[freshstrangemusic]

Pull Request checklist

• Breaking changes: This PR follows our breaking change policy
  • This PR follows the breaking change policy:
    • This PR has no breaking API changes, or
    • There are corresponding PRs for our consumer applications that resolve the breaking changes and have been approved
• Quality: This PR builds and tests run cleanly
  • Note:
    • For changes that need extra cross-platform testing, consider adding [ci full] to the PR title.
    • If this pull request includes a breaking change, consider cutting a new release after merging.
• Tests: This PR includes thorough tests or an explanation of why it does not
• Changelog: This PR includes a changelog entry in CHANGELOG.md or an explanation of why it does not need one
  • Any breaking changes to Swift or Kotlin binding APIs are noted explicitly
• Dependencies: This PR follows our dependency management guidelines
  • Any new dependencies are accompanied by a summary of the due diligence applied in selecting them.

[freshstrangemusic]

This does update zip to a version not in m-c but it is only used by an excluded crate: https://searchfox.org/firefox-main/source/Cargo.toml#134

[bendk]

moz-central is on 2.4.2, so I think this will require an audit on the next vendor. I'm not totally sure since this is "just" a CLI crate, but I think it will. I think there's a google audit for 6.0.0, so we might just need to audit 6 -> 9. Are you up for doing that?

[bendk]

I just read your comment and realized you had already checked into this.