Bump com.github.junrar:junrar from 8.1.1 to 8.1.2

[dependabot]

Bumps com.github.junrar:junrar from 8.1.1 to 8.1.2.

Release notes

Sourced from com.github.junrar:junrar's releases.

Release v8.1.2

Changelog

🐛 Fixes

rar5

• refuse symlink targets with '..' after a name (19e06c1)
• keep absolute link names under the destination and walk symlinks from the canonical root (43b325e)
• anchor link paths on the canonical destination before creating directories (6bebb62)

unscoped

• replay a solid stream after a failed extraction (b9b61ce)
• restart the RAR 1.4 solid ordinal when replaying a solid stream (fdc86db)
• replay solid stream when re-extracting the same entry (d3bdab3)
• create regular files under the canonical destination (fd18ff6)
• deliver output past the declared size instead of rejecting it (82a623b)
• extract RAR5 entries of unknown size instead of an empty file (763b881)
• report a stream failure on the read reaching the declared size (46bbc83)
• report a stream failure on close once the full entry was read (683a91b)
• extract empty entries through getInputStream too (f4f2059)
• report extraction failures through getInputStream instead of a normal EOF (67474bd)

🧪 Tests

rar5

• pin each link-destination guard with a failing-without test (c9c80bd)

unscoped

• pin a RAR5 unknown-size entry in the regression corpus (8d471c3)

🛠 Build

deps

• bump com.fasterxml.jackson.core:jackson-databind (d756daf)
• bump com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (014c70a)
• bump io.github.ben-manes.versions.settings (394d5aa)
• bump org.bouncycastle:bcprov-jdk18on from 1.85.2 to 1.86 (1677f5a)
• bump com.diffplug.spotless from 8.10.1 to 8.10.2 (55450fc)
• bump gradle/actions from 6.3.0 to 6.4.0 (4611f3f)
• bump org.jreleaser from 1.25.0 to 1.26.0 (1d10acc)
• bump actions/setup-java from 5 to 6 (ac678ad)
• bump com.diffplug.spotless from 8.10.0 to 8.10.1 (682b75f)

unscoped

• enable immutable github releases with jreleaser (c29e60f)

📝 Documentation

• record the regular-file and symlink-chain follow-ups to GHSA-ccq9-hw6f-p9cm (e22b8c5)
• state that Archive is not thread-safe and how stream failures surface (621f6de)

Contributors

... (truncated)

Changelog

Sourced from com.github.junrar:junrar's changelog.

8.1.2 (2026-10-09)

🐛 Fixes

rar5

• refuse symlink targets with '..' after a name (19e06c1)
• keep absolute link names under the destination and walk symlinks from the canonical root (43b325e)
• anchor link paths on the canonical destination before creating directories (6bebb62)

unscoped

• replay a solid stream after a failed extraction (b9b61ce)
• restart the RAR 1.4 solid ordinal when replaying a solid stream (fdc86db)
• replay solid stream when re-extracting the same entry (d3bdab3)
• create regular files under the canonical destination (fd18ff6)
• deliver output past the declared size instead of rejecting it (82a623b)
• extract RAR5 entries of unknown size instead of an empty file (763b881)
• report a stream failure on the read reaching the declared size (46bbc83)
• report a stream failure on close once the full entry was read (683a91b)
• extract empty entries through getInputStream too (f4f2059)
• report extraction failures through getInputStream instead of a normal EOF (67474bd)

🧪 Tests

rar5

• pin each link-destination guard with a failing-without test (c9c80bd)

unscoped

• pin a RAR5 unknown-size entry in the regression corpus (8d471c3)

🛠 Build

deps

• bump com.fasterxml.jackson.core:jackson-databind (d756daf)
• bump com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (014c70a)
• bump io.github.ben-manes.versions.settings (394d5aa)
• bump org.bouncycastle:bcprov-jdk18on from 1.85.2 to 1.86 (1677f5a)
• bump com.diffplug.spotless from 8.10.1 to 8.10.2 (55450fc)
• bump gradle/actions from 6.3.0 to 6.4.0 (4611f3f)
• bump org.jreleaser from 1.25.0 to 1.26.0 (1d10acc)
• bump actions/setup-java from 5 to 6 (ac678ad)
• bump com.diffplug.spotless from 8.10.0 to 8.10.1 (682b75f)

unscoped

• enable immutable github releases with jreleaser (c29e60f)

📝 Documentation

• record the regular-file and symlink-chain follow-ups to GHSA-ccq9-hw6f-p9cm (e22b8c5)
• state that Archive is not thread-safe and how stream failures surface (621f6de)

Commits

• b9b61ce fix: replay a solid stream after a failed extraction
• fdc86db fix: restart the RAR 1.4 solid ordinal when replaying a solid stream
• d3bdab3 fix: replay solid stream when re-extracting the same entry
• d756daf build(deps): bump com.fasterxml.jackson.core:jackson-databind
• 014c70a build(deps): bump com.fasterxml.jackson.datatype:jackson-datatype-jsr310
• 394d5aa build(deps): bump io.github.ben-manes.versions.settings
• 1677f5a build(deps): bump org.bouncycastle:bcprov-jdk18on from 1.85.2 to 1.86
• 55450fc build(deps): bump com.diffplug.spotless from 8.10.1 to 8.10.2
• e22b8c5 docs: record the regular-file and symlink-chain follow-ups to GHSA-ccq9-hw6f-...
• 19e06c1 fix(rar5): refuse symlink targets with '..' after a name
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Qodana for JVM

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

• Register at Qodana Cloud and configure the action
• Use GitHub Code Scanning with Qodana
• Host Qodana report at GitHub Pages
• Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2026.2.2
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions