Bump rubyzip from 2.4.1 to 3.0.1

[dependabot]

Bumps rubyzip from 2.4.1 to 3.0.1.

Release notes

Sourced from rubyzip's releases.

v3.0.1

Version 3.0.1

⚠️ There are breaking changes in the 3.x series ⚠️

Please see the README and Updating to version 3.x in the wiki for help upgrading from version 2.4.x to version 3.x.

v3.0.0

Version 3.0.0

⚠️ There are breaking changes to the API in this release! ⚠️

Please see the README and Updating to version 3.x in the wiki for help upgrading from version 2.4.x to version 3.0.0.

Changelog

Sourced from rubyzip's changelog.

3.0.1 (2025-08-08)

• Restore Zip::File's Enumerable status. #641
• Escape filename pattern when matching in Entry#name_safe?. #639
• Eagerly require gem version. #637
• Fix direct require of Entry by requiring constants. #636

3.0.0 (2025-07-28)

• Fix de facto regression for input streams.
• Fix File#write_buffer to always return the given io.
• Add Entry#absolute_time? and DOSTime#absolute_time? methods.
• Use explicit named parameters for File methods.
• Ensure that entries can be extracted safely without path traversal. #540
• Enable Zip64 by default.
• Rename GPFBit3Error to StreamingError.
• Ensure that Entry.ftype is correct via InputStream. #533
• Add Entry#zip64? as a better way detect Zip64 entries.
• Implement Zip::FileSystem::ZipFsFile#symlink?.
• Remove File::add_buffer from the API.
• Fix OutputStream#put_next_entry to preserve StreamableStreams. #503
• Ensure File.open_buffer doesn't rewrite unchanged data.
• Add CentralDirectory#count_entries and File::count_entries.
• Fix reading unknown extra fields. #505
• Fix reading zip files with max length file comment. #508
• Fix reading zip64 files with max length file comment. #509
• Don't silently alter zip files opened with Zip::sort_entries. #329
• Use named parameters for optional arguments in the public API.
• Raise an error if entry names exceed 65,535 characters. #247
• Remove the ZipXError v1 legacy classes.
• Raise an error on reading a split archive with InputStream. #349
• Ensure InputStream raises GPFBit3Error for OSX Archive files. #493
• Improve documentation and error messages for InputStream. #196
• Fix zip file-level comment is not read from zip64 files. #492
• Fix Zip::OutputStream.write_buffer doesn't work with Tempfiles. #265
• Reinstate normalising pathname separators to /. #487
• Fix restore options consistency. #486
• View and/or preserve original date created, date modified? (Windows). #336
• Fix frozen string literal error. #475
• Set the default Entry time to the file's mtime on Windows. #465
• Ensure that Entry#time= sets times as DOSTime objects. #481
• Replace and deprecate Zip::DOSTime#dos_equals. #464
• Fix loading extra fields. #459
• Set compression level on a per-zipfile basis. #448
• Fix input stream partial read error. #462
• Fix zlib deflate buffer growth. #447

Tooling/internal:

• No longer test setting $\ in tests.

... (truncated)

Commits

• 932ea90 Update version number, README and Changelog for release.
• 85ec84b Restore Zip::File's Enumerable status.
• f91150a entry: escape filename pattern when matching in #name_safe?
• 69858e1 Eagerly require gem version
• 9d67a3e entry: fix direct require by requiring constants
• f1d0f48 Update version number, README and Changelog for release.
• 1d5e27d Remove research notice from the README.
• 7add81c No longer test setting $\ in tests.
• 1f3f84c Update version number and Changelog for RC2.
• deca4d5 Fix de facto regression for input streams.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[zinduolis]

@dependabot recreate

[zinduolis]

@dependabot recreate

[zinduolis]

@dependabot recreate

[Copilot]

Pull Request Overview

This PR bumps the rubyzip dependency from version 2.4.1 to 3.0.1, which includes significant breaking changes and security improvements. The update brings enhanced path traversal protection, Zip64 support by default, and various API improvements.

Key changes:

• Updated rubyzip version constraint from ~> 2.4 to ~> 3.0
• Incorporates breaking changes that may require code updates for compatibility
• Includes security enhancements and bug fixes from the 3.x series

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

This major version bump introduces breaking API changes. The changelog mentions changes to method signatures (explicit named parameters), removed methods (File::add_buffer), renamed exceptions (GPFBit3Error to StreamingError), and behavioral changes. You should verify that all rubyzip usage in the codebase is compatible with the 3.x API changes before merging this update.

[dependabot]

Superseded by #3383.