[lexoliu]

We caught RUSTSEC-2026-0367, RUSTSEC-2026-0368, and RUSTSEC-2026-0369 during a cargo audit run in waterui. To help downstream users of MathCAT get these security fixes as soon as possible, this PR upgrades the runtime and build-time zip dependencies to 9.0.4 and adapts the two affected filename call sites to the new API (while keeping all existing compression features and archive formats intact).

Tested & Verified:

• Cargo test (default, include-zip, no-unsafe)
• Cargo clippy (default, no-unsafe) — the 4 dead-code warnings under include-zip also exist on main.
• Standard/minimized rules packaging and archive integrity checks.

Hope we can get this merged and released soon!

[moritz-gross]

thanks for the PR, we'll look into it next week.

also, let us know if we can help in any other way to use MathCAT for WaterUI

[NSoiffer]

Looks good. Thanks.

[github-actions]

Linux library size: 0.58 MiB (+1.02%)

Revision	Release liblibmathcat.so
Base (72e41ba)	0.58 MiB (605,800 bytes)
PR (fe89897)	0.58 MiB (611,992 bytes)
Change	+6,192 bytes (+1.02%)

Built with default features, Rust 1.96.0, and Ubuntu 24.04. Workflow run.

[lexoliu]

thanks for the PR, we'll look into it next week.

also, let us know if we can help in any other way to use MathCAT for WaterUI

Thanks for merging this so quickly! Could you publish a version on crates.io so that we can depend it?