v9.0.2

Fixed

• Android: unzip/unzipWithPassword no longer extract symlink entries — zip4j's default extractSymbolicLinks=true allowed a crafted archive to plant a symlink resolving outside the destination directory (#357, fixed in #361)
• iOS: zip/zipWithPassword with a files array now add directory items recursively with entry paths relative to the listed directory, matching Android (previously directories produced empty entries and their contents were silently dropped) (#339, fixed in #362)

Thanks to @kimdu0 for the thorough security report and @trustytrojan for the clear cross-platform analysis!