deps: bump zip to 9.0.3 (all of 8.x is yanked)

SA
2d ago
+23-4

zip-rs has yanked every 8.x release, plus 9.0.0ā€“9.0.2. zip = "8.6.0" therefore resolves only to yanked versions, and downstream crates fail cargo deny (error[yanked]) with no way to fix it from their side. The releases after 8.6.0 fix symlink-following during extraction, overflows in the implode decoder, and reads past an entry's declared size.

This changes Cargo.toml and fuzz/Cargo.toml to 9.0.3 and updates the lockfile. No code changes: anydoc only uses ZipWriter, SimpleFileOptions, ZipArchive::new/by_name and ZipError::FileNotFound, and none of those changed in 9. zip 9.0.3 keeps rust-version = 1.88.

cargo test --workspace (296 passed), cargo clippy --all-targets -- -D warnings and cargo fmt --check are all clean. A release on this would let us drop our vendored copy.

šŸ¤– Generated with Claude Code

Summary by cubic

Bumps zip from 8.6.0 to 9.0.3 so downstream crates can pass cargo deny: all 8.x releases, plus 9.0.0ā€“9.0.2, are yanked, leaving ^8.6.0 resolving only to yanked versions.

No code changes are needed ā€” the used APIs (ZipWriter, SimpleFileOptions, ZipArchive::by_name) are unchanged in 9, and rust-version stays at 1.88. The bump also picks up fixes for symlink-following during extraction, decoder overflows, and reads past an entry's declared size.