[loganaden]

Update to zlib v1.4 which fixes CVE-2026-85091.

[Byron]

Something went wrong, and I think it was on my side. Meantime the release was automated, so let's try this then.

---

Yes, the published crate is missing the entire zlib update. This branch restores exactly the revision the same author submitted earlier.

Version | Bundled zlib revision -- | -- Author’s earlier PR #281 | 99623ef — zlib 1.4 Published libz-sys 1.1.32 | da607da — zlib 1.3.2 This branch | 99623ef — zlib 1.4

The cause is release commit f0414fc: alongside bumping the crate version, it changed the submodule pointer back to 1.3.2. I downloaded the published crate and confirmed it actually contains 1.3.2.

That omission is material. The 1.4 changelog includes a gzwrite() buffer-overflow fix, fixes for leaking uninitialized memory, and several other out-of-bounds access fixes.

The new commit’s mention of another CVE adds no new upstream code compared with the earlier PR: both select the exact same commit. A corrective release would need a new crate version; this branch still says 1.1.32.

No builds or tests run; this was a history and published-source comparison. These fixes apply when using bundled stock zlib; system zlib and zlib-ng depend on their own versions.

**Yes, the published crate is missing the entire zlib update.** This branch restores exactly the revision the same author submitted earlier.

Version	Bundled zlib revision
Author’s earlier [PR #281](#281)	99623ef — zlib 1.4
Published libz-sys 1.1.32	da607da — zlib 1.3.2
This branch	99623ef — zlib 1.4

The cause is release commit f0414fc: alongside bumping the crate version, it changed the submodule pointer back to 1.3.2. I downloaded the published crate and confirmed it actually contains 1.3.2.

That omission is material. The [1.4 changelog](https://github.com/madler/zlib/blob/99623ef7097352da7993ba614161fd6a311e046e/ChangeLog) includes a gzwrite() buffer-overflow fix, fixes for leaking uninitialized memory, and several other out-of-bounds access fixes.

The new commit’s mention of another CVE adds no new upstream code compared with the earlier PR: both select the exact same commit. A corrective release would need a new crate version; this branch still says 1.1.32.

No builds or tests run; this was a history and published-source comparison. These fixes apply when using bundled stock zlib; system zlib and zlib-ng depend on their own versions.