Build(deps): bump adm-zip from 0.6.0 to 0.6.1 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: adm-zip.

Updates adm-zip from 0.6.0 to 0.6.1

Release notes

Sourced from adm-zip's releases.

v0.6.1

Full Changelog: cthackers/adm-zip@v0.6.0...v0.6.1

• Updated dev dependencies
• Fixed uncaught crash in async decompression on malformed DEFLATE data
• Fixed addLocalFolder following symlinks out of the archived folder
• Stripped setuid/setgid/sticky bits from extracted file permissions
• Enforced the decompression size cap on the async path and for size 0
• Rejected archives with duplicate entry names
• Blocked extraction from writing through symlinks inside the target
• Routed malformed-header parse errors through the async callback
• Rejected zip entries whose declared data extent runs past the buffer
• Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
• Fixed addLocalFolderAsync2 mangling local paths on Windows

Commits

• cb2cf9b Fixed addLocalFolderAsync2 mangling local paths on Windows
• 54902b6 Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
• 73131bd Fixed CI
• 758898d Rejected zip entries whose declared data extent runs past the buffer
• 74b6e9f Routed malformed-header parse errors through the async callback
• eaa35fa Blocked extraction from writing through symlinks inside the target
• 1e015e3 Increment version
• 05101d4 Rejected archives with duplicate entry names
• 4916006 Enforced the decompression size cap on the async path and for size 0
• 6a63c33 Stripped setuid/setgid/sticky bits from extracted file permissions
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[joelst]

Review

Do not merge this Dependabot PR as written. The adm-zip 0.6.0 → 0.6.1 bump is the right security move, but this lockfile update is not a clean bump and CI already fails.

What this package is for in Flint

Flint does not import adm-zip. It is a transitive of foundry-local-sdk@1.2.4 (adm-zip: ^0.5.16). Flint already forces a newer copy via package.json overrides. The SDK uses it only in script/install-utils.cjs to open Microsoft .nupkg files and extractEntryTo a few native binaries (dll/so/dylib) into foundry-local-core/<platform>/. Flint never extracts user-supplied zips.

Will 0.6.1 break that?

Unlikely for the SDK install path:

• 0.6.1’s zip-bomb / symlink / setuid / async-path fixes do not apply to sync extractEntryTo of NuGet natives.
• addLocalFolder* changes are unused (the SDK only reads archives).

The only realistic breakage is if a Foundry nupkg has duplicate entry names or a declared data extent past the buffer — 0.6.1 now rejects those at parse time, which would fail npm install / ensure:foundry. Microsoft nupkgs normally do not look like that, but that path should be smoke-tested (npm run ensure:foundry) on a clean override bump, not assumed from this PR.

Practical risk of the advisory against Flint is low (trusted nuget.org / ADO feeds, not attacker zips). GitHub still flags 0.6.0 (GHSA-7q85-xj36-vmfc), so the override should move to 0.6.1.

Why this PR is the wrong vehicle

CI check and test both fail at npm run ci:deps:

npm ci can only install packages when package.json and package-lock.json are in sync
Missing: picomatch@4.0.7 from lock file

Dependabot also rewrote unrelated lockfile fields (version 0.7.0 → 0.9.0, dropped hasInstallScript, deleted the nested svelte-check picomatch entry). That last deletion is what broke npm ci.

Better approach

1. Close or ignore this PR.
2. On a clean branch from current main: set overrides.adm-zip to 0.6.1 (exact pin, not ^0.6.1, so a later 0.6.x cannot surprise-break nupkg extract).
3. Run npm install so only node_modules/adm-zip changes in the lockfile. Keep picomatch@4.0.7.
4. Add an empty changeset (override-only; no app bump) so CI’s changeset gate is happy.
5. Smoke npm run ensure:foundry (and npm run smoke:node if natives were re-extracted).
6. Update docs/BACKLOG.md — the “adm-zip advisory is not fixable without an SDK bump” line is already stale (the override is the fix).

Waiting for foundry-local-sdk to bump its own adm-zip is nicer long-term, but it still declares ^0.5.16. The override is the correct Flint-side lever until that pin moves.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml