GHSA-gmfj-vffv-32pw: 
Rust vulnerability analysis and mitigation

On current master (92c037b2 / 9.0.5), ZipStreamReader with enforce_header_consistency(true) can finish successfully without validating the ZIP end record. Central-directory parsing stops on any error, and local offsets are normalized by the first central offset, so common shifts are accepted. Regression cases are a ZIP truncated immediately before its EOCD and a ZIP with shifted central local-header offsets. A proposed fix and tests are prepared locally on security/stream-footer-validation. Please keep the patch private in a temporary fork until a fixed release is available.