From a01e7ca21aa5c09a032b965922dd40a4f7719b87 Mon Sep 17 00:00:00 2001
From: drendog <dwenya@dren.dog>
Date: Sat, 17 Oct 2026 20:56:27 +0200
Subject: [PATCH] webrtc-sys-build: bump zip to 9.0.4 for security advisories

---
 .changeset/update_zip_to_9.md | 10 ++++++++++
 Cargo.lock                    | 23 +++++++++++++++++++----
 webrtc-sys/build/Cargo.toml   |  2 +-
 3 files changed, 30 insertions(+), 5 deletions(-)
 create mode 100644 .changeset/update_zip_to_9.md

diff --git a/.changeset/update_zip_to_9.md b/.changeset/update_zip_to_9.md
new file mode 100644
index 000000000..689bba7b5
--- /dev/null
+++ b/.changeset/update_zip_to_9.md
@@ -0,0 +1,10 @@
+---
+webrtc-sys-build: patch
+webrtc-sys: patch
+libwebrtc: patch
+livekit: patch
+livekit-capture: patch
+livekit-ffi: patch
+---
+
+Update `zip` to 9.0.4, as older releases have security issues and were temporarily yanked ([zip-rs/zip2#1075](https://github.com/zip-rs/zip2/issues/1075)).
diff --git a/Cargo.lock b/Cargo.lock
index 963aba893..f06645337 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2126,6 +2126,7 @@ checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
+ "zlib-rs",
 ]
 
 [[package]]
@@ -7986,6 +7987,12 @@ dependencies = [
  "rustc-hash 2.1.3",
 ]
 
+[[package]]
+name = "typed-path"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+
 [[package]]
 name = "typeid"
 version = "1.0.3"
@@ -9562,16 +9569,24 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "0.6.6"
+version = "9.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "760394e246e4c28189f19d488c058bf16f564016aefac5d32bb1f3b51d5e9261"
+checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22"
 dependencies = [
- "byteorder",
  "crc32fast",
- "crossbeam-utils",
  "flate2",
+ "indexmap 2.14.0",
+ "memchr",
+ "nix",
+ "typed-path",
 ]
 
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
+
 [[package]]
 name = "zmij"
 version = "1.0.23"
diff --git a/webrtc-sys/build/Cargo.toml b/webrtc-sys/build/Cargo.toml
index 4e985b526..a54519273 100644
--- a/webrtc-sys/build/Cargo.toml
+++ b/webrtc-sys/build/Cargo.toml
@@ -8,7 +8,7 @@ repository.workspace = true
 
 [dependencies]
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots", "blocking"] }
-zip = { version = "0.6", default-features = false, features = ["deflate"] }
+zip = { version = "9.0.4", default-features = false, features = ["deflate-flate2-zlib-rs"] }
 regex = "1.0"
 scratch = "1.0"
 fs2 = "0.4"