ZipArchive

• Bump minizip to 3.0.9
• Add a privacy manifest file per iOS 17+ requirements to document file API usage (thanks @lakshmankreditbee)

• Fixes #662 - CVE-2022-36943. (Thank you @imihaly)

• mz_compat updated to minizip 3.0.7
• Fixes Mac Catalyst build with bumped OS minimum requirements (Thank you @steventroughtonsmith!) #654

Reminder (This message will be dropped after this version):

Version 2.5.0+ Updates Minimum OS Versions.

A key dependency of this project is the zlib library. zlib before version 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches according to CVE-2018-25032.

zlib 1.2.12 is included in macOS 10.15+ (with latest security patches), iOS 15.5+, tvOS 15.4+, watchOS 8.4+. As such, these OS versions will be the new minimums as of version 2.5.0 of ZipArchive.

If you need support for previous versions of ZipArchive for earlier OS support, you can target an earlier version but know you will be using an unmaintained version of this library.

• mz_compat updated to minizip 3.0.6 by @jhudsonWA in https://github.com/ZipArchive/ZipArchive/pull/647

Builds on 2.5.1:

Bumps the version of minizip used to 3.0.6 which includes fixes for two buffer overflow issues [fixed in 3.0.5+] (Thank you LB who reached out via email)

Reminder:

Version 2.5.0+ Updates Minimum OS Versions

A key dependency of this project is the zlib library. zlib before version 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches according to CVE-2018-25032.

zlib 1.2.12 is included in macOS 10.15+ (with latest security patches), iOS 15.5+, tvOS 15.4+, watchOS 8.4+. As such, these OS versions will be the new minimums as of version 2.5.0 of ZipArchive.

If you need support for previous versions of ZipArchive for earlier OS support you can target an earlier version but know you will be using an unmaintained version of this library.

Bumps the version of minizip used to 3.0.6 which includes fixes for two buffer overflow issues [fixed in 3.0.5+] (Thank you LB who reached out via email)

Reminder:

Version 2.5.0+ Updates Minimum OS Versions

A key dependency of this project is the zlib library. zlib before version 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches according to CVE-2018-25032.

zlib 1.2.12 is included in macOS 10.15+ (with latest security patches), iOS 15.5+, tvOS 15.4+, watchOS 8.4+. As such, these OS versions will be the new minimums as of version 2.5.0 of ZipArchive.

If you need support for previous versions of ZipArchive for earlier OS support you can target an earlier version but know you will be using an unmaintained version of this library.

We will not support versions of ZipArchive that use dependencies with known vulnerabilities.

Version 2.5.0+ Updates Minimum OS Versions

A key dependency of this project is the zlib library. zlib before version 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches according to CVE-2018-25032.

zlib 1.2.12 is included in macOS 10.15+ (with latest security patches), iOS 15.5+, tvOS 15.4+, watchOS 8.4+. As such, these OS versions will be the new minimums as of version 2.5.0 of ZipArchive.

If you need support for previous versions of ZipArchive for earlier OS support you can target an earlier version but know you will be using an unmaintained version of this library.

We will not support versions of ZipArchive that use dependencies with known vulnerabilities.

Upgraded minizip to 3.0.4.

Fixes:
More header/import work to help ensure previous integrations continue to work after SPM support was added. (#617) (Thank you @CLJian)

Fixes:

• Restores CocoaPods includes paths to be the same as 2.2.3 (Pre-SPM) - Fixes #616, #615

Improvements:

• Moving to Github actions for CI/CD (#576) (Thank you @willson-chen) - travis-ci.org is shutting down 3/31/2021 and moving to their commercial platform. Getting credits for OSS projects is possible, but takes continual requests and maintenance.
• Provide progress handler for + (BOOL)createZipFileAtPath:withFilesAtPaths:withPassword: (#578) (Thank you @fritzt0)

Improvements And Fixes:

• minizip-ng (formally minizip) upgraded to version 3.0.2 (#613)
• Can now use openForAppending to append to the zip file (#598) (Thank you @andrewreeman)
• Added support for compressing symbolic link files and keeping them as symbolic links (#560) (Thank you @willson-chen) - fixes #313, #423, #551

Fixes:

• Forbid archive included in compress path (#569)

Improvements:

• Swift Package Manager Support! (#536) (Thank you @victor-pavlychko and others for your help getting this merged and tested)
• Enable zip64 to allow the creation of zip files larger than 4.3Gb (#580) (Thank you @joelfischerr)
• Xcode 12 warning fixes (#588) (Thank you @ddaddy)
• License update to remove reference to @soffes (#610) (Thank you @soffes for all of your contributions to this project over the years)

Reminder:

• We stopped releasing Carthage package in a previous version. It is better for developers to build it by themselves.

Fixes:

• Set file flag to UTF-8 when zipping files. (#564)---fixed #461

Improvements:

• Remove executable bit from non-executable files (#563 thanks @friederbluemle)
• Replacing Minizip 2.8.9 with Minizip 2.9.2.dev (#558, big thanks @nmoinvaz)
• Updating Travis for Xcode 11 (thanks @Coeur)
• Update Podfile (thanks @Coeur)
• Improved error message (#532 thanks @philippec-ls)
• Dropping iOS 8, as it's now unsecure (#531 thanks @Coeur)
• Added -payloadSizeForArchiveAtPath (#530 thanks @philippec-ls)
• Added missing newline && Renamed local variable (#529 thanks @philippec-ls)
• ProvisioningStyle = Automatic; for tests (thanks @Coeur)

Note:

• We stop releasing Carthage package from this version on. It is better for developers to build it by themselves.

Fixes:

• AES compatibility when zipping and unzipping (thanks @Florrr #516 and @JeffersonSchuler #517 for the simultaneous reports, @nmoinvaz for the quick fix)---update to fix #559

Fixes:

• Podspec should only affect pod_target_xcconfig, not user_target_xcconfig.
• Carthage should include SSZipCommon.h (#511, thanks @wanewang)

Fixes:

• Error handling when exceeding the limit of file open. (#483, thanks @Tamamaki)
• Fix version_madeby for unicode support when creating zip files (#507, thanks @jsutdolph)
• Fix some minor Xcode 10.2 warnings

Improvements:

• Replacing Minizip 1.2+ with Minizip 2.8.6.dev (#509, big thanks @nmoinvaz)

Breaking:

• ios minimum deployment target is now really 8.0 for CocoaPods, so don't forget to define your minimum deployment target explicitly in your Podfile.

Fixes:

• Carthage compatibility with Xcode 10.2+ (#500, thanks @DivineDominion)
• Carthage build with watchOS arm64_32 slice (#474)
• File path sanitation compatibility with Unicode (#472)
• Fix resource leak when testing password protection or failing to open a file (#418, thanks @craig65535)
• Fix zipping together more than 65535 files (https://github.com/nmoinvaz/minizip/pull/373, thanks @idezzzz)

Improvements:

• Allow reading > 64k at a time on platforms where zlib supports this (https://github.com/nmoinvaz/minizip/pull/327)

Fixes:

• avoid that the applications continue to read incorrect data when wrong password is entered. (nmoinvaz/minizip#210)
• avoid buffers overwrite (#438, thanks @fpillet, @cleric, @littlebobert, @alexrestrepo)
• handle empty directory path gracefully when keepParentDirectory is YES (#468, thanks @rob2468)

Improvements:

• compatibility with CocoaPods module for Swift. (#452, thanks @taglia3)
• swifter empty status of a directory (#465, thanks @rob2468)
• unzipping a directory doesn't require a password

Fixes:

Sanitize path traversal characters from file names before unarchiving them. #456 (Thanks @EthanArbuckle!)

Fixes:

• fix compatibility with iOS 4.3 and iOS 5.x
• improved DOS filename support ( #443, thanks @palmin)
• fix isFilePasswordProtectedAtPath (#445, thanks @hacknicity)
• fix two small memory leaks (#446, thanks @hacknicity)

Hotfix:

• fix unzipping some files (regression in 2.1.0, #402, thanks @jdeepwell)

Fixes:

• Safer encryption by using arc4random_buf instead of "/dev/urandom" (https://github.com/nmoinvaz/minizip/issues/175)
• fix nested zip files (#380, thanks @Alyn-zz)
• fix carthage iOS/tvOS/watchOS frameworks compatibility with swift (#396)
• ignoring __MACOSX/ (#400, thanks @0x68)
• fix unzipping archives with more than 65535 entries (#403, thanks @jdeepwell)