From fdd7457f86dbe42c9b4bbfeaef3c8a9bfe819eeb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 13 Feb 2026 09:45:45 +0000
Subject: [PATCH 1/2] update: bump zip from 6.0.0 to 7.4.0

Bumps [zip](https://github.com/zip-rs/zip2) from 6.0.0 to 7.4.0.
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zip-rs/zip2/compare/v6.0.0...v7.4.0)

---
updated-dependencies:
- dependency-name: zip
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock     | 35 +----------------------------------
 sdk/Cargo.toml |  6 +++---
 2 files changed, 4 insertions(+), 37 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 7e1e22a942..47f1bba775 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -127,15 +127,6 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
-dependencies = [
- "derive_arbitrary",
-]
-
 [[package]]
 name = "asn1-rs"
 version = "0.7.1"
@@ -525,8 +516,7 @@ dependencies = [
  "wstd",
  "x509-parser",
  "zeroize",
- "zip 6.0.0",
- "zip 7.4.0",
+ "zip",
 ]
 
 [[package]]
@@ -1099,17 +1089,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "derive_arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.115",
-]
-
 [[package]]
 name = "difflib"
 version = "0.4.0"
@@ -5464,18 +5443,6 @@ dependencies = [
  "syn 2.0.115",
 ]
 
-[[package]]
-name = "zip"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb2a05c7c36fde6c09b08576c9f7fb4cda705990f73b58fe011abf7dfb24168b"
-dependencies = [
- "arbitrary",
- "crc32fast",
- "indexmap 2.13.0",
- "memchr",
-]
-
 [[package]]
 name = "zip"
 version = "7.4.0"
diff --git a/sdk/Cargo.toml b/sdk/Cargo.toml
index 2c862113e0..98bcb85759 100644
--- a/sdk/Cargo.toml
+++ b/sdk/Cargo.toml
@@ -204,14 +204,14 @@ rcgen = "0.14.7"
 ureq = { version = "3.1.0", default-features = false, features = [
     "rustls"
 ], optional = true }
-zip = { version = "7.0.0", default-features = false }
+zip = { version = "7.4.0", default-features = false }
 
 [target.'cfg(target_os = "wasi")'.dependencies]
 rcgen = "0.14.7"
 wasi = { version = "0.14.3", optional = true }
 wstd = { version = "0.5.4", optional = true }
 # Use zip 6 for WASI to avoid typed-path wasip2 issue. Fix: http://github.com/chipsenkbeil/typed-path/pull/57
-zip = { version = "6.0.0", default-features = false }
+zip = { version = "7.4.0", default-features = false }
 
 # `wstd` is required for testing, but optional as a normal dependency.
 [target.'cfg(target_os = "wasi")'.dev-dependencies]
@@ -279,7 +279,7 @@ web-sys = { version = "0.3.58", features = [
     "Window",
     "WorkerGlobalScope",
 ] }
-zip = { version = "7.0.0", default-features = false }
+zip = { version = "7.4.0", default-features = false }
 
 [dev-dependencies]
 anyhow = "1.0.97"

From 51a0de5c3f758272f81d3ea116e26a6c6976876d Mon Sep 17 00:00:00 2001
From: Colin Murphy <colmurph@adobe.com>
Date: Sat, 14 Feb 2026 12:32:39 -0500
Subject: [PATCH 2/2] chore: consolidate zip dependencies

---
 sdk/Cargo.toml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/sdk/Cargo.toml b/sdk/Cargo.toml
index 98bcb85759..90bb0ad1b7 100644
--- a/sdk/Cargo.toml
+++ b/sdk/Cargo.toml
@@ -176,6 +176,7 @@ uuid = { version = "1.18.0", features = ["serde", "v4"] }
 web-time = "1.1"
 x509-parser = "0.18.0"
 zeroize = { version = "1.8", features = ["zeroize_derive"] }
+zip = { version = "7.4.0", default-features = false }
 
 # Use the asm feature of sha2 on aarch64 macOS for better performance. This nearly
 # halves hashing time for large assets (> 50gb mp4, for example).
@@ -204,14 +205,11 @@ rcgen = "0.14.7"
 ureq = { version = "3.1.0", default-features = false, features = [
     "rustls"
 ], optional = true }
-zip = { version = "7.4.0", default-features = false }
 
 [target.'cfg(target_os = "wasi")'.dependencies]
 rcgen = "0.14.7"
 wasi = { version = "0.14.3", optional = true }
 wstd = { version = "0.5.4", optional = true }
-# Use zip 6 for WASI to avoid typed-path wasip2 issue. Fix: http://github.com/chipsenkbeil/typed-path/pull/57
-zip = { version = "7.4.0", default-features = false }
 
 # `wstd` is required for testing, but optional as a normal dependency.
 [target.'cfg(target_os = "wasi")'.dev-dependencies]
@@ -279,7 +277,6 @@ web-sys = { version = "0.3.58", features = [
     "Window",
     "WorkerGlobalScope",
 ] }
-zip = { version = "7.4.0", default-features = false }
 
 [dev-dependencies]
 anyhow = "1.0.97"