Update dependency SharpZipLib to 1.3.3

[mend-for-github-com]

This PR contains the following updates:

Package	Type	Update	Change
SharpZipLib	nuget	minor	1.2.0 -> 1.3.3

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
High	7.3	CVE-2021-32840
Medium	4.0	CVE-2021-32841
Medium	4.0	CVE-2021-32842

---

Release Notes

icsharpcode/SharpZipLib (SharpZipLib)

v1.3.3

Another minor release, containing security fixes and smaller bugfixes.

Fixes:

• 🐛 specialized tar extract traversal by nils måsén
• 🐛 [#​635] bzip2 use explicit feature defs for vectorized memory move by Jackson Wood
• 🐛 [#​645] tar create translated files in temp by nils måsén

Smaller changes:

• 🔨 [#​604] Move the Password property from DeflaterOutputStream into ZipOutputStream by Richard Webb
• 🔨 [#​625] Make BZip2Constants static instead of sealed by Richard Webb
• 🔨 [#​626] make a couple of private functions static by Richard Webb

Other changes (not related to library code):

• 📚 [#​648] zip fix ZipStrings typo by Friedrich von Never
• 🚨 add tests for tar path traversal by nils måsén
• ⚙️ add codeql analysis by nils måsén
• 🚨 [#​636] Fix unstable tests and switch to dotcover by nils måsén
• 🚨 [#​634] add an async version of the WriteZipOutputStream benchmark by Richard Webb
• ⚙️ [#​628] Limit code coverage to windows CI by nils måsén
• 🚨 [#​627] fix the expected/actual value ordering in unit tests by Richard Webb

v1.3.2

Another minor release, containing security fixes and smaller bugfixes.
Additionally, this version will have an additional target framework, .NET Standard 2.1, which will see some speed improvements when
used in newer versions of .NET (Core), mainly in Bzip2.

Features

• [#​611] Bzip input stream simple vectorization by Konrad Kruczyński
• [#​351] Add support for Filename field in GZip by nils måsén

Smaller fixes and optimizations

• [#​579] Implement very simple ReadAsync in ZipAESStream by Richard Webb
• [#​587] Remove supported method checks from ZipEntry.CompressionMethod setter by Richard Webb
• [#​593] Simplify DropPathRoot and fix out of bounds issue by nils måsén
• [#​575] Replace uses of new T[0] with Array.Empty<T> by Richard Webb
• [#​583] Restore entry times on FastZip extract by nils måsén
• [#​517] Throw exception on Store+Descriptor entries by nils måsén
• [#​578] Fix typos in the StreamDecodingException doc comments by Richard Webb
• [#​577] Throw ZipException in ZipAESStream instead of generic Exception by Richard Webb
• [#​510] Build the test bootstrapper app as netcoreapp3.1 instead of netcoreapp2.0 by Richard Webb
• [#​546] Make pure private functions static by Richard Webb
• [#​554] Skip CRC calculation for AES zip entries by nils måsén
• [#​605] Suppress CA1707 warnings in the Constants classes by Richard Webb
• [#​549] Add .NET Standard 2.1 target framework by Cédric Luthi

Other changes (not related to library code)

• [#​586] Convert VB sample projects to PackageReference format by Richard Webb
• [#​533] Convert the C# sample projects to PackageReference format by Richard Webb
• [#​457] add basic async unit tests for the inflator/deflator streams by Richard Webb
• [#​588] Add a simple async read test for ZipFile by Richard Webb
• [#​621] unify PR/push CI build actions by nils måsén
• [#​616] Change the build status badge to reference github actions by Richard Webb
• [#​603] pass CreateZip tests that are within time tolerance by nils måsén
• [#​602] Update test/coverage packages and push to codecov by nils måsén
• [#​601] pass tests that are within time tolerance by nils måsén
• [#​599] Use net46 as CI target framework for windows tests by nils måsén
• [#​594] Remove the local nuget.config files from the test projects by Richard Webb
• [#​553] Remove broken codacy integration by nils måsén
• [#​542] Build and publish documentation on release by nils måsén

v1.3.1

Minor release, mainly to address the incorrect file version of v1.3.0, but also contains some security fixes and performance improvements.

Highlights

• Correct FileVersion and AssemblyVersion
• Security fixes for ZipFile and Zip*Streams
• Improved CRC32 performance
• BZip2 compression support for Zip files

Features

• [#​355] Wire up BZip2 compression support for Zip files by Richard Webb

Fixes

• [#​475] Fix updating zips with descriptor entries by Richard Webb & nils måsén
• [#​516] Improve CRC32 performance by Nelson Gomez
• [#​538] Use RNGCryptoServiceProvider for crypto headers by nils måsén
• [#​539] Use securely generated random temporary file names by nils måsén
• [#​509] Make PutNextEntry throw if the entry is AES and no password has been set by Richard Webb

Other changes (not related to library code)

• [#​541] Update csproj for new release by nils måsén
• [#​530] Fix Codacy Workflows by nils måsén
• [#​529] Add release workflow by nils måsén
• [#​511] Move the 7zip helper functions into their own class for easier reuse by Richard Webb
• [#​525] Update the sample projects to use the v1.3 release by Richard Webb
• [#​522] Use PackageIcon instead of PackageIconUrl in csproj by nils måsén
• [#​523] Fix Codacy workflows by nils måsén

v1.3.0

Highlights

• AES encryption fixes and support in FastZip
• File name encoding support for Tar
• Improved Unix timestamp support
• Better handling of entry file names
• Fix errors with entries using Stored compression method

Changes

• TarArchive.ExtractContents() now needs another parameter set to true to allow the extraction to traverse outside of the target directory.
• TarArchive constructors now includes an Encoding parameter. Omitting it will discard any non-ASCII bytes in file names.

Fixes

• [#​503] Consider AES overhead when testing encrypted folder entries by Richard Webb
• [#​452] Ensure crypto streams are disposed in ZipFile.GetOutputStream by Richard Webb
• [#​333] Handle unsupported compression methods in ZipInputStream better by Richard Webb
• [#​402] Only convert entry.Name once when accessing updateIndex by Vladyslav Taranov
• [#​353] Fix ZipFile.TestLocalHeader CompressionMethod resolving for AES entries by Richard Webb
• [#​460] Account for AES overhead in compressed entry size by Richard Webb
• [#​422] Change ZipOutputStream.PutNextEntry to explicity validate the requested compression method by Richard Webb
• [#​467] Allow seeking a PartialInputStream to the very end by Víctor M. González
• [#​440] Use CompressionMethodForHeader for header entries by Richard Webb
• [#​420] Throw NotSupportedException in ZipFile.Add when trying to add AES entry by Richard Webb
• [#​421] Have ZipFile.Add validate compression compability internally by Richard Webb
• [#​387] Better handle baseStreams closing themselves unexpectedly by Richard Webb
• [#​408] When searching for the Zip64 end of central directory locator, pay attention to its fixed size by Richard Webb
• [#​406] Skip forced Deflate flush when using Stored compression by nils måsén
• [#​362] Don't call CleanName from the ZipEntry constructor by Richard Webb
• [#​465] Use correct count in ZipAESStream.ReadBufferedData by Víctor M. González
• [#​390] Ensure GZipOutputStream headers are written before flush by Richard Webb
• [#​498] Use string.Trim to trim strings by Richard Webb
• [#​432] Throw ArgumentNullException in BZip2 by Richard Webb
• [#​519] Restrict path traversal on TarArchive extraction by nils måsén

Features

• [#​201] Raise ProcessDirectory event for FastZip extract by Stevie-O
• [#​380] Add support for AES encryption in FastZip.CreateZip by Richard Webb
• [#​497] Transform new entry names using an INameTranform in ZipOutputStream by Richard Webb
• [#​482] Add variants of FastZip.CreateZip taking IScanFilter instead of strings by Richard Webb
• [#​455] Add FastZip.CreateZip with a leaveOpen parameter by Richard Webb
• [#​433] Restore directory timestamps when extracting with FastZip by Richard Webb
• [#​472] Allow ZipFile to accept empty strings as passwords when decrypting AES entries by Richard Webb
• [#​364] Add nameEncoding parameter to Tar entries by Yusuke Ito
• [#​463] Improve support for Unix timestamps in ZIP archives by Bastian Eicher

Other changes (not related to library code)

• [#​346] Add a Security Policy by nils måsén
• [#​451] Minimize and update sample app package dependencies by Richard Webb
• [#​505] Expect ZipEntry clean name test to be positive by nils måsén
• [#​504] Fix warning about missing doc comment in FastZip.CreateZip by Richard Webb
• [#​374] Update Docs generation by nils måsén
• [#​431] Remove the link to the sharpdevelop forum from readme.md by Richard Webb
• [#​425] Update Microsoft.SourceLink.GitHub to the 1.0.0 release version by Richard Webb
• [#​483] Suppress CA1707 warnings from LzwConstants by Richard Webb
• [#​458] Dispose of entry streams returned by ZipFile.GetInputStream by Richard Webb
• [#​488] Add [MemoryDiagnoser] to the zip input/output stream benchmark classes by Richard Webb
• [#​489] Remove duplicate ICSharpCode.SharpZipLib.snk by Richard Webb
• [#​494] Use the Range to test different compression levels in InflaterDeflaterTestSuite by Richard Webb
• [#​502] Fix tests and ZipEntry DateTime Kind by nils måsén
• [#​476] Remove duplicated words in comments by Richard Webb
• [#​477] Fix spelling errors in comments by Richard Webb
• [#​479] Streamline and update VB sample projects by Richard Webb
• [#​445] Make InvalidHeaderException serializable by Richard Webb
• [#​450] Fix CA1200 code analyzer warnings by Richard Webb
• [#​435] Add unit test for ZipFile.Add(string fileName, string entryName) by Richard Webb
• [#​448] Fix unit test assert argument order by Richard Webb
• [#​461] Fix Exception doc comments by Richard Webb
• [#​453] Fix the 7-zip interop tests in the .Net 4.6 test build by Richard Webb
• [#​466] Improve the ZipFileStoreAesPartialRead test to test multiple block sizes by Richard Webb
• [#​468] Add test for adding empty folders to archives using FastZip by Richard Webb
• [#​473] Add a Nuget badge to readme.md by Richard Webb
• [#​469] Add test for writing using a zero byte buffer by Richard Webb
• [#​389] Simplify Documentation generation by Robin Sue
• [#​437] Add a ZipCrypto/7zip interop test to the ZipEncryptionHandling tests by Richard Webb
• [#​441] Update the benchmark project to BenchmarkDotNet 0.12.1 by Richard Webb
• [#​444] Multi-target unit tests for .NET Core 2.0 and .NET FW 4.6 by Richard Webb

---

• If you want to rebase/retry this PR, check this box