Upgrade zip to 9.x to address extraction advisories

Cargo.toml

@@ -44,16 +44,16 @@ elements_rs = { version = "0.2.8", default-features = false }
 
 # Runtime extracts inner language/braille zips (BZIP2). The package-rules binary also
 # writes DEFLATE outer archives for Windows/unzip-compatible Rules.zip downloads.
-# wasm uses the same features: zip 8.x bzip2 is pure Rust (libbz2-rs-sys), not clang C.
-zip = { version = "8.2", default-features = false, features = ["deflate", "bzip2"] }
+# wasm uses the same features: zip 9.x bzip2 is pure Rust (libbz2-rs-sys), not clang C.
+zip = { version = "9.0", default-features = false, features = ["deflate", "bzip2"] }
 
 android_logger = {version = "0.15.1", optional = true}
 natural-tts = { version = "0.3.1", optional = true }
 
 [build-dependencies]
 bitflags = "2.6"
 yaml-rust = "0.4"
-zip = { version = "8.2", default-features = false, features = ["deflate", "bzip2"] }
+zip = { version = "9.0", default-features = false, features = ["deflate", "bzip2"] }
 
 [dev-dependencies]
 tempfile = "3.23"

src/bin/package_rules.rs

@@ -87,7 +87,7 @@ mod tests {
     fn outer_names(bytes: &[u8]) -> Vec<String> {
         let mut archive = ZipArchive::new(Cursor::new(bytes)).unwrap();
         let mut names: Vec<String> = (0..archive.len())
-            .map(|i| archive.by_index(i).unwrap().name().replace('\\', "/"))
+            .map(|i| archive.by_index(i).unwrap().name().unwrap().replace('\\', "/"))
             .collect();
         names.sort();
         return names;

src/rules_archive.rs

@@ -7,7 +7,7 @@
 //
 // Inner language/braille zips always use BZIP2. Downloadable `Rules.zip` uses DEFLATE for the
 // outer archive so Windows Explorer / `unzip` can open it. The include-zip embed uses BZIP2
-// for both layers (MathCAT's `zip` crate reads it; zip 8.x bzip2 is pure Rust and works on wasm).
+// for both layers (MathCAT's `zip` crate reads it; zip 9.x bzip2 is pure Rust and works on wasm).
 
 use std::fs::{self, File, read_dir};
 use std::io::{self, Cursor, Read, Seek, Write};

src/shim_filesystem.rs

@@ -108,7 +108,7 @@ cfg_if! {
                         let path = match file.enclosed_name() {
                             Some(path) => PathBuf::from(containing_dir).join(path),
                             None => {
-                                bail!("Entry {} has a suspicious path (outside of archive)", file.name());
+                                bail!("Entry {} has a suspicious path (outside of archive)", String::from_utf8_lossy(file.name_raw()));
                             }
                         };
                         // debug!("read_zip_file: file path='{}'", path.display());