Skip to content

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Aug 7, 2025

Updated SharpZipLib from 1.2.0 to 1.4.2.

Release notes

Sourced from SharpZipLib's releases.

1.4.2

New patch release that further fixes issues with the changes in v1.4.0.

Fixes:

Other changes (not related to library code):

1.4.1

New patch release that mainly fixes issues with the changes in v1.4.0.

ZIP String Encoding:

Further iteration on the StringCodec API, since the released version was confusing to use and in some cases could not be used without causing deprecation warnings.

TAR:

Two issues that could cause deadlocks was found in v1.4.0, one due to a typo in the async implementation and one due to a buffer not being cleared.

Async:

General async speed improvement, since we now correctly opt out of requiring to continue in the same context (ConfigureAwait(false)).

Other changes (not related to library code):

1.4.0

New minor release focusing on async and supporting newer frameworks.

Note that this version drops support for the EOL .NET 4.5 Framework, but adding explicit support for .NET 6.

Features:

Fixes:

Other changes (not related to library code):

1.3.3

Another minor release, containing security fixes and smaller bugfixes.

Fixes:

Smaller changes:

Other changes (not related to library code):

1.3.2

Another minor release, containing security fixes and smaller bugfixes.
Additionally, this version will have an additional target framework, .NET Standard 2.1, which will see some speed improvements when
used in newer versions of .NET (Core), mainly in Bzip2.

Features

Smaller fixes and optimizations

Other changes (not related to library code)

1.3.1

Minor release, mainly to address the incorrect file version of v1.3.0, but also contains some security fixes and performance improvements.

Highlights

  • Correct FileVersion and AssemblyVersion
  • Security fixes for ZipFile and Zip*Streams
  • Improved CRC32 performance
  • BZip2 compression support for Zip files

Features

Fixes

Other changes (not related to library code)

1.3.0

Highlights

  • AES encryption fixes and support in FastZip
  • File name encoding support for Tar
  • Improved Unix timestamp support
  • Better handling of entry file names
  • Fix errors with entries using Stored compression method

Changes

  • TarArchive.ExtractContents() now needs another parameter set to true to allow the extraction to traverse outside of the target directory.
  • TarArchive constructors now includes an Encoding parameter. Omitting it will discard any non-ASCII bytes in file names.

Fixes

  • [#​503] Consider AES overhead when testing encrypted folder entries by Richard Webb
  • [#​452] Ensure crypto streams are disposed in ZipFile.GetOutputStream by Richard Webb
  • [#​333] Handle unsupported compression methods in ZipInputStream better by Richard Webb
  • [#​402] Only convert entry.Name once when accessing updateIndex by Vladyslav Taranov
  • [#​353] Fix ZipFile.TestLocalHeader CompressionMethod resolving for AES entries by Richard Webb
  • [#​460] Account for AES overhead in compressed entry size by Richard Webb
  • [#​422] Change ZipOutputStream.PutNextEntry to explicity validate the requested compression method by Richard Webb
  • [#​467] Allow seeking a PartialInputStream to the very end by Víctor M. González
  • [#​440] Use CompressionMethodForHeader for header entries by Richard Webb
  • [#​420] Throw NotSupportedException in ZipFile.Add when trying to add AES entry by Richard Webb
  • [#​421] Have ZipFile.Add validate compression compability internally by Richard Webb
  • [#​387] Better handle baseStreams closing themselves unexpectedly by Richard Webb
  • [#​408] When searching for the Zip64 end of central directory locator, pay attention to its fixed size by Richard Webb
  • [#​406] Skip forced Deflate flush when using Stored compression by nils måsén
  • [#​362] Don&#​39;t call CleanName from the ZipEntry constructor by Richard Webb
  • [#​465] Use correct count in ZipAESStream.ReadBufferedData by Víctor M. González
  • [#​390] Ensure GZipOutputStream headers are written before flush by Richard Webb
  • [#​498] Use string.Trim to trim strings by Richard Webb
  • [#​432] Throw ArgumentNullException in BZip2 by Richard Webb
  • [#​519] Restrict path traversal on TarArchive extraction by nils måsén

Features

  • [#​201] Raise ProcessDirectory event for FastZip extract by Stevie-O
  • [#​380] Add support for AES encryption in FastZip.CreateZip by Richard Webb
  • [#​497] Transform new entry names using an INameTranform in ZipOutputStream by Richard Webb
  • [#​482] Add variants of FastZip.CreateZip taking IScanFilter instead of strings by Richard Webb
  • [#​455] Add FastZip.CreateZip with a leaveOpen parameter by Richard Webb
  • [#​433] Restore directory timestamps when extracting with FastZip by Richard Webb
  • [#​472] Allow ZipFile to accept empty strings as passwords when decrypting AES entries by Richard Webb
  • [#​364] Add nameEncoding parameter to Tar entries by Yusuke Ito
  • [#​463] Improve support for Unix timestamps in ZIP archives by Bastian Eicher

Other changes (not related to library code)

  • [#​346] Add a Security Policy by nils måsén
    ... (truncated)

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: SharpZipLib
  dependency-version: 1.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Aug 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants