([Snyk] Fix for 35 vulnerable dependencies snyk-labs/nodejs-goof#513)
• 76b1dd8 package lock update ([Snyk] Fix for 35 vulnerable dependencies snyk-labs/nodejs-goof#511)
• 19696fd Merge pull request [Snyk] Fix for 1 vulnerable dependencies snyk-labs/nodejs-goof#450 from yfdyh000/pr-rawName
• 85e8305 updates
• a399405 updates
• f82dacf typo ([Snyk] Fix for 35 vulnerable dependencies snyk-labs/nodejs-goof#510)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs