[jeromeajot]

Moves the zip dependency from 8.6.0 to 9.1.3, as discussed in #212.

zip 8.x is flagged by five advisories that are only fixed in the 9.x line:

Advisory	Severity	Fixed in
GHSA-m665-v7pm-7grj	critical	9.0.5
GHSA-9hj8-73fh-9963	high	9.0.0
GHSA-hjqx-j4rw-g7xv	high	9.0.0
GHSA-q7v9-x93c-xqv3	high	9.0.0
GHSA-8hxf-qr8p-62x4	medium	9.0.0

What changed:

• Cargo.toml and fuzz/Cargo.toml: zip 8.6.0 to 9.1.3, same feature set (default features off, deflate on).
• Cargo.lock: zip 9.1.3, typed-path 0.12.3 to 0.13.0, plus the transitive cfg_aliases and nix crates that zip 9 pulls in.
• No source change was needed. The minimum supported Rust version stays at 1.88.

Checked locally: cargo test --locked passes (286 unit tests plus the integration tests) and cargo fmt --check is clean.

Closes #212

---

Summary by cubic

Updates the zip dependency from 8.6.0 to 9.1.3 to address five security advisories that are only fixed in the 9.x line.

• Bumps zip in Cargo.toml and fuzz/Cargo.toml, keeping the same feature set (default-features = false, deflate).
• Updates Cargo.lock to zip 9.1.3 and its new transitive dependencies (cfg_aliases, nix, and a typed-path bump).
• No source changes are required; the minimum supported Rust version remains 1.88.

Closes #212.

^{Written for commit b34060d. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{View guided diff | Re-trigger cubic}