fix(deps): bump the non-major-version-updates group with 5 updates by dependabot[bot] · Pull Request #29 · electron/extract-zip

dependabot · 2026-10-24T06:31:49Z

Bumps the non-major-version-updates group with 5 updates:

Package	From	To
napi	`3.9.0`	`3.14.2`
napi-derive	`3.5.6`	`3.6.12`
zip	`9.0.3`	`9.0.4`
unicode-normalization	`0.1.25`	`0.1.26`
napi-build	`2.3.2`	`2.6.0`

Updates napi from 3.9.0 to 3.14.2

Release notes

Sourced from napi's releases.

napi-v3.14.2

Fixed

(napi) register the wasm cleanup through the env cleanup hook (#3571)

(napi) own NativeBorrowScope storage via NonNull to fix aliasing violation (#3573)

(napi) bound serde_json::Value conversion depth at 128 levels (#3568)

napi-v3.14.1

Fixed

(napi) create objects with napi_define_properties on every Node version (#3560)

napi-v3.14.0

Added

(napi) lock the allocator on threaded WASI and never hang after a worker crash (#3552)

napi-v3.13.0

Added

(async-runtime) offer the MultiThread flavor on wasm32-wasip1-threads (#3541)

Fixed

(napi) validate native payload provenance for External and instance data (#3540)

napi-v3.12.7

Fixed

(napi) guard AsyncTask completion against env teardown (#3536)

napi-v3.12.6

Fixed

(cli) drain outstanding async work before disposing a WASI binding (#3528)

napi-v3.12.5

Fixed

fatal_exception noop in optimized builds (#3509)

napi-v3.12.4

Security

Object::unwrap and Object::remove_wrapped (and the deprecated Env::unwrap / Env::drop_wrapped) read a TypeId out of a payload that is not a TaggedObject, giving a heap out-of-bounds read and a JavaScript-forgeable out-of-bounds write; payload provenance is now validated before dereferencing. See GHSA-rhpj-pggq-896v, fixed in #3506.

The serde deserializer reached unreachable!() on ordinary JavaScript values and aborted the process instead of returning an error. See GHSA-f334-75xc-qxv3, fixed in #3507.

ArrayBuffer::from_external, TypedArraySlice::from_external and Uint8ClampedSlice::from_external (plus the compat-mode Env::create_arraybuffer_with_borrowed_data) built their slice from freed memory on runtimes without external buffers. See GHSA-32mm-r9wp-hrvc, fixed in #3503.

Fixed

... (truncated)

Commits

8bab46e chore: release (#3567)
9c49b6c chore(release): publish
e73367c feat: recognize the aarch64-unknown-freebsd target (#3574)
44e7911 chore(deps): update dependency @oxc-node/core to v0.1.3 (#3564)
962e4b5 fix(cli): keep WASI-managed root entry that differs from package main (#3572)
469b861 chore(deps): update dependency webdriverio to v10 (#3566)
9ca1bab fix(napi): register the wasm cleanup through the env cleanup hook (#3571)
8047dbb fix(napi): own NativeBorrowScope storage via NonNull to fix aliasing violatio...
125e472 fix(napi): bound serde_json::Value conversion depth at 128 levels (#3568)
a713fcb chore(deps): update dependency oxc-parser to ^0.153.0 (#3569)
Additional commits viewable in compare view

Updates napi-derive from 3.5.6 to 3.6.12

Release notes

Sourced from napi-derive's releases.

napi-derive-v3.6.12

Other

update Cargo.toml dependencies

napi-derive-v3.6.11

Fixed

(deps) update rust crate syn to v3 (#3407)

napi-derive-v3.6.10

Other

update Cargo.toml dependencies

napi-derive-v3.6.9

Other

update Cargo.toml dependencies

napi-derive-v3.6.8

Fixed

(napi) guard AsyncTask completion against env teardown (#3536)

napi-derive-v3.6.7

Other

update Cargo.toml dependencies

napi-derive-v3.6.6

Other

update Cargo.toml dependencies

napi-derive-v3.6.5

Other

update Cargo.toml dependencies

napi-derive-v3.6.4

Fixed

(deps) update rust crate convert_case to 0.12 (#3469)

napi-derive-v3.6.3

Other

updated the following local packages: napi-derive-backend

... (truncated)

Commits

8bab46e chore: release (#3567)
9c49b6c chore(release): publish
e73367c feat: recognize the aarch64-unknown-freebsd target (#3574)
44e7911 chore(deps): update dependency @oxc-node/core to v0.1.3 (#3564)
962e4b5 fix(cli): keep WASI-managed root entry that differs from package main (#3572)
469b861 chore(deps): update dependency webdriverio to v10 (#3566)
9ca1bab fix(napi): register the wasm cleanup through the env cleanup hook (#3571)
8047dbb fix(napi): own NativeBorrowScope storage via NonNull to fix aliasing violatio...
125e472 fix(napi): bound serde_json::Value conversion depth at 128 levels (#3568)
a713fcb chore(deps): update dependency oxc-parser to ^0.153.0 (#3569)
Additional commits viewable in compare view

Updates zip from 9.0.3 to 9.0.4

Release notes

Sourced from zip's releases.

v9.0.4

🐛 Bug Fixes

enclosed_name rejects a separator inside one verbatim path component (#1066)

return Ok(None) when read_zipfile_from_stream is called on an empty archive (#1063)

⚙️ Miscellaneous Tasks

Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#1065)

update lzma-rust2 and ppmd-rust dependencies (#1060)

Changelog

Sourced from zip's changelog.

9.0.4 - 2026-10-16

🐛 Bug Fixes

enclosed_name rejects a separator inside one verbatim path component (#1066)

return Ok(None) when read_zipfile_from_stream is called on an empty archive (#1063)

⚙️ Miscellaneous Tasks

Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#1065)

update lzma-rust2 and ppmd-rust dependencies (#1060)

Commits

7d99886 chore: release v9.0.4 (#1071)
f61665e ci(deps): bump the codeql group with 2 updates (#1072)
3f4f58c ci(deps): bump release-plz/action from 0.5.139 to 0.5.140 (#1069)
8853a03 ci(deps): bump step-security/harden-runner from 2.22.0 to 2.22.1 (#1070)
3ea38eb ci(fuzz): Write errors to stderr rather than stdout (#1064)
a5a1a66 ci(deps): bump github/codeql-action/upload-sarif from 4.38.2 to 4.38.3 (#1073)
ca70ca9 ci(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 (#1068)
9d76832 fix: enclosed_name rejects a separator inside one verbatim path component (#1...
0ebefb8 fix: return Ok(None) when read_zipfile_from_stream is called on an empty ar...
b7c1a5b ci: Exit read fuzzing early if a crash occurs (#1062)
Additional commits viewable in compare view

Updates unicode-normalization from 0.1.25 to 0.1.26

Commits

See full diff in compare view

Updates napi-build from 2.3.2 to 2.6.0

Release notes

Sourced from napi-build's releases.

napi-build-v2.6.0

Added

(async-runtime) offer the MultiThread flavor on wasm32-wasip1-threads (#3541)

napi-build-v2.5.0

Added

(async-runtime) offer the MultiThread flavor on wasm32-wasip1-threads (#3541)

napi-build-v2.4.4

Fixed

(napi) guard AsyncTask completion against env teardown (#3536)

napi-build-v2.4.3

Fixed

(cli) drain outstanding async work before disposing a WASI binding (#3528)

napi-build-v2.4.2

Fixed

(cli,build) make wasm32-wasip1-threads link with wasi-sdk 34 and Rust nightly (#3492)

napi-build-v2.4.1

Fixed

(napi) stop unloading addons with live native code, preserve non-Error rejections, and add the wasm teardown barrier (#3423)

napi-build-v2.4.0

Added

(cli) support non-threaded WASI targets (#3353)

Commits

a94cef3 feat(napi): lock the allocator on threaded WASI and never hang after a worker...
e50c819 chore(deps): update dependency oxfmt to ^0.71.0 (#3549)
29d4fa5 ci: replace yarn with nodejs in msys2 pacboy install (#3553)
afbe5df chore(deps): update yarn to v4.18.1 (#3547)
210bc27 chore(deps): update dependency oxfmt to ^0.70.0 (#3543)
2763e12 chore: release (#3538)
5ae5cf6 chore(release): publish
0da138e feat(cli): self-sign OpenHarmony artifacts with --ohos-sign (#3539)
2499a63 feat(async-runtime): offer the MultiThread flavor on wasm32-wasip1-threads (#...
886bd07 chore(deps): update dependency oxc-parser to ^0.151.0 (#3542)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the non-major-version-updates group with 5 updates: | Package | From | To | | --- | --- | --- | | [napi](https://github.com/napi-rs/napi-rs) | `3.9.0` | `3.14.2` | | [napi-derive](https://github.com/napi-rs/napi-rs) | `3.5.6` | `3.6.12` | | [zip](https://github.com/zip-rs/zip2) | `9.0.3` | `9.0.4` | | [unicode-normalization](https://github.com/unicode-rs/unicode-normalization) | `0.1.25` | `0.1.26` | | [napi-build](https://github.com/napi-rs/napi-rs) | `2.3.2` | `2.6.0` | Updates `napi` from 3.9.0 to 3.14.2 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](napi-rs/napi-rs@napi-v3.9.0...napi-v3.14.2) Updates `napi-derive` from 3.5.6 to 3.6.12 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](napi-rs/napi-rs@napi-derive-v3.5.6...napi-derive-v3.6.12) Updates `zip` from 9.0.3 to 9.0.4 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](zip-rs/zip2@v9.0.3...v9.0.4) Updates `unicode-normalization` from 0.1.25 to 0.1.26 - [Commits](https://github.com/unicode-rs/unicode-normalization/commits/v0.1.26) Updates `napi-build` from 2.3.2 to 2.6.0 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](napi-rs/napi-rs@napi-build-v2.3.2...napi-build-v2.6.0) --- updated-dependencies: - dependency-name: napi dependency-version: 3.14.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: non-major-version-updates - dependency-name: napi-derive dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: non-major-version-updates - dependency-name: zip dependency-version: 9.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: non-major-version-updates - dependency-name: unicode-normalization dependency-version: 0.1.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: non-major-version-updates - dependency-name: napi-build dependency-version: 2.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: non-major-version-updates ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-10-24T06:32:12Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/unicode-normalization@0.1.25 ⏵ 0.1.26
	cargo/napi@3.9.0 ⏵ 3.14.2
	cargo/napi-build@2.3.2 ⏵ 2.6.0	^-2
	cargo/napi-derive@3.5.6 ⏵ 3.6.12
	cargo/zip@9.0.3 ⏵ 9.0.4

View full report

socket-security · 2026-10-24T06:32:14Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

cargo/syn@3.0.9
cargo/convert_case@0.12.0
cargo/napi@3.14.2
cargo/napi-build@2.6.0
cargo/napi-derive@3.6.12
cargo/napi-derive-backend@6.1.5
cargo/napi-sys@3.4.1
cargo/unicode-normalization@0.1.26
cargo/zip@9.0.4

View full report

claude

Code review found no issues

No high-confidence issues detected in this change.

napi-derive-backend 6.1.6 generates calls to napi::bindgen_prelude::defer_native_borrow_scope, which only exists in napi 3.15.0; the lock pins napi 3.14.2. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ScqBk6P9MTu4DBRVAaCHEb

claude

Code review found no issues

No high-confidence issues detected in this change.

MarshallOfSound · 2026-10-24T06:58:06Z

@SocketSecurity ignore-all

electron-npm-package-publisher · 2026-10-28T17:05:25Z

🎉 This PR is included in version 1.0.7 🎉

The release is available on:

Your semantic-release bot 📦🚀

dependabot Bot requested a review from a team as a code owner October 24, 2026 06:31

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 24, 2026

claude Bot reviewed Oct 24, 2026

View reviewed changes

MarshallOfSound enabled auto-merge (squash) October 24, 2026 06:35

MarshallOfSound approved these changes Oct 24, 2026

View reviewed changes

claude Bot reviewed Oct 24, 2026

View reviewed changes

MarshallOfSound approved these changes Oct 24, 2026

View reviewed changes

dsanders11 approved these changes Oct 28, 2026

View reviewed changes

MarshallOfSound merged commit d0e50f9 into main Oct 28, 2026
29 checks passed

MarshallOfSound deleted the dependabot/cargo/non-major-version-updates-2db0074661 branch October 28, 2026 17:00

electron-npm-package-publisher Bot added the released label Oct 28, 2026

Navigation Menu

Repository navigation

fix(deps): bump the non-major-version-updates group with 5 updates - #29

fix(deps): bump the non-major-version-updates group with 5 updates#29
MarshallOfSound merged 2 commits into
mainfrom
dependabot/cargo/non-major-version-updates-2db0074661

dependabot Bot commented on behalf of github Oct 24, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

claude Bot left a comment

Uh oh!

MarshallOfSound commented Oct 24, 2026

Uh oh!

Uh oh!

electron-npm-package-publisher Bot commented Oct 28, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot Bot commented on behalf of github Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

napi-v3.14.2

Fixed

napi-v3.14.1

Fixed

napi-v3.14.0

Added

napi-v3.13.0

Added

Fixed

napi-v3.12.7

Fixed

napi-v3.12.6

Fixed

napi-v3.12.5

Fixed

napi-v3.12.4

Security

Fixed

napi-derive-v3.6.12

Other

napi-derive-v3.6.11

Fixed

napi-derive-v3.6.10

Other

napi-derive-v3.6.9

Other

napi-derive-v3.6.8

Fixed

napi-derive-v3.6.7

Other

napi-derive-v3.6.6

Other

napi-derive-v3.6.5

Other

napi-derive-v3.6.4

Fixed

napi-derive-v3.6.3

Other

v9.0.4

🐛 Bug Fixes

⚙️ Miscellaneous Tasks

9.0.4 - 2026-10-16

🐛 Bug Fixes

⚙️ Miscellaneous Tasks

napi-build-v2.6.0

Added

napi-build-v2.5.0

Added

napi-build-v2.4.4

Fixed

napi-build-v2.4.3

Fixed

napi-build-v2.4.2

Fixed

napi-build-v2.4.1

Fixed

napi-build-v2.4.0

Added

Uh oh!

socket-security Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

MarshallOfSound commented Oct 24, 2026

Uh oh!

Uh oh!

electron-npm-package-publisher Bot commented Oct 28, 2026

Uh oh!

Reviewers

dependabot Bot commented on behalf of github Oct 24, 2026 •

edited

Loading

socket-security Bot commented Oct 24, 2026 •

edited

Loading

socket-security Bot commented Oct 24, 2026 •

edited

Loading