Override adm-zip to 0.6.0 to clear GHSA-xcpc-8h2w-3j85

[felladrin]

Description

Clears Dependabot alert #32 (GHSA-xcpc-8h2w-3j85, high, "crafted ZIP file triggers 4GB memory allocation") by overriding adm-zip to 0.6.0.

onnxruntime-node, added in #2235, declares adm-zip: ^0.5.16. The advisory is fixed in 0.6.0, which that range cannot reach, so npm keeps resolving 0.5.18 and the alert cannot be closed by a normal dependency bump. An overrides entry pulls 0.6.0 in anyway.

npm audit goes from 2 high advisories to zero.

Why the override is safe

onnxruntime-node uses adm-zip in exactly one place, script/install-utils.js, and only through new AdmZip(packageFilePath) and zip.getEntry(...). Both behave the same in 0.6.0, verified directly:

version: 0.6.0
new AdmZip(buffer): true | getEntry: true | extractEntryTo: function | readFile: hello

The only other change is the engine requirement moving from node >=12 to node >=14, and this project already requires node >=22.

The override is unscoped rather than nested under onnxruntime-node, so it keeps applying if another dependency pulls adm-zip in later. onnxruntime-node is the only consumer today.

Exposure, for context

Worth knowing while assessing urgency: this code path is not reached by a normal install. adm-zip is used by onnxruntime-node's postinstall script to unpack binaries that are not bundled in the npm package, chiefly the CUDA execution provider. On a default CPU install the script exits early and never opens an archive, and the archive it would open comes from Microsoft's NuGet feed rather than from user input.

So this is housekeeping to get the alert closed and keep npm audit clean, not an exploitable path in MiniSearch. The proper long-term fix is upstream relaxing the range in onnxruntime-node; the override can be dropped once that ships.

Type of Change

• Bug fix
• New feature
• Documentation
• Other (refactor, build, chore)

How to test

1. npm install, then npm ls adm-zip shows adm-zip@0.6.0 under onnxruntime-node@1.27.0.
2. npm audit reports found 0 vulnerabilities (2 high before this change).
3. npm run test passes (288 tests) and npm run lint passes.
4. npx vitest run --config vitest.integration.config.ts passes (6 tests), which loads the real ONNX model and so proves onnxruntime-node still works under the override.

I could not test the CUDA install path, since that needs Linux x64 with an NVIDIA GPU. It is the only place adm-zip actually runs, so the API check quoted above stands in for it.

Checklist

• npm run lint passes
• Tests pass (npm run test), with tests added where it made sense

No new tests: the change is a dependency resolution constraint, and the existing integration test already covers the consumer still working.

Security, performance, or breaking changes

Security: closes one high-severity advisory. No behavior change for users, and nothing to migrate.