From e8598ba8d336a0238a315775b5b392a62f37be7e Mon Sep 17 00:00:00 2001
From: rtb-12 <ronit_c@me.iitr.ac.in>
Date: Tue, 1 Sep 2026 00:55:21 +0530
Subject: [PATCH] Narrow zip to the deflate codec by default

zip's default features enable every codec it supports. Only deflate is needed for the archives this crate extracts, so pull it with default-features off and add a zip-all-codecs feature that restores the rest.
---
 CHANGELOG.md | 8 ++++++++
 Cargo.toml   | 3 ++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index da4302b..f9ec18c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Added
+
+- Added a `zip-all-codecs` feature that restores `zip`'s full codec set.
+
+### Changed
+
+- `zip` is now pulled with `default-features = false` and only the `deflate` and `time` features. Its default features enable every codec it supports, of which only deflate is needed to extract the archives this crate handles; enable `zip-all-codecs` to get the others back.
+
 ## [v0.10.1](https://github.com/epwalsh/rust-cached-path/releases/tag/v0.10.1) - 2026-03-04
 
 ### Changed
diff --git a/Cargo.toml b/Cargo.toml
index b264637..7561ad1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,7 +36,7 @@ glob = "0.3"
 thiserror = "2.0"
 flate2 = "1.0"
 tar = "0.4"
-zip = "8.0"
+zip = { version = "8.0", default-features = false, features = ["deflate", "time"] }
 indicatif = { version = "0.18.0", optional = true }
 env_logger = { version = "0.11", optional = true }
 structopt = { version = "0.3", optional = true }
@@ -50,6 +50,7 @@ build-binary = ["env_logger", "structopt", "color-eyre", "progress-bar"]
 rustls-tls = ["reqwest/rustls-tls"]
 default-tls = ["reqwest/default-tls"]
 lzma = ["lzma-rs"]
+zip-all-codecs = ["zip/default"]
 progress-bar = ["indicatif"]
 
 [dev-dependencies]