build(deps): bump adm-zip from 0.6.0 to 0.6.1

[dependabot]

Bumps adm-zip from 0.6.0 to 0.6.1.

Release notes

Sourced from adm-zip's releases.

v0.6.1

Full Changelog: cthackers/adm-zip@v0.6.0...v0.6.1

• Updated dev dependencies
• Fixed uncaught crash in async decompression on malformed DEFLATE data
• Fixed addLocalFolder following symlinks out of the archived folder
• Stripped setuid/setgid/sticky bits from extracted file permissions
• Enforced the decompression size cap on the async path and for size 0
• Rejected archives with duplicate entry names
• Blocked extraction from writing through symlinks inside the target
• Routed malformed-header parse errors through the async callback
• Rejected zip entries whose declared data extent runs past the buffer
• Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
• Fixed addLocalFolderAsync2 mangling local paths on Windows

Commits

• cb2cf9b Fixed addLocalFolderAsync2 mangling local paths on Windows
• 54902b6 Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
• 73131bd Fixed CI
• 758898d Rejected zip entries whose declared data extent runs past the buffer
• 74b6e9f Routed malformed-header parse errors through the async callback
• eaa35fa Blocked extraction from writing through symlinks inside the target
• 1e015e3 Increment version
• 05101d4 Rejected archives with duplicate entry names
• 4916006 Enforced the decompression size cap on the async path and for size 0
• 6a63c33 Stripped setuid/setgid/sticky bits from extracted file permissions
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cloudflare-workers-and-pages]

Deploying electron-website with    Cloudflare Pages

Latest commit:	45922d7
Status:	✅  Deploy successful!
Preview URL:	https://8d0b5463.electron-website.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-adm-kkiu.electron-website.pages.dev

View logs

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	adm-zip@​0.6.0 ⏵ 0.6.1	+1	+18	+1

View full report

[claude]

LGTM, straightforward dependency version bump.

What was reviewed: confirmed the diff is limited to package.json and yarn.lock, bumping adm-zip from ^0.6.0 to ^0.6.1 (patch release) with matching resolution/checksum update; no application source, scripts, or docs touched. Also checked the ruled-out concern that the newer adm-zip's stricter zip validation (duplicate entries, size-cap enforcement) could affect src/transformers/api-history.ts's usage — that file only reads well-formed archives produced by the same toolchain, so the added strictness is not expected to break it.

Extended reasoning...

Overview

The PR is a dependency-only change generated by Dependabot: it bumps adm-zip from ^0.6.0 to ^0.6.1 in package.json, with yarn.lock regenerated to match (updated resolved version and integrity checksum in two lockfile entries). No application source code, build scripts, or documentation are modified.

Security risks

None introduced by this change itself. The adm-zip 0.6.1 release notes describe several security-hardening fixes (rejecting duplicate zip entries, blocking symlink traversal during extraction, enforcing decompression size caps, stripping setuid/setgid/sticky bits). These are all fixes that make the library stricter/safer, not regressions. A patch-level semver bump with matching lockfile update carries very low risk of supply-chain issues.

Level of scrutiny

This warrants minimal scrutiny: it is a single-dependency patch version bump confined to manifest/lockfile changes, matching the low-risk category (config/dependency bumps) called out in the approval guidelines. The bug hunting system found no findings, and the diff is fully mechanical and verifiable by inspection.

Other factors

One candidate concern was investigated and ruled out by the earlier bug-hunting pass: whether adm-zip 0.6.1's stricter parsing (duplicate entry rejection, buffer-overrun entry rejection) could break src/transformers/api-history.ts's zip handling. Given that file processes archives from a controlled/trusted source (not arbitrary untrusted zips), the added strictness is unlikely to cause regressions. No CODEOWNERS restrictions apply to package.json/yarn.lock in this repo, and there is no unresolved third-party objection in the PR timeline.