[Snyk] Upgrade adm-zip from 0.4.7 to 0.6.0

[andreiraca]

Snyk has created this PR to upgrade adm-zip from 0.4.7 to 0.6.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 27 versions ahead of your current version.

• The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Directory Traversal SNYK-JS-ADMZIP-1065796	244	No Known Exploit
	Arbitrary File Write via Archive Extraction (Zip Slip) npm:adm-zip:20180415	244	Mature
	Allocation of Resources Without Limits or Throttling SNYK-JS-ADMZIP-17954277	244	Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: adm-zip

• 0.6.0 - 2026-07-10
  

  Full Changelog: v0.5.18...v0.6.0

  This release fixes a security vulnerability (CVE-2026-39244), resolves several long-standing bugs, ships built-in TypeScript types, and includes two behavior changes worth reading before you upgrade.

  • extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files). (#306)
  • Extraction no longer fails when the modification time can't be set — utimes is now best-effort. (#379)
  • Minimum Node.js is now 14 (the code already required it; engines was incorrectly >=12).
  • CVE-2026-39244 — a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process; allocation is now bounded by the data actually present. Reported by Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (#568)
  • Hardened entry-name lookup against object injection (proto names). Prototype-less table.
  • Data-descriptor regression rejecting valid archives (#548, #533, #554)
  • Directory permissions not restored on extract (#530)
  • Infinite recursion on symlink loops in addLocalFolder (#541)
  • Uncaught process crash in writeFileToAsync on write failure (#470, #459, #402)
  • Empty name on directory entries (#466)
  • test() always returned false for archives with files
  • ~6× faster entry sorting for large archives
  • Built-in TypeScript definitions (types.d.ts) — you can drop @ types/adm-zip
• 0.5.18 - 2026-06-29
  

  What's Changed

  • Bump js-yaml from 4.1.1 to 4.3.0 by @ dependabot[bot] in #566
  • Fix corrupted zip when round-tripping entries with a data descriptor (#555) by @ JohnJunior in #564
  • prevent crashes when process.versions is an empty object by @ matt-fidd in #551
  • support for writing zip64 by @ mielverkerken in #562
  • Fix Archive Utility failure on zips with empty directories (#558) by @ JohnJunior in #563

  New Contributors

  • @ JohnJunior made their first contribution in #564
  • @ matt-fidd made their first contribution in #551
  • @ mielverkerken made their first contribution in #562

  Full Changelog: v0.5.17...v0.5.18

• 0.5.17 - 2026-04-01
  

  What's Changed

  • entryHeader time setter more tolerant by @ thomasheritage in #540
  • Add check for local desc flag in crc check by @ issacgerges in #543
  • Create only if the directory does not exist by @ DennisHill in #557
  • Fix issue with absolute paths by @ kwolfy in #559

  New Contributors

  • @ thomasheritage made their first contribution in #540
  • @ issacgerges made their first contribution in #543
  • @ DennisHill made their first contribution in #557
  • @ kwolfy made their first contribution in #559

  Full Changelog: v0.5.16...v0.5.17

• 0.5.16 - 2024-08-30
  

  What's Changed

  • Fixing preserving linux file permissions by @ NickAllmakerOpsCompass in #531
  • fix: totalEntries is not defined by @ sidartaveloso in #535

  New Contributors

  • @ NickAllmakerOpsCompass made their first contribution in #531
  • @ sidartaveloso made their first contribution in #535

  Full Changelog: v0.5.15...v0.5.16

• 0.5.15 - 2024-08-05
  

  What's Changed

  • Fix utils canonical to valid posix by @ skoniks in #499
  • addFile backslash test by @ 5saviahv in #500
  • added addLocalFolderAsync2 by @ 5saviahv in #501
  • fixed windows paths by @ roosipuu in #503
  • Add Windows build by @ 5saviahv in #504
  • inital "decoder" functionality by @ 5saviahv in #505
  • Bump braces from 3.0.2 to 3.0.3 by @ dependabot in #506
  • Write out Electron original-fs auto loading by @ 5saviahv in #502
  • using writeZip() twice throws "Invalid LOC header (bad signature)" error by @ 5saviahv in #507
  • Descriptor check & Main Header locating by @ 5saviahv in #508
  • House keeping by @ 5saviahv in #509
  • typo by @ 5saviahv in #510
  • Allow interoperability files with non-UTF-8 (bit 11 = 0) name by @ yfdyh000 in #450
  • package lock update by @ 5saviahv in #511
  • small updates by @ 5saviahv in #513
  • CodeQL check by @ 5saviahv in #514
  • Keep local extra data by @ 5saviahv in #515
  • Update old test by @ 5saviahv in #516
  • make all errors a function by @ 5saviahv in #517
  • Update date time functions by @ 5saviahv in #518
  • Add a length check when extra field parsed by @ code-sunbo in #520
  • deleteFile is too eager by @ 5saviahv in #525

  New Contributors

  • @ skoniks made their first contribution in #499
  • @ roosipuu made their first contribution in #503
  • @ code-sunbo made their first contribution in #520

  Full Changelog: v0.5.14...v0.5.15

• 0.5.14 - 2024-06-04
  

  Fixed an issue introduced on version 0.5.13 requiring a new mandatory parameter on the inflater on nodejs version >= 15

• 0.5.13 - 2024-06-01
  
  • Fixed extractAllToAsync callback @ 5saviahv
  • Fixed issue with "toAsyncBuffer" where after that command all entries are gone @ 5saviahv
  • Minor fixes (tests, typos etc) @ 5saviahv
  • Added a an option to specificy the maximum expectedLength of the file to protect against zip bombs or limit memory usage @ undefined-moe
  • Add check for invalid large disk entries @ criyle
• 0.5.12 - 2024-03-14
• 0.5.11 - 2024-03-13
• 0.5.10 - 2022-12-20
• 0.5.9 - 2021-10-07
  

  v0.5.9

• 0.5.8 - 2021-10-07
• 0.5.7 - 2021-10-01
• 0.5.6 - 2021-09-12
• 0.5.5 - 2021-03-31
• 0.5.4 - 2021-03-08
• 0.5.3 - 2021-02-18
• 0.5.2 - 2021-01-27
• 0.5.1 - 2020-11-27
• 0.5.0 - 2020-11-19
• 0.4.16 - 2020-06-23
• 0.4.14 - 2020-02-06
• 0.4.13 - 2018-11-13
• 0.4.11 - 2018-05-12
• 0.4.10 - 2018-05-12
• 0.4.9 - 2018-04-25
• 0.4.8 - 2018-04-23
• 0.4.7 - 2015-02-09

from adm-zip GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[andreiraca]

This upgrade from version 0.4.7 to 0.6.0 is a major version jump that includes important security fixes but also introduces potentially breaking changes.

Key Changes:

• Behavioral Change in extractEntryTo: The behavior of extractEntryTo has changed. When the maintainEntryPath argument is set to false, the new version preserves subdirectories instead of flattening them. This could impact code that relies on the previous flattening behavior.
• Node.js Version Support: Support for Node.js v6 was dropped in version 0.5.0. While Node.js v6 is long past its end-of-life, this is a breaking change for environments still using it.
• Security Fixes: Version 0.6.0 addresses a high-severity Denial of Service (DoS) vulnerability (CVE-2026-39244) where a crafted archive could cause memory exhaustion. It also hardens against object injection vulnerabilities.

Recommendation:
Due to the behavioral change in file extraction, it is recommended to verify any usage of the extractEntryTo function to ensure it works as expected after the upgrade. The security fixes make this upgrade important.

Source: Yarn Changelog

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.