fix(desktop): bump zip to 9 for RUSTSEC-2026-0367/0368/0369 (#8412)

🤖 Bumps the desktop app's direct `zip` dependency from 8 to 9 to clear
RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369 on the
managed Node.js archive extraction path.

zip 9 makes `ZipArchive::name_for_index` and `ZipFile::name` fallible.
Managed Node.js zip validation now rejects an entry whose name can't be
decoded, and the "unsafe path" error prints the raw entry name lossily.
The absolute-path, drive-prefix, traversal and `enclosed_name()` checks
are unchanged.

The lockfile update is scoped to `zip`; it pulls in newer `zstd`,
`lzma-rust2` and `ppmd-rust` that zip 9 requires.

**`zip` 8 is still in release builds.** With `--features mesh-llm`,
`mesh-llm` v0.76.2 (`mesh-llm-system`, `mesh-llm-plugin-manager`,
`mesh-llm-host-runtime`) still depends on `zip` 8.6.0. That goes away
when the `mesh-llm` pin moves to a release that includes
Mesh-LLM/mesh-llm#2471.

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

desktop/src-tauri/Cargo.lock

@@ -916,7 +916,7 @@ dependencies = [
  "arrayvec",
  "cc",
  "cfg-if 1.0.4",
- "constant_time_eq",
+ "constant_time_eq 0.4.2",
  "cpufeatures 0.3.0",
 ]
 
@@ -1208,7 +1208,7 @@ dependencies = [
  "window-vibrancy",
  "windows-sys 0.61.2",
  "zeroize",
- "zip 8.6.0",
+ "zip 9.0.5",
 ]
 
 [[package]]
@@ -1809,6 +1809,15 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
 
+[[package]]
+name = "constant_time_eq"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eb6feb175df65d0a3ccd3e73484e940d0ac664e8034f0519fd49a93db3071d9"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "convert_case"
 version = "0.10.0"
@@ -5095,9 +5104,9 @@ dependencies = [
 
 [[package]]
 name = "lzma-rust2"
-version = "0.16.5"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca93e534d1142d1d0dcca6d25fe302508a5dfb40b302802904577725ea0b695b"
+checksum = "7277c9742229dc25243236d578b6471a798c554512c6f6a04365ec2e87c2a3bb"
 dependencies = [
  "sha2 0.11.0",
 ]
@@ -7869,9 +7878,9 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "ppmd-rust"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efca4c95a19a79d1c98f791f10aebd5c1363b473244630bb7dbde1dc98455a24"
+checksum = "196a7c80b9a7652aba7cc070827516c2abe4ccdf53d128e1944003cf5726cff1"
 
 [[package]]
 name = "ppv-lite86"
@@ -14015,10 +14024,24 @@ name = "zip"
 version = "8.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "indexmap 2.14.0",
+ "memchr",
+ "typed-path",
+ "zopfli",
+]
+
+[[package]]
+name = "zip"
+version = "9.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e04976da629d3b04204ba8105b396a193af8ad2583b2c79bfb3ab8af580a11e"
 dependencies = [
  "aes 0.9.1",
  "bzip2 0.6.1",
- "constant_time_eq",
+ "constant_time_eq 0.6.1",
  "crc32fast",
  "deflate64",
  "flate2",
@@ -14027,6 +14050,7 @@ dependencies = [
  "indexmap 2.14.0",
  "lzma-rust2",
  "memchr",
+ "nix 0.31.3",
  "pbkdf2 0.13.0",
  "ppmd-rust",
  "sha1 0.11.0",
@@ -14063,27 +14087,27 @@ dependencies = [
 
 [[package]]
 name = "zstd"
-version = "0.13.3"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+checksum = "db3ae9bf90af6e40197bef767eeefc46ad6397420fe873830bd85e5fbbfb3c70"
 dependencies = [
  "zstd-safe",
 ]
 
 [[package]]
 name = "zstd-safe"
-version = "7.2.4"
+version = "8.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
+checksum = "ded520f16b29e1a9b771c722221b2b0a0398c2316d9bb3c42b458a5414d7434b"
 dependencies = [
  "zstd-sys",
 ]
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.16+zstd.1.5.7"
+version = "2.1.2+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+checksum = "481ada9c543b2323cbb7bbdbb5249177fbf0188ed959ed2c15e4b22421c84ed3"
 dependencies = [
  "cc",
  "pkg-config",

desktop/src-tauri/Cargo.toml

@@ -139,7 +139,7 @@ png = "0.18"
 # target-gated inside arboard; at runtime X11 sessions still fall back to X11.
 arboard = { version = "3", features = ["wayland-data-control"] }
 image = { version = "0.25", default-features = false, features = ["jpeg", "png", "webp", "gif"] }
-zip = "8"
+zip = "9"
 flate2 = "1"
 sherpa-onnx = "1.12"
 regex = "1"

desktop/src-tauri/src/commands/agent_discovery/managed_node.rs

@@ -472,7 +472,8 @@ fn validate_managed_node_zip_entries(
     for i in 0..archive.len() {
         let name = archive
             .name_for_index(i)
-            .ok_or_else(|| format!("Node.js zip entry {i}: missing name"))?;
+            .ok_or_else(|| format!("Node.js zip entry {i}: missing name"))?
+            .map_err(|e| format!("Node.js zip entry {i}: invalid name: {e}"))?;
 
         // Absolute-path checks (platform-neutral).
         if name.starts_with('/') || name.starts_with('\\') {
@@ -509,7 +510,7 @@ fn extract_managed_node_zip(
             None => {
                 return Err(format!(
                     "Node.js zip contains unsafe path: {}",
-                    entry.name()
+                    String::from_utf8_lossy(entry.name_raw())
                 ))
             }
         };