Bump sevenz-rust2 from 0.20.2 to 0.21.4

[dependabot]

Bumps sevenz-rust2 from 0.20.2 to 0.21.4.

Changelog

Sourced from sevenz-rust2's changelog.

0.21.4 - 2026-08-01

Fixed

• Fixed an integer overflow when summing attacker-controlled coder stream counts while parsing a block header. Malformed archives panicked in debug builds and bypassed the stream-count bound in release builds. They are now rejected with an error. (#127, thanks @​tyrex-vberthier)

0.21.3 - 2026-07-05

Changed

• Cache most recent AES key derivation to improve performance (#118, thanks @​jdlien)

Fixed

• Hardened the library against malicious or malformed archives that could otherwise cause a panic, an infinite loop, or an unbounded allocation while parsing or decoding.

0.21.2 - 2026-07-01

Fixed

• Decode 7z folders that layer a single-input filter (e.g. Delta) on top of a BCJ2 coder (Method = Delta BCJ2). These folders previously failed to decode with an Unsupported method error because the decoder required the folder's final output coder to be BCJ2 itself. (#117, thanks @​trevorWieland)

0.21.1 - 2026-06-23

Fixed

• Fix security issue were malicious 7z files could write files outside the destination directory. Reported by @​lintowe (#116)

0.21.0 - 2026-04-25

Changed

• Bumped MSRV to 1.93 (required by nt-time 0.15)

Updated

• Bumped nt-time to 0.15 (#105)
• Bumped aes to 0.9 and cbc to 0.2 (cipher 0.5) (#111, #110)

Fixed

• K_ANTI property block was not written for archives containing only anti-items, so anti-items were extracted as 0-byte files instead of acting as deletion markers (#112, thanks @​uraf)

... (truncated)

Commits

• f8c4668 Fix integer overflow in debug mode
• bffd561 Update lzma-rust2 requirement from 0.17 to 0.18
• 505fb83 Update lz4_flex requirement from 0.13 to 0.14
• f3dc394 Update lzma-rust2 requirement from 0.16 to 0.17
• 9d1ccab Hardening against malicious or malformed archives
• 04fbf12 Cache the most recent AES-256 key derivation (#118)
• dfaf0df Release v0.21.2
• 15952ee Fix decoding of folders with a filter on top of BCJ2
• ef760b6 7z files could write files outside the destination directory
• 3ce5d2a Bump actions/checkout from 6 to 7
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #165.