Bump the cargo group with 2 updates

[dependabot]

Bumps the cargo group with 2 updates: async_zip and bag_address_lookup.

Updates async_zip from 0.0.18 to 0.0.19

Release notes

Sourced from async_zip's releases.

v0.0.19

Bumps to v0.0.19, which lands #192, a rewrite of the seek reader. See CHANGELOG.md and MIGRATION.md.

Changelog

Sourced from async_zip's changelog.

[0.0.19] - 2026-08-22

Added

• This changelog and MIGRATION.md.
• Terminology and high-level ZIP concepts (archive, file, LF/LFH, CDR/CDRH, EOCDR, CEOCDR) documented in the [base] module, and used consistently across the new API.
• Tracing as an optional dependency, enabled via the tracing feature. Included in full.
• An initial re-write of the read module. This is still in active development, with no stream reader currently. The intent is to fully replace the existing read module with it. Improvements include a large set of configurable validation checks. This reader is intended to be in feature parity with the old read module. It lives at [base::read1] until then, and provides:
  • [base::read1::seek::ZipArchiveReader], which reads the central directory up-front and opens files by index without consuming the source reader ([file()], or [file_oneshot()]).
  • [base::read1::seek::ZipArchiveFactory], a user-supplied generator function which produces additional readers over the same archive for concurrent/parallel file reads.
  • [base::read1::seek::ZipArchiveInner], shareable archive metadata which can be reused across readers via [new_with_inner()] to avoid re-reading the central directory.
  • [base::read1::ZipFileReader], an [AsyncRead] over a single file which validates the CRC32 and uncompressed size on EOF.
  • [base::read1::ZipOptions], a set of configurable validations and limits, plus [ZipOptions::untrusted()] as a conservative starting point for untrusted archives.
  • ZIP64 support, including ZIP64-aware accessors on [LF], [CDR] and [CEOCDR].
• The [spec] module is now public, exposing [spec::headers1] (primitive headers), [spec::constructs] (headers combined with their variable-length data), [spec::extra] (extra fields), [spec::ZipString] and the [spec::KnownSize] trait.
• New [ZipError] variants covering header/CDR mismatches, configured limits, invalid offsets, missing ZIP64 records, and binary parse failures.

Changed

• The full feature now includes tracing.
• The specification link in the README and crate docs now points at PKWARE's APPNOTE.TXT.

Deprecated

• [base::read::seek::ZipFileReader], [base::read::mem::ZipFileReader] and [tokio::read::fs::ZipFileReader] in favour of [base::read1].

Removed

Fixed

Security

• The new reader bounds what an archive can make it allocate or read on your behalf. Extra field block sizes, extra field counts, central directory size and file counts, and per-file compressed and uncompressed sizes are all checked against configured limits before anything is allocated. File names remain your responsibility to sanitise.

Commits

• 7c3aefe Add compare changelog for 0.0.19
• 173bb0b Fix README issue
• e8cc897 Bump version
• b55a19c Bump actions/checkout from 6 to 7
• a64cf79 Fill changelog/migration
• 2785a05 Fix typos
• 15fedd6 Fix no features tests
• 15fa4cd Audit fixes for breaking changes
• bd85e74 Latest fixes
• 7936ed9 Spec pub use changes
• Additional commits viewable in compare view

Updates bag_address_lookup from lib-v0.8.1 to lib-v0.8.3

Commits

• f02f27e chore: publish v0.8.3 with bag.bin
• 7e1638f chore: monthly release v0.8.3
• bc04bc6 Bump the cargo-dependencies group across 1 directory with 4 updates (#25)
• 6751c84 chore: monthly release v0.8.2
• fc7a443 Bump quick-xml in the cargo-dependencies group across 1 directory (#23)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Sigrid maintainability feedback

---

🔒Enable security insights in your CI pipeline to detect vulnerabilities early.
Start using Sigrid CI for Security today. Learn more.

---

💭️ You did not change any files that are analyzed by Sigrid.

---

View this system in Sigrid

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud