…2_t'

mz_dir_has_unsafe_symlink walks every component of the destination
path and rejects any symlink with an absolute target. That's too
strict: when the user-chosen destination dir (or one of its ancestors)
happens to be a symlink, extracting into it gets rejected with -107.
The check only needs to police symlinks that appear strictly inside
the destination, since those could be zip-controlled.

Skip the symlink check when check_path is at or above base_path; let
the existing logic enforce on components below.

Fixes #943.

The Apple crypto backend defaults MZ_TARGET_APPSTORE to 1, which
makes mz_crypt_aes_set_key return MZ_SUPPORT_ERROR for GCM mode
because the GCM CommonCrypto APIs are private and rejected by App
Store review. The test was hard-coded to expect MZ_OK and failed on
the default macOS build.

Skip the test when the runtime reports MZ_SUPPORT_ERROR; otherwise
proceed and verify correctness as before.

minizip_erase rewrites the archive to a temp file under TMPDIR and
then renames it onto the source. rename(2) returns EXDEV across
filesystems, so when TMPDIR (e.g. /tmp) and the source live on
different mounts (a common conda-forge pattern), the rename fails
after the original was already moved aside to .bak — the next
operation that opens the archive sees no file and reports -111.

Add mz_os_path_same_fs() and have minizip_erase fall back on POSIX to
a same-dir temp when TMPDIR is on a different filesystem. POSIX uses
stat() st_dev comparison; Win32 uses _wstati64 for the parallel check
but the caller skips it under #ifndef _WIN32 because MoveFileExW with
MOVEFILE_COPY_ALLOWED already absorbs cross-volume rename internally.

Make the same-dir tmp filename unique (mz_ms_time suffix) and refuse
to clobber an existing leftover from a prior crash.

Refs #943.

mz_os_get_file_attribs used lstat on POSIX and GetFileAttributesW
on Win32, both of which return the link's own attributes rather
than the target's. Callers that wanted to follow a symlink had no
way to ask for that, so mz_zip_writer_add_file produced followed
entries tagged ISLNK and readers that tried to recreate them as
symlinks.

Flip mz_os_get_file_attribs to stat on POSIX and to a CreateFile +
GetFileInformationByHandle path on Win32 when the entry is a
reparse point. Add mz_os_get_link_attribs preserving the original
lstat / GetFileAttributesW semantics. Update mz_zip_writer_add_file
to pick the right getter for each branch and to skip symlinks
cleanly when neither store_links nor follow_links is set.

Refs #797.

Returns the absolute offset where the current entry's compressed
data begins, matching the original minizip API used by chromium and
other consumers. The position is already tracked internally via
entry_pos for STORE-method seek support, so this just exposes it.

Both packages export separate static and shared imported targets, but
the find_package paths picked one variant unconditionally — zstd
preferred libzstd_static and zlib-ng always linked the shared zlib.
Building minizip-ng with BUILD_SHARED_LIBS=ON against a system zstd
that ships both variants therefore produced a libminizip.so with zstd
statically baked in (#983).

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v7...v8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

The stream tests compress then decompress, but the deflate path returns
MZ_SUPPORT_ERROR when built with MZ_ZIP_NO_COMPRESSION, so the round
trip cannot run. Guard the tests on that macro, and exclude only the
inflate-and-compare half when MZ_ZIP_NO_DECOMPRESSION is set.

Assisted-By: Claude Opus 4.8

These test files were conditionally added to the test target by CMake,
so their in-source guards never ran in the excluded configurations.
Compile them unconditionally and let the ifdef guards select the tests.
test_compat.cc keeps its MZ_COMPAT gate in CMake since the compatibility
layer is only built then, but its compression requirement moves into the
source.

Assisted-By: Claude Opus 4.8

AES-GCM block size is 128 bits but IV size is 96+ bits.

The independent cipher bytes (encrypted text) are gotten on a 3rd party site.

Symlink archive entries had their stored target passed directly to
mz_os_make_symlink without checking containment, so a malicious
archive could create a link pointing outside the extraction root.

Add mz_path_is_symlink_target_safe to verify a link target resolves
within the destination directory, and apply it to both the UNIX1
extrafield and entry-content link targets. Reject symlink entries
outright when no destination base is set, since the target cannot be
validated without one.

Assisted-By: Claude Opus 4.8

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6 to 7.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v6...v7)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/cache](https://github.com/actions/cache) from 5 to 6.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v5...v6)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Add ICU as an alternative backend to libiconv using ucnv_convert.
ICU is detected via CMake's FindICU module on non-Windows platforms.
Add CI build configuration for ICU in GitHub Actions.

…4 EOCD

When number_entry in the standard EOCD is UINT16_MAX, the reader looks for a zip64 EOCD record. If not found, it returned MZ_FORMAT_ERROR even when the recover flag was set.

…has type 'time_t'

mz_os_posix.c:409:61: warning: format specifies type 'unsigned long' but the argument
has type 'time_t' (aka 'long long') [-Wformat]
  409 |     result = snprintf(path, max_path, "%s/%lux", temp_path, time(NULL));
      |                                           ~~~               ^~~~~~~~~~
      |                                           %lld
1 warning generated.

`CCCryptorGCMEncrypt()` and `CCCryptorGCMDecrypt()` returned kCCParamError
(-4300).