This repository was archived by the owner on Feb 25, 2025. It is now read-only.
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Bump archive from 3.1.2 to 3.3.9 in /lib/web_ui (#45795)
Bumps [archive](https://github.com/brendan-duncan/archive) from 3.1.2 to 3.3.9. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/brendan-duncan/archive/blob/main/CHANGELOG.md">archive's changelog</a>.</em></p> <blockquote> <h2>3.3.9 - September 10, 2023</h2> <ul> <li>Fix for extractFileToDisk causing corrupt files by closing a file stream before it finished writing.</li> </ul> <h2>3.3.8 - September 02, 2023</h2> <ul> <li>Fix for zip security issue with symlinks, <a href="https://redirect.github.com/brendan-duncan/archive/issues/265">brendan-duncan/archive#265</a>. <a href="https://osv.dev/vulnerability/GHSA-9v85-q87q-g4vg">https://osv.dev/vulnerability/GHSA-9v85-q87q-g4vg</a>.</li> <li>Fix for zip security issue with file paths, <a href="https://redirect.github.com/brendan-duncan/archive/issues/266">brendan-duncan/archive#266</a>. <a href="https://osv.dev/vulnerability/GHSA-r285-q736-9v95">https://osv.dev/vulnerability/GHSA-r285-q736-9v95</a>.</li> <li>Add progress callback for decoding zip files.</li> <li>Don't allow tar files to include absolute paths.</li> <li>Fix error decoding AES-192.</li> </ul> <h2>3.3.7 - April 01, 2023</h2> <ul> <li>Add Zip AES-256 decryption</li> <li>Fix symlink encoding for tar files</li> </ul> <h2>3.3.6 - January 27, 2023</h2> <ul> <li>Fix errors decoding XZ files.</li> </ul> <h2>3.3.5 - November 22, 2022</h2> <ul> <li>Fix file content when decoding zips</li> </ul> <h2>3.3.4 - November 11, 2022</h2> <ul> <li>Fix analysis errors.</li> </ul> <h2>3.3.3 - November 11, 2022</h2> <ul> <li>Support symlinks in ZIP archives</li> <li>Fix ZIP decryption for ZipCrypto format</li> </ul> <h2>3.3.2 - October 16, 2022</h2> <ul> <li>Fix for UTF-8 file name caused problem on Windows.</li> </ul> <h2>3.3.1 - July 19, 2022</h2> <ul> <li>Fix for Inflate crashing on some compressed files.</li> </ul> <h2>3.3.0 - March 25, 2022</h2> <ul> <li>IO encoders (ZipFileEncoder, TarFileEncoder), will now include directories and empty directories.</li> <li>Fix for ZipEncoder file lastModTime.</li> <li>Fix for ArchiveFile.string.</li> <li>Add PAX format to tar decoder.</li> <li>Make more file operations async.</li> </ul> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/brendan-duncan/archive/commit/53e1773d8e18191d6e3fea2136ba61806b7e925d"><code>53e1773</code></a> Update to 3.3.9</li> <li><a href="https://github.com/brendan-duncan/archive/commit/2912496861604f05801f9638cf4f6a0174c4a152"><code>2912496</code></a> Fix analyzer error</li> <li><a href="https://github.com/brendan-duncan/archive/commit/674522a9f82dae48f354dd752d77b52635d20d2b"><code>674522a</code></a> Make sure input file isn't closed until after the archive has been extracted ...</li> <li><a href="https://github.com/brendan-duncan/archive/commit/bbd1b6d1f7fa17519eb3390c1eab34bf1580337b"><code>bbd1b6d</code></a> Update CHANGELOG.md</li> <li><a href="https://github.com/brendan-duncan/archive/commit/21fe8e66ccef8f2e8076884e760ae98e66646eac"><code>21fe8e6</code></a> Update pubspec sdk version to <4.0.0</li> <li><a href="https://github.com/brendan-duncan/archive/commit/01110f00e0d0b9b2bc524dd074b896c5409e54db"><code>01110f0</code></a> Update to 3.3.8</li> <li><a href="https://github.com/brendan-duncan/archive/commit/0d17b270a3c33d3bed56cadd9a43da7717ab11f4"><code>0d17b27</code></a> Use central directory filename instead of local file name when extracting zip...</li> <li><a href="https://github.com/brendan-duncan/archive/commit/6de492385d72af044231c4163dff13a43d991c83"><code>6de4923</code></a> improve symlink validation check</li> <li><a href="https://github.com/brendan-duncan/archive/commit/edb0d480733a44d28ff3d5e4e2779153ba645ce7"><code>edb0d48</code></a> don't create symlinks to files outside of the extracted path</li> <li><a href="https://github.com/brendan-duncan/archive/commit/85ac8df7f8e800abe3bb1343cae596c82de8802c"><code>85ac8df</code></a> Merge pull request <a href="https://redirect.github.com/brendan-duncan/archive/issues/272">#272</a> from Mastbau-FN/main</li> <li>Additional commits viewable in <a href="https://github.com/brendan-duncan/archive/compare/3.1.2...3.3.9">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
- Loading branch information